PT-2022-3521 · Schneider Electric · Ecostruxure Power Commission

Name of the Vulnerable Software and Affected Versions: EcoStruxure Power Commission versions prior to V2.22 Description: A vulnerability exists that could cause all remote domains to access the resources supplied by the server when an attacker sends a fetch request from a third-party site or...

CVE-2022-31398

A cross-site scripting XSS vulnerability in /staff/tools/custom-fields of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email name field...

CVE-2022-31400

A cross-site scripting XSS vulnerability in /staff/setup/email-addresses of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email name field...

PT-2022-20491

Name of the Vulnerable Software and Affected Versions Biscuit versions 1 Description The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. This would allow an attacker to create a token with any access level. The version 2 of...

Double Public Key Signing Function Oracle Attack on `ed25519-dalek`

Versions of ed25519-dalek prior to v2.0 model private and public keys as separate types which can be assembled into a Keypair, and also provide APIs for serializing and deserializing 64-byte private/public keypairs. Such APIs and serializations are inherently unsafe as the public key is one of th...

CVE-2022-31402

ITOP v3.0.1 was discovered to contain a cross-site scripting XSS vulnerability via /itop/webservices/export-v2.php...

UBUNTU-CVE-2022-26377

Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions...

USN-5474-1 varnish vulnerabilities

It was dicovered that Varnish Cache did not clear a pointer between the handling of one client request and the next request within the same connection. A remote attacker could possibly use this issue to obtain sensitive information. CVE-2019-20637 It was discovered that Varnish Cache could have a...

directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tar

...

LibreHealth EHR 跨站脚本漏洞

LibreHealth EHR is a clinically-focused electronic health record HER system designed to be both easy to use out of the box and customizable for use in a variety of healthcare settings. libreHealth EHR 2.0.0 is vulnerable to a cross-site scripting vulnerability for which no detailed vulnerability...

Poly EagleEye Director 操作系统命令注入漏洞

Poly EagleEye Director is a conference camera system with automated people tracking from Poly USA. An operating system command injection vulnerability exists in Poly EagleEye Director II version 2.2.1.1, which stems from...

LibreHealth EHR 跨站脚本漏洞

LibreHealth EHR is a clinically-focused electronic health record EHR system designed to be easy to use out of the box and customizable for use in a variety of healthcare settings. a cross-site scripting vulnerability exists in LibreHealth EHR Base version 2.0.0. The vulnerability stems from a...

LibreHealth EHR 跨站脚本漏洞

LibreHealth EHR is a clinically-focused electronic health record EHR system designed to be both easy to use out of the box and customizable for use in a variety of healthcare settings.LibreHealth EHR 2.0.0 is vulnerable to a cross-site scripting vulnerability for which no detailed vulnerability...

CVE-2022-29767

adbyby v2.7 allows external users to make connections via port 8118. This can cause a program logic error and lead to a Denial of Service DoS via high CPU usage due to a large number of connections...

XXL-JOB 跨站脚本漏洞

XXL-JOB is a java-based distributed task scheduling platform from the XXL XXL-JOB community. xxl-job version 2.3.0 is vulnerable to a cross-site scripting vulnerability. An attacker can exploit this vulnerability to execute JavaScript programs...

DEBIAN-CVE-2022-31782

ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow...

CVE-2022-31328

Online Ordering System By janobe 2.3.2 has SQL Injection via /ordering/admin/products/index.php?view=edit&id=...

CVE-2022-29734

A cross-site scripting XSS vulnerability in ICT Protege GX/WX v2.08 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter...

CVE-2022-24701

An issue was discovered in WinAPRS 2.9.0. A buffer overflow in national.txt processing allows a local attacker to cause a denial of service or possibly achieve code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

FreeType 缓冲区错误漏洞

FreeType is an open source font rendering library written in the C language. A security vulnerability exists in ftbench.c in FreeType Demo Programs version 2.12.1 and earlier versions, which can be exploited by an attacker to cause a heap-based buffer overflow...