4337-snap (>=0.1.0, <=0.1.1), @0xabcdefg/smart-order-router (>=1.0.0, <=1.0.5) +1281 more potentially affected by CVE-2022-31170 via @openzeppelin/contracts (>=4.0.0, <=4.7.0)

@openzeppelin/contracts NPM version =4.0.0, =0.1.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =1.0.0, =0.2.0, =4.14.3, =1.0.2, =4.0.0-prerelease, =4.0.1-alpha, =2.0.0-beta.1, =3.1.0 and more Source cves: CVE-2022-31170 Source advisory: OSV:GHSA-QH9X-GCFH-PCRW...

DEBIAN-CVE-2022-34169

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 o...

PT-2022-22199 · Digital Watchdog · Dw Megapix Ip Cameras

Name of the Vulnerable Software and Affected Versions: Digital Watchdog DW MEGApix IP cameras version A7.2.2 20211029 Description: A command injection issue was found in the /admin/vca/license/license tok.cgi component. This issue can be exploited through a crafted POST request. Recommendations:...

Design/Logic Flaw

OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to an error that renders account contracts unusable on live networks. This issue affects all accounts vanilla and ethereum flavors in the...

DEBIAN-CVE-2022-32308

Cross Site Scripting XSS vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofed 'MessageSender.url' to the browser renderer process...

roaring-landmask (0.4.0) potentially affected by CVE-2022-2097 via openssl-src (300.0.0+3.0.0)

openssl-src CARGO version 300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask 0.4.0 Source cves: CVE-2022-2097 Source advisory: OSV:GHSA-3WX7-46CH-7RQ2...

PT-2022-21058 · Tenda · Tenda Ax1806

Name of the Vulnerable Software and Affected Versions: Tenda AX1806 version 1.0.0.1 Description: A stack overflow issue was discovered via the list parameter in the fromSetRouteStatic function. Recommendations: For Tenda AX1806 version 1.0.0.1, consider restricting access to the fromSetRouteStati...

AZL-10013 CVE-2022-2257 affecting package vim for versions less than 9.0.0050-2

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0...

abstraps (0.1.8), aivm (>=0.2.0, <=0.3.0) +287 more potentially affected by CVE-2022-31104 via cranelift-codegen (>=0.14.0, <=0.84.0)

cranelift-codegen CARGO version =0.14.0, =0.2.0, =0.1.0, =0.1.0, =0.5.0, =0.1.0, =0.1.0, =0.2.9, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.26.1, =0.30.1 and more Source cves: CVE-2022-31104 Source advisory: OSV:GHSA-JQWC-C49R-4W2X...

DCMTK 安全漏洞

DCMTK is a collection of libraries and applications that implement most DICOM standards. Software for inspecting, building and converting DICOM image files, handling offline media, sending and receiving images over a network connection, and demo image storage and worklist servers. a denial of...

PT-2022-11323 · Unknown · Todo-Regex

Name of the Vulnerable Software and Affected Versions: todo-regex version 0.1.1 Description: A Regular Expression Denial of Service ReDOS issue was found in the software when it matches crafted invalid TODO statements. This occurs because the regular expression used can be exploited to cause a...

DEBIAN-CVE-2022-2120

OFFIS DCMTK's All versions prior to 3.6.7 service class user SCU is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution...

CVE-2022-33094

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/map...

CVE-2022-23056 ERPNext - Stored XSS leads to account takover

In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack...

WordPress plugin Mail Subscribe List 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. cross-site request forgery vulnerability exists in versions of the WordPress Mail Subscribe List plugin...

Vulnerable OZ version [email protected] used

Lines of code Vulnerability details Impact An outdated and vulnerable OpenZeppelin version 3.4.0 is used. This dependency has a known high severity vulnerability: describes the possibility of initializer protected functions to be called twice, this would affect the MyStrategy.sol contract. See...

NOKIA VitalSuite SPM SQL注入漏洞

NOKIA VitalSuite SPM is a multi-vendor, multi-application performance management solution from Nokia Finland. A security vulnerability exists in NOKIA VitalSuite SPM version 2020. An attacker exploited the vulnerability to perform SQL injection via UserName...

Kakao PotPlayer 缓冲区错误漏洞

Kakao PotPlayer is a lightweight media player from the South Korean company Kakao that supports multiple formats. A security vulnerability exists in Kakao PotPlayer 1.7.21523 build 210729, which stems from an exploitable out-of-bounds write in the application. An attacker can exploit the...

Design/Logic Flaw

Vulnerable versions of the JupiterX Theme =2.0.6 allow any logged-in user, including subscriber-level users, to access any of the functions registered in lib/api/api/ajax.php, which also grant access to the jupiterxapiajax actions registered by the JupiterX Core Plugin =2.0.6. This includes the...

Badminton Center Management System SQL注入漏洞（CNVD-2022-44727）

Badminton Center Management System is a badminton center management system from Carlo Montero's personal developer. It provides an online and automated platform for badminton centers to manage their daily transactions and records.Badminton Center Management System version v1.0 is vulnerable to SQ...