PT-2022-27624 · Ip Com · Ip-Com M50

Name of the Vulnerable Software and Affected Versions: IP-COM M50 version 15.11.0.3310768 Description: The issue is related to multiple buffer overflows that can occur via the pEnable, pLevel, and pModule parameters in the formSetDebugCfg function. This can potentially allow for exploitation...

PT-2022-28089 · Ayacms · Ayacms

Name of the Vulnerable Software and Affected Versions: AyaCMS version 3.1.2 Description: The issue allows for file deletion via the /aya/module/admin/fst del.inc.php endpoint. Recommendations: For AyaCMS version 3.1.2, as a temporary workaround, consider restricting access to the...

Ghost unauthorized newsletter modification vulnerability

Talos Vulnerability Report TALOS-2022-1624 Ghost unauthorized newsletter modification vulnerability December 21, 2022 CVE Number CVE-2022-41654 SUMMARY An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted...

Emby Server <= 4.7.11 XSS Vulnerability

Emby Server is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2022-27885 · Tenda · Tenda F1203

Name of the Vulnerable Software and Affected Versions: Tenda F1203 version 2.0.1.6 Description: A buffer overflow issue was discovered via the deviceId parameter at the "/goform/addWifiMacFilter" API endpoint. Recommendations: For Tenda F1203 version 2.0.1.6, consider restricting access to the...

Tenable Nessus Network Monitor < 5.11.0 Multiple Vulnerabilities (TNS-2019-08)

Tenable Nessus Network Monitor is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WordPress plugin JoomSport SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerability exist...

PT-2022-27222 · Unknown · Conprosys Hmi System

Name of the Vulnerable Software and Affected Versions: CONPROSYS HMI System CHS versions 3.4.4 and earlier Description: The issue allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is running by sending a specially crafted request...

CVE-2022-46059

AeroCMS v0.0.1 is vulnerable to Cross Site Request Forgery CSRF...

PT-2022-6001 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.14 and earlier Description: The issue is related to a reflected Cross-Site Scripting XSS vulnerability. It can be exploited if an attacker convinces a victim to visit a URL referencing a vulnerable page,...

Zhuhai Suny Technology ESL Tag Forgery / Replay Attacks Vulnerability

Zhuhai Suny Technology ESL Tag suffers from replay attacks and a forgery attack allowing for the displaying of arbitrary contents. ======================================================================= title: Replay attacks & Displaying arbitrary contents product: Zhuhai Suny Technology ESL Tag ...

PT-2022-36507 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.267 Description: A memory leak issue was discovered in the query regdb file function related to cfg80211, a Linux kernel module for wireless networking. The actual impact and attack plausibility have not y...

CVE-2022-42458

Authentication bypass using an alternate path or channel vulnerability in bingo!CMS version1.7.4.1 and earlier allows a remote unauthenticated attacker to upload an arbitrary file. As a result, an arbitrary script may be executed and/or a file may be altered...

PT-2022-26441 · Bingo!Cms · Bingo!Cms

Name of the Vulnerable Software and Affected Versions: bingo!CMS versions 1.7.4.1 and earlier Description: The issue allows a remote unauthenticated attacker to upload an arbitrary file, potentially leading to the execution of an arbitrary script or alteration of a file. This is due to an...

node-sass-with-bindings (>=4.5.5 <=4.5.6) potentially affected by CVE-2022-25895 via lite-dev-server (=3.2.7)

lite-dev-server NPM version =3.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on lite-dev-server and may be impacted: - node-sass-with-bindings =4.5.5, =4.5.6 Source cves: CVE-2022-25895 Source advisory: SNYK:JS-LITEDEVSERVER-3153718...

Tenda AC6 安全漏洞

Tenda AC6 is a wireless router from Tenda, China. A security vulnerability exists in Tenda AC6 version V1.0 V15.03.05.19, which originates from a buffer overflow vulnerability via the time parameter in the setSmartPowerManagement function...

PT-2022-27603 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6V1.0 version 15.03.05.19 Description: A buffer overflow issue was discovered via the schedStartTime parameter in the setSchedWifi function. This issue can be exploited, potentially allowing for unauthorized access or control...

OX App Suite 7.10.6 Cross Site Scripting / SSRF / Resource Consumption

Product: OX App Suite Vendor: OX Software GmbH Internal reference: OXUIB-1654 Vulnerability type: Cross-Site Scripting CWE-80 Vulnerable version: 7.10.6 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.10.5-rev37, 7.10.6-rev...

XWiki 12.10.11 < 13.10.8, 14.x < 14.4.3, 14.5.x < 14.6 Exposure of Sensitive Information Vulnerability (GHSA-p2x4-6ghr-6vmq)

Xwiki is prone to an exposure of sensitive information vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki...

LimeSurvey <= 5.4.12 SQLi Vulnerability

LimeSurvey is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:limesurvey:limesurvey...