GHSA-68G5-8Q7F-M384 Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL...

GHSA-3WQF-4X89-9G79 Bootstrap vulnerable to Cross-Site Scripting (XSS)

In Bootstrap starting in version 2.3.0 and prior to 3.4.0, as well as 4.x before 4.1.2, XSS is possible in the collapse data-parent attribute...

CVE-2021-0194

Improper access control in the IntelR In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enable escalation of privilege via network access...

CVE-2021-0126

Improper input validation for the IntelR Manageability Commander before version 2.2 may allow an authenticated user to potentially enable escalation of privilege via adjacent access...

CVE-2022-1650

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2...

CVE-2022-29930

SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor version 2.0.1...

Intel RealSense ID Solution F450 安全漏洞

Intel RealSense ID is a facial recognition solution from Intel Corporation USA that relies on its RealSense depth sensing technology. A security vulnerability exists in Intel RealSense ID Solution F450 prior to version 2.6.0.74, which can be exploited by an attacker to access sensitive informatio...

CVE-2021-33316

The TRENDnet TI-PG1284i switchhw v2.0R prior to version 2.0.2.S0 suffers from an integer underflow vulnerability. This vulnerability exists in its lldp related component. Due to lack of proper validation on length field of ChassisID TLV, by sending a crafted lldp packet to the device, integer...

PRIMEUR SPAZIO 安全漏洞

PRIMEUR SPAZIO is a secure hosted file transfer from PRIMEUR Switzerland. A security vulnerability exists in PRIMEUR SPAZIO version 2.5.1.954. An attacker could exploit the vulnerability to obtain sensitive data via a specially crafted HTTP request...

CVE-2022-23704

A potential security vulnerability has been identified in Integrated Lights-Out 4 iLO 4. The vulnerability could allow remote Denial of Service. The vulnerability is resolved in Integrated Lights-Out 4 iLO 4 2.80 and later...

CVE-2022-28162

Brocade SANnav before version SANnav 2.2.0 logs the REST API Authentication token in plain text...

CVE-2022-28162

Brocade SANnav before version SANnav 2.2.0 logs the REST API Authentication token in plain text...

GPAC 安全漏洞

GPAC is an open source multimedia framework. A security vulnerability exists in GPAC version 2.1-DEV-rev87-g053aae8-master, which originates from an assertion failure of the function BSReadByte in utils/bitstream.c. The vulnerability can be exploited to implement a denial-of-service attack. An...

LibreHealth EHR 跨站脚本漏洞

LibreHealth EHR is a clinically-focused Electronic Health Record EHR system designed to be easy to use out-of-the-box or customized for use in a variety of healthcare settings. A security vulnerability exists in LibreHealth EHR 2.0.0, which stems from the lack of filter escaping for the GET...

CVE-2021-42185

wdja v2.1 is affected by a SQL injection vulnerability in the foreground search function...

PT-2022-18807 · Skycaiji · Skycaiji

Name of the Vulnerable Software and Affected Versions: Skycaiji version 2.4 Description: The issue is related to a remote code execution RCE vulnerability. It can be exploited via the "/SkycaijiApp/admin/controller/Develop.php" API endpoint. Recommendations: For Skycaiji version 2.4, consider...

Skycaiji 安全漏洞

Skycaiji Blue Sky Collector is a free data collection and publishing crawler software from China Nanchang Zhuolan Technology Co., Ltd, developed with php+mysql and can be deployed on cloud servers. A security vulnerability exists in Skycaiji version 2.4, which originated from the discovery that...

GeoServer 代码问题漏洞

GeoServer is an open source software server written in Java. It allows users to share and edit geospatial data. A security vulnerability exists in GeoServer that originates from an option that allows SSRF to set up proxy hosts through. The following products and versions are affected: versions...

git-pull-or-clone 参数注入漏洞

git-pull-or-clone is used to ensure that a git repository exists on disk and is up-to-date. A parameter injection vulnerability exists in git-pull-or-clone versions prior to 2.0.2, which can be exploited to cause arbitrary command injection...

PT-2022-11522 · Ping Identity · Pingid Windows Login

Name of the Vulnerable Software and Affected Versions: PingID Windows Login versions prior to 2.7 Description: A misconfiguration of RSA in PingID Windows Login is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass. Recommendations: For versions prior to 2.7, update t...