SolarWinds Security Event Manager 安全漏洞

SolarWinds Security Event Manager SolarWinds SEM is an American SolarWinds, Inc. for forensics and troubleshooting, as well as a tool to help you manage log data. A security vulnerability exists in SolarWinds Security Event Manager 2022.2 and prior versions that stems from disclosing HTTP methods...

SQL Injection

arches is vulnerability to sql injection. The vulnerability exists in concept.py where the attacker can send a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database...

PT-2022-6401 · Trueconf · Trueconf Server

Name of the Vulnerable Software and Affected Versions: TrueConf Server affected versions not specified Description: The issue is related to an uncontrolled resource consumption in the software. It can be exploited by a remote attacker using a specially crafted HTTPS request to cause a denial of...

puma-5.6.4: http request smuggling vulnerabilities

A HTTP request smuggling flaw was found in puma. This issue occurs when using puma behind a proxy. Puma does not validate incoming HTTP requests, as per RFC specification, leading to loss of integrity...

CVE-2022-43264

Arobas Music Guitar Pro for iPad and iPhone before v1.10.2 allows attackers to perform directory traversal and download arbitrary files via a crafted web request...

CVE-2022-43264

Arobas Music Guitar Pro for iPad and iPhone before v1.10.2 allows attackers to perform directory traversal and download arbitrary files via a crafted web request...

Directory traversal

Arobas Music Guitar Pro for iPad and iPhone before v1.10.2 allows attackers to perform directory traversal and download arbitrary files via a crafted web request...

Wiesemann & Theis Com-Server Family 访问控制错误漏洞

The Wiesemann & Theis Com-Server Family is a family of serial device servers from Wiesemann & Theis, Germany. An access control error vulnerability exists in Wiesemann & Theis Com-Server Family. A remote attacker could exploit this vulnerability to log in to the system without knowing the passwor...

Privilege escalation

Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to retrieve other app tokens by ID via an HTTP web request. Patched Versions are 3.5.3, 3.4.7, and 2.12.6...

CVE-2022-45183

Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to retrieve other app tokens by ID via an HTTP web request. Patched Versions are 3.5.3, 3.4.7, and 2.12.6...

Ironman Software PowerShell Universal 安全漏洞

Ironman Software PowerShell Universal is a single pane for managing and delegating access to automation environments from Ironman Software. A security vulnerability exists in Ironman Software PowerShell Universal, which stems from a privilege escalation on a web server, that allows an attacker wi...

GHSA-GMPQ-XRXJ-XH8M Arches vulnerable to execution of arbitrary SQL

Impact With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database. Anyone running the impacted versions =7.0.0, =7.1.1 should upgrade as soon as possible. Patches The problem has been patched in the following versions: 6.1.2, 6.2.1, and 7.2...

CVE-2022-3181

An Improper Input Validation vulnerability exists in Trihedral VTScada version 12.0.38 and prior. A specifically malformed HTTP request could cause the affected VTScada to crash. Both local area network LAN-only and internet facing systems are affected...

WordPress Web Stories plugin input validation error vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation error...

CVE-2022-40874

Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow vulnerability in the GetParentControlInfo function, which can cause a denial of service attack through a carefully constructed http request...

Tenda AX1803 缓冲区错误漏洞

Tenda AX1803 is a dual-band Gigabit WIFI6 router from China's Tenda. A security vulnerability exists in Tenda AX1803 v1.0.0.1, which stems from a heap overflow vulnerability in the GetParentControlInfo function that can lead to a denial of service attack via a well-constructed http request...

CVE-2022-38200 BUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server.

A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser...

PT-2022-23622 · Algosec · Algosec Fireflow

Name of the Vulnerable Software and Affected Versions: AlgoSec FireFlow affected versions not specified Description: The issue involves a Reflected Cross-Site-Scripting RXSS attack. A malicious user can inject JavaScript code into the IntersectudRule parameter on the "search/result.html" page. By...

Cisco Identity Services Engine 输入验证错误漏洞

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users, and devices to develop and implement policies to monitor the network. An input validation error vulnerability exists in...

DEBIAN-CVE-2022-39291

ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new data into the logs stored by Zoneminder. This was observed through an HTTP POST request...