CVE-2021-44854

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API publicly caches results from private wikis...

多款Nintendo产品安全漏洞

Nintendo Mario Kart and others are products of the Japanese company Nintendo.Nintendo Mario Kart is a game.Nintendo Splatoon is a third-person shooter game series.Nintendo Switch Sports is a sports video game. Nintendo Mario Kart,Nintendo Splatoon,Nintendo Switch Sports,Nintendo Super Mario Maker...

Remote code execution

If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution. This vulnerability affects Firefox 102, Firefox ESR 91.11, Thunderbird 102, and Thunderbird 91.11...

Design/Logic Flaw

If a Thunderbird user replied to a crafted HTML email containing a meta tag, with the meta tag having the http-equiv="refresh" attribute, and the content attribute specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration to block remote content. I...

lighttpd 1.4.56 < 1.4.59 Denial of Service

According to its banner, the version of lighttpd running on the remote host is 1.4.56, 1.4.57 or 1.4.58. It is, therefore, affected by a a denial of service because connectionreadheadermore in connections.c has a typo that disrupts use of multiple read operations on large headers. Note that the...

CVE-2022-45041

SQL Injection exits in xinhu 2.5.0...

GHSA-VXMC-QG5X-PVFX "Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data

An issue was discovered in the fpnewsletter aka Newsletter subscriber management extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via createAction operations...

CVE-2021-32415

EXEMSI MSI Wrapper Versions prior to 10.0.50 and at least since version 6.0.91 will introduce a local privilege escalation vulnerability in installers it creates...

CVE-2022-46355

A vulnerability has been identified in SCALANCE X204RNA HSR All versions V3.2.7, SCALANCE X204RNA PRP All versions V3.2.7, SCALANCE X204RNA EEC HSR All versions V3.2.7, SCALANCE X204RNA EEC PRP All versions V3.2.7, SCALANCE X204RNA EEC PRP/HSR All versions V3.2.7. The affected products are...

PT-2022-16046

Name of the Vulnerable Software and Affected Versions Loofah versions 2.2.0 through 2.19.0 Description Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. It uses recursion for sanitizing CDATA sections, making it susceptible t...

Design/Logic Flaw

Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete...

PT-2022-35993 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.10 Description: The issue is related to a possible memory leak in the register pcpu function. The actual impact and attack plausibility have not yet been proven. Recommendations: For versions prior to...

Input validation

Improper neutralization of Server-Side Includes SSW within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage of Content Types' may execute an arbitrary Perl script and/or an arbitrary OS command. Affected products/versions are as follows: Movable...

PT-2022-22577 · WordPress · Awesome Support

Name of the Vulnerable Software and Affected Versions: Awesome Support WordPress plugin versions prior to 6.1.2 Description: The issue allows a low-privileged user, such as a subscriber, to download arbitrary exported tickets via an IDOR vector. This occurs because the plugin does not ensure that...

Hewlett Packard Enterprise NetBatch-Plus 授权问题漏洞

Hewlett Packard Enterprise NetBatch-Plus is a path application from Hewlett Packard Enterprise that provides a screen-driven interface to the NetBatch job management system. An unauthorized vulnerability exists in Hewlett Packard Enterprise NetBatch-Plust 9189h01 and later, versions prior to...

PT-2022-6734 · Ruby +10 · Cgi +10

Name of the Vulnerable Software and Affected Versions: cgi gem versions 0.1.0.0 through 0.1.0.1 cgi gem versions 0.2.0 through 0.2.1 cgi gem versions 0.3.0 through 0.3.4 Description: The issue is related to HTTP response splitting, which occurs when untrusted user input is inserted into an HTTP...

CVE-2022-42119

Certain Liferay products are vulnerable to Cross Site Scripting XSS via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8...

CVE-2022-43030

Siyucms v6.1.7 was discovered to contain a remote code execution RCE vulnerability in the background. SIYUCMS is a content management system based on ThinkPaP5 AdminLTE. SIYUCMS has a background command execution vulnerability, which can be used by attackers to gain server privileges...

CVE-2022-43967

Concrete CMS formerly concrete5 below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the multilingual report due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+...

Information disclosure

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 15.3.5, all versions starting from 15.4 before 15.4.4, all versions starting from 15.5 before 15.5.2. A malicious maintainer could exfiltrate a Datadog integration's access token by modifying the...