5848 matches found
ZKTeco ZKBioSecurity 安全漏洞
ZKTeco ZKBioSecurity is a web-based all-in-one platform from ZKTeco China.An access control error vulnerability exists in ZKTeco ZKBioSecurity V5000 version 3.0.5r. The vulnerability stems from the presence of improper access control in the application, which can be exploited by an attacker to...
Exploit for Missing Authentication for Critical Function in Zohocorp Manageengine_Servicedesk_Plus
Golang-CVE-2021-44077-POC This exploit is an unauthe...
@adobe/git-server (>=0.9.17 <=1.0.0), @adobe/helix-cli (>=0.3.0-SNAPSHOT.293 <=5.7.6) +34 more potentially affected by CVE-2022-22984 +1 more via snyk-python-plugin (>=1.0.0 <=1.24.0)
snyk-python-plugin NPM version =1.0.0, =0.9.17, =0.3.0-SNAPSHOT.293, =2.6.0, =1.0.5-SNAPSHOT.105, =0.0.4, =8.0.36, =5.0.22, =3.10.42, =0.0.70, =0.5.8, =3.2.4, =0.0.2, =0.0.11, =1.0.1 - @ericblade/quagga2-redux-middleware =1.0.1 and more Source cves: CVE-2022-22984, CVE-2022-40764 Source advisory:...
Cross site scripting
IBM Rational Change 5.3 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using the SUPPTEMPLATEFLAG parameter in a specially-crafted URL to execute script in a victim's Web browser within the security...
TOTOLINK A860R 操作系统命令注入漏洞
TOTOLINK A860R is a wireless router from China Gion Electronics TOTOLINK.TOTOLINK A860R version V4.1.2cu.5182B20201027 is vulnerable to command injection, which stems from the component /cgi-bin/downloadFile.cgi failing to properly filter the construct command special characters, commands, etc. A...
Wedding Planner SQL注入漏洞
Wedding Planner is a wedding planner project. Designed to provide users with an easy way to plan their wedding through a web application while using real data, Wedding Planner v1.0 is vulnerable to a SQL injection vulnerability that stems from a missing validation of externally entered SQL...
Cross site scripting
Toast UI Grid is a component to display and edit data. Versions prior to 4.21.3 are vulnerable to cross-site scripting attacks when pasting specially crafted content into editable cells. This issue was fixed in version 4.21.3. There are no known workarounds...
Mozilla Thunderbird Security Advisory (MFSA2022-39) - Mac OS X
Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...
Apple macOS Monterey 安全漏洞
Apple macOS Monterey is the 18th major release of Apple's macOS for the Macintosh desktop operating system. A security vulnerability exists in Apple macOS Monterey version 12.5, which stems from an application's ability to access sensitive user data...
WordPress plugin Form Builder CP 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
PT-2022-24608 · Unknown +1 · Democritus-Strings +1
Name of the Vulnerable Software and Affected Versions: d8s-math version 0.1.0 Description: The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. Recommendations: For version 0.1.0,...
clip-jax (=0.0.5) potentially affected by CVE-2022-35984 via tensorflow-cpu (=2.9.0)
tensorflow-cpu PYPI version =2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - clip-jax =0.0.5 Source cves: CVE-2022-35984 Source advisory: OSV:GHSA-P2XF-8HGM-HPW5...
clip-jax (=0.0.5) potentially affected by CVE-2022-35967 via tensorflow-cpu (=2.9.0)
tensorflow-cpu PYPI version =2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - clip-jax =0.0.5 Source cves: CVE-2022-35967 Source advisory: OSV:GHSA-V6H3-348G-6H5X...
clip-jax (=0.0.5) potentially affected by CVE-2022-36004 via tensorflow-cpu (=2.9.0)
tensorflow-cpu PYPI version =2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - clip-jax =0.0.5 Source cves: CVE-2022-36004 Source advisory: OSV:GHSA-MV8M-8X97-937Q...
CVE-2022-36074
Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade. This can lead to account access exposure and compromise. It is recommended that the Nextcloud Server...
JVN#30900552: EC-CUBE plugin "Product Image Bulk Upload Plugin" vulnerable to insufficient verification in uploading files
EC-CUBE plugin "Product Image Bulk Upload Plugin", a plugin that enables to upload image files, provided by EC-CUBE CO.,LTD. contains an insufficient verification vulnerability when uploading files CWE-20. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary...
PT-2022-23902 · Stealjs · Stealjs
Name of the Vulnerable Software and Affected Versions: stealjs steal version 2.2.4 Description: A Regular Expression Denial of Service ReDoS flaw was found in the input variable in main.js. This issue can cause a denial of service. Recommendations: For version 2.2.4, consider restricting the inpu...
XWiki 2.0 < 13.10.5, 14.0 < 14.3 CSRF Vulnerability (GHSA-fxwr-4vq9-9vhj)
Xwiki is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...
InventoryManagementSystem SQL注入漏洞
InventoryManagementSystem is an inventory management system by Sajan Rajbhandari, an individual developer. It provides an easy way to track products, suppliers, customers, and purchasing and sales information. A security vulnerability exists in InventoryManagementSystem version 1.0, which...
