The vulnerability of the FortiSandbox’s web interface allows a perpetrator to execute arbitrary commands.

The vulnerability of the FortiSandbox threat detection and mitigation web interface is related to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to remotely execute arbitrary commands b...

CVE-2022-38200

A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser...

Cross site scripting

A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser...

Abode Iota 操作系统命令注入漏洞

Abode Iota is a reliable Diy home security system from Abode. A security vulnerability exists in Abode Iota versions 6.9X and 6.9Z. An attacker exploits the vulnerability to execute arbitrary commands via specially crafted HTTP requests...

Abode Iota 操作系统命令注入漏洞

Abode Iota is a reliable Diy home security system from Abode. An operating system command injection vulnerability exists in Abode Iota versions 6.9X and 6.9Z. An attacker could exploit this vulnerability to execute arbitrary commands via specially crafted HTTP requests...

Abode Iota 操作系统命令注入漏洞

Abode Iota is a reliable Diy home security system from Abode. An operating system command injection vulnerability exists in Abode Iota All-In-One Security Kit versions 6.9X and 6.9Z. An attacker could exploit this vulnerability to execute arbitrary commands via specially crafted HTTP requests...

Abode Iota 格式化字符串错误漏洞

Abode Iota is a reliable Diy home security system from Abode. A formatting string error vulnerability exists in Abode Iota versions 6.9X and 6.9Z, which stems from the fact that an attacker can send an authenticated, malicious HTTP request to its web interface/action/wirelessConnect functionality...

UBUNTU-CVE-2022-39399

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit vulnerabilit...

CVE-2022-40684

An authentication bypass using an alternate path or channel CWE-288 in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform...

Atlassian Jira 代码问题漏洞

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace.Digital Bazaar Forge is a native implementation of Tls in Javascript and an open source tool for writing encryption-based and...

VulnCheck KEV: CVE-2022-40684

Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests...

NocoDB 资源管理错误漏洞

NocoDB is an open source Airtable replacement. A resource management error vulnerability exists in versions of NocoDB prior to 0.92.0, which stems from allowing the insertion of large characters into the input field "New Project" in the creation field. ", an attacker could use this vulnerability ...

ZoneMinder 授权问题漏洞

ZoneMinder is an open source video surveillance software system that supports IP, USB and analog cameras. The system supports IP, USB and analog cameras, etc. A security vulnerability exists in ZoneMinder, which stems from the fact that an authenticated attacker can use the vulnerability to bypas...

Hertz path traversal vulnerability

Hertz is a Golang microservices HTTP framework open sourced by CloudWeGo. v0.3.0 of Hertz contains a path traversal vulnerability that stems from a failure of the normalizePath function to properly filter special elements in a resource or file path. An attacker could exploit this vulnerability to...

Trudesk 输入验证错误漏洞

Chris Brame Trudesk is an open source helpdesk/ticketing solution from Chris Brame, USA. An input validation error vulnerability exists in versions prior to Trudesk 1.2.2 that stems from allowing large characters to be inserted into the full name of the input field of a registration field, which...

Dataprobe iBoot-PDU 代码问题漏洞

The Dataprobe iBoot-PDU is a web-accessible managed PDU independently controlled outlet from Dataprobe USA. A code issue vulnerability exists in the Dataprobe iBoot-PDU FW that stems from the fact that an attacker can create URLs capable of changing host parameters via a carefully crafted PHP...

OpenWrt 缓冲区错误漏洞

OpenWrt is a Linux operating system for embedded devices. A security vulnerability exists in OpenWrt versions prior to v21.02.3, v22.03.0-rc6, which stems from the inclusion of two skip loops in the function headervalue, which can be exploited by an attacker to access sensitive information via a...

Apple macOS Safari Buffer Overflow Vulnerability

Apple Safari is a web browser that is the default browser that comes with the Mac OS X and iOS operating systems. A security vulnerability exists in Apple macOS Safari WebKit, which can be exploited by a remote attacker to submit a special web request that can be tricked into being parsed by the...

PT-2022-4871 · Openwrt · Openwrt

Name of the Vulnerable Software and Affected Versions: Openwrt versions prior to 21.02.3 Openwrt version 22.03.0-rc6 Description: The issue is related to a buffer overflow vulnerability in the header value function, which allows attackers to access sensitive information via a crafted HTTP request...

CVE-2022-3001

This vulnerability exists in Milesight Video Management Systems VMS, all firmware versions prior to 40.7.0.79-r1, due to improper input handling at camera’s web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http request on the target...