Showing URL in QR Code <= 0.0.1 - Stored XSS via CSRF

The plugin does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin or editor add Stored XSS payloads via a CSRF attack PoC Make a logged in editor or admin open a page with the below payload...

CVE-2022-43066

Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Master.php?f=deletemessage...

curl 资源管理错误漏洞

curl is a tool for transferring data from or to a server. A security vulnerability exists in curl, which stems from a problem in error/cleanup handling that could result in a double release if a transfer with a non-HTTPS URL is performed using an HTTP proxy...

CVE-2022-38436 Adobe Illustrator CDR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Adobe Illustrator versions 26.4 and earlier and 25.4.7 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the...

[Security Nation] James Kettle of PortSwigger on Advancing Web-Attack Research

!\Security Nation\ James Kettle of PortSwigger on Advancing Web-Attack Researchhttps://blog.rapid7.com/content/images/2022/10/securitynationlogo.jpg In this episode of Security Nation, Jen and Tod talk to James Kettle of PortSwigger. Their discussion includes research for new web-attack technique...

CVE-2022-40831

B.C. Institute of Technology CodeIgniter =3.1.13 is vulnerable to SQL Injection via system\database\DBquerybuilder.php like function. Note: Multiple third parties have disputed this as not a valid vulnerability...

Security fix for the ALT Linux 10 package node version 16.17.1-alt1

Sept. 30, 2022 Vitaly Lipatov 16.17.1-alt1 - new version 16.17.1 with rpmrb script - set npm = 8.15.0 - CVE-2022-32212: DNS rebinding in --inspect on macOS High - CVE-2022-32213: bypass via obs-fold mechanic Medium - CVE-2022-35255: Weak randomness in WebCrypto keygen - CVE-2022-35256: HTTP Reque...

Security feature bypass

A vulnerability in the Aruba Virtual Intranet Access VIA client for Microsoft Windows operating system client communications that could allow for an attacker in a privileged network position to intercept sensitive information in Aruba Virtual Intranet Access VIA client for Microsoft Windows...

CVE-2022-23678

The CVE-2022-23678 entry describes a vulnerability in the Aruba Virtual Intranet Access (VIA) client for Windows (versions 4.3.0 build 2208101 and below) where an attacker on a privileged network position could intercept sensitive information. Affected component: VIA Client for Windows; root caus...

CVE-2022-23678

A vulnerability in the Aruba Virtual Intranet Access VIA client for Microsoft Windows operating system client communications that could allow for an attacker in a privileged network position to intercept sensitive information in Aruba Virtual Intranet Access VIA client for Microsoft Windows...

via-alpina.org Cross Site Scripting vulnerability OBB-2884765

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Dell SmartFabric Storage Software 操作系统命令注入漏洞

Dell SmartFabric Storage Software is a stand-alone storage software solution from Dell USA. A command injection vulnerability exists in Dell SmartFabric storage software version 1.0.0, which arises from a failure of a network system or product to properly filter special characters, commands, etc...

CVE-2022-36226

SiteServerCMS 5.X has a Remote-download-Getshell-vulnerability via /SiteServer/Ajax/ajaxOtherService.aspx...

CVE-2022-36606

Ywoa before v6.1 was discovered to contain a SQL injection vulnerability via /oa/setup/checkPool?database...

CVE-2022-34999

JPEGDEC commit be4843c was discovered to contain a FPE via DecodeJPEG at /src/jpeg.inl...

CVE-2022-35557

A stack overflow vulnerability exists in /goform/wifiSSIDget in Tenda W6 V1.0.0.94122 version, which can be exploited by attackers to cause a denial of service DoS via the index parameter...

UBUNTU-CVE-2022-2303

An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for group members to bypass 2FA enforcement enabled at the group level by using Resource Owner Passwo...

CVE-2022-21552

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware component: Search. Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter...

PT-2022-20515 · Kubeedge · Kubeedge

Name of the Vulnerable Software and Affected Versions: KubeEdge versions prior to 1.11.1 KubeEdge versions prior to 1.10.2 KubeEdge versions prior to 1.9.4 Description: A large response received by the viaduct WSClient can cause a denial of service DoS from memory exhaustion. The entire body of t...

edinburghcastleapartments.com Cross Site Scripting vulnerability OBB-2738311

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...