Liferay Portal 跨站脚本漏洞

Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network and more. A security vulnerability exists in Liferay Portal...

PT-2022-5187 · Ibm · Ibm Cognos Analytics

Name of the Vulnerable Software and Affected Versions: IBM Cognos Analytics versions 11.1.7 through 11.2.1 Description: The issue is related to the transmission of critical information in plain text. Exploitation of this issue may allow a remote attacker to disclose protected information. It is...

GitLab 路径遍历漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A path traversal vulnerability exists in GitLab CE/EE versions 12.7 through...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A security vulnerability exists in GitLab CE/EE versions 10.0 to 15.2.5, 15.3 t...

depend (>=0.2.0 <=0.3.0), ekrhizoc (>=0.0.5 <=0.1.0) +12 more potentially affected by CVE-2022-36070 via poetry (>=1.0.0 <=1.1.5)

poetry PYPI version =1.0.0, =0.2.0, =0.0.5, =2020.1.0, =0.1.4, =5.2.0, =0.0.5, =0.1.0, =0.4.0, =0.1.0, =0.3.0, =0.1.3, =0.0.1, =0.1.4 Source cves: CVE-2022-36070 Source advisory: OSV:GHSA-J4J9-7HG9-97G6...

03-api-solid (>=1.0.0 <=1.1.2), 0uth (>=1.0.5 <=1.2.1) +2535 more potentially affected by CVE-2022-39288 via fastify (>=4.0.2 <=4.7.0)

fastify NPM version =4.0.2, =1.0.0, =1.0.5, =1.0.3, =0.0.3, =1.0.0, =3.0.0, =0.1.0, =2.0.0, =3.0.0, =0.0.1, =0.1.0, =2.0.0, =1.0.1, =1.0.6 and more Source cves: CVE-2022-39288 Source advisory: OSV:GHSA-455W-C45V-86RG...

@magicfinn/gatsby-theme-finn-default (>=1.0.0 <=2.0.40), @panstav/ozen-dashboard-shared (>=0.0.2 <=0.0.7) potentially affected by CVE-2022-35923 via v8n (>=1.2.3 <=1.3.3)

v8n NPM version =1.2.3, =1.0.0, =0.0.2, =0.0.7 Source cves: CVE-2022-35923 Source advisory: OSV:GHSA-XRX9-GJ26-5WX9...

ae.teletronics.nlp:entityextraction (=1.3), ae.teletronics.nlp:w2vec (=1.0) +20762 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-java (>=2.0.3 <=3.16.1)

com.google.protobuf:protobuf-java MAVEN version =2.0.3, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2022-3171 Source advisory: OSV:GHSA-H4H5-3HR4-J3G2...

ai.bareun.tagger:bareun (>=1.0.0 <=1.4.1), ai.djl.serving:serving (=0.19.0) +3739 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-java (>=3.21.0-rc-1 <=3.21.6)

com.google.protobuf:protobuf-java MAVEN version =3.21.0-rc-1, =1.0.0, =3.42.0.2-1-3.4, =0.0.1, =22.3.2, =22.3.2, =22.3.2, =22.3.2, =1.0.0-beta01, =1.0.0-beta01, =1.0.0-beta06 - at.ac.ait.lablink.clients:universalapiclient =0.1.0 and more Source cves: CVE-2022-3171 Source advisory:...

PT-2022-34626 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v3.18 through v5.15.67 Description: The issue concerns absolute zero lowcore corruption on boot. It was introduced in version v3.18 and fixed in version v5.15.68. The actual impact and attack plausibility have not yet be...

PT-2023-6741 · Ibm +3 · Jsse +5

Name of the Vulnerable Software and Affected Versions: IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE versions 8.0.7.0 through 8.0.7.11 Description: The issue is related to the use of flawed cryptographic algorithms in the Java Secure Socket Extension JSSE and IBMJCEPlus...

Hyperledger Besu 安全漏洞

Hyperledger Besu is an open source application from Hyperledger. It is used to run, maintain, debug and monitor nodes in the Ethernet network. A security vulnerability exists in Hyperledger Besu versions prior to 22.1.3 through 22.7.1, which stems from an error in its 32-bit signed and unsigned...

Parse Server 安全漏洞

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A security vulnerability exists in Parse Server versions prior to 4.10.15, 5.0.0 through 5.2.6. An attacker can use this vulnerability to assign a session object to his or her own user by writi...

PYSEC-2022-280

In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's /confirm endpoint...

Cloudreve 跨站脚本漏洞

Cloudreve is Cloudreve open source a public cloud file system that supports multiple cloud storage drives. A cross-site scripting vulnerability exists in Cloudreve versions v1.0.0 through v3.5.3. The vulnerability stems from the discovery of a cross-site scripting XSS vulnerability via the file...

a2ml (>=1.0.20 <=1.0.55), accelerometer (>=4.2.1 <=7.0.0.dev0) +332 more potentially affected by CVE-2022-21797 via joblib (>=1.0.0 <=1.1.0a0)

joblib PYPI version =1.0.0, =1.0.20, =4.2.1, =1.0.88, =1.0.32, =1.3.0, =1.0.0, =0.20211108144632.0, =0.2.7, =0.1.0, =0.1.5, =0.53.0, =0.0.1, =1.0.1, =1.3.1 and more Source cves: CVE-2022-21797 Source advisory: SNYK:PYTHON-JOBLIB-3027033...

@appsocially/timepassport (>=0.1.2-0.1 <=0.1.29), @becompliancebr/shared-components (>=1.0.0 <=1.10.0) +73 more potentially affected by CVE-2022-25873 via vuetify (>=2.0.0 <=2.6.1)

vuetify NPM version =2.0.0, =0.1.2-0.1, =1.0.0, =1.2.5, =5.0.1-beta.0, =0.0.128, =0.0.101-beta.22, =0.0.128, =0.0.128, =0.0.128, =0.0.128, =0.0.128, =0.0.128, =0.0.128, =0.1.0, =0.1.1 - @een/cm-timeline-sdk =0.1.8 and more Source cves: CVE-2022-25873 Source advisory: OSV:GHSA-Q4Q5-C5CV-2P68...

CVE-2022-25873

The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting XSS due to improper input sanitization in the 'eventName' function within the VCalendar component...

vuetify 跨站脚本漏洞

vuetify is a German vuetify open source material component framework for Vue. A security vulnerability exists in vuetify versions 2.0.0-beta.4 through 2.6.10, which stems from incorrect input cleanup in the "eventName" function of the VCalendar component...

@budibase/client (>=0.0.999-alpha.30 <=1.3.19-alpha.7), @budibase/frontend-core (>=0.0.1 <=1.3.19-alpha.7) +4 more potentially affected by CVE-2022-3225 via @budibase/bbui (>=0.0.1 <=1.3.19-alpha.7)

@budibase/bbui NPM version =0.0.1, =0.0.999-alpha.30, =0.0.1, =0.0.999-alpha.30, =0.9.1, =0.9.123, =0.9.124 - @operabuild/standard-components =0.9.124 Source cves: CVE-2022-3225 Source advisory: OSV:GHSA-X92G-49GH-63QM...