‼ CVE-2022-27669 ‼
📖 Read
via "National Vulnerability Database".
An unauthenticated user can use functions of XML Data Archiving Service of SAP NetWeaver Application Server for Java - version 7.50, to which access should be restricted. This may result in an escalation of privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27263 ‼
📖 Read
via "National Vulnerability Database".
An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28216 ‼
📖 Read
via "National Vulnerability Database".
SAP BusinessObjects Business Intelligence Platform (BI Workspace) - version 420, is susceptible to a Cross-Site Scripting attack by an unauthenticated attacker due to improper sanitization of the user inputs on the network. On successful exploitation, an attacker can access certain reports causing a limited impact on confidentiality of the application data.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27670 ‼
📖 Read
via "National Vulnerability Database".
SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashing the server with some queries that use indirect identifiers.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28396 ‼
📖 Read
via "National Vulnerability Database".
Apostrophe v3.16.1 was discovered to contain a remote code execution (RCE) vulnerability via the component uploadfs.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28770 ‼
📖 Read
via "National Vulnerability Database".
Due to insufficient input validation, SAPUI5 library(vbm) - versions 750, 753, 754, 755, 75, allows an unauthenticated attacker to inject a script into the URL and execute code. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27473 ‼
📖 Read
via "National Vulnerability Database".
SQL injection vulnerability in Topics Searching feature of Roothub 2.6.0 allows unauthorized attackers to execute arbitrary SQL commands via the "s" parameter remotely.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27671 ‼
📖 Read
via "National Vulnerability Database".
A CSRF token visible in the URL may possibly lead to information disclosure vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27164 ‼
📖 Read
via "National Vulnerability Database".
CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_viewUsers📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28033 ‼
📖 Read
via "National Vulnerability Database".
Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_uploads.php📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28213 ‼
📖 Read
via "National Vulnerability Database".
When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server and in successful exploits of DoS.📖 Read
via "National Vulnerability Database".
🕴 80% of Software Codebases Contain at Least One Vulnerability 🕴
📖 Read
via "Dark Reading".
Open source code continues its steady takeover of codebases, and organizations have made slight gains in eliminating out-of-date and vulnerable components.📖 Read
via "Dark Reading".
Dark Reading
80% of Software Codebases Contain at Least One Vulnerability
Open source code continues its steady takeover of codebases, and organizations have made slight gains in eliminating out-of-date and vulnerable components.
‼ CVE-2022-23163 ‼
📖 Read
via "National Vulnerability Database".
Dell PowerScale OneFS, 8.2,x, 9.1.0.x, 9.2.1.x, and 9.3.0.x contain a denial of service vulnerability. A local malicious user could potentially exploit this vulnerability, leading to denial of service/data unavailability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23160 ‼
📖 Read
via "National Vulnerability Database".
Dell PowerScale OneFS, versions 8.2.0-9.3.0, contains an Improper Handling of Insufficient Permissions vulnerability. An remote malicious user could potentially exploit this vulnerability, leading to gaining write permissions on read-only files.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22560 ‼
📖 Read
via "National Vulnerability Database".
Dell EMC PowerScale OneFS 8.1.x - 9.1.x contain hard coded credentials. This allows a local user with knowledge of the credentials to login as the admin user to the backend ethernet switch of a PowerScale cluster. The attacker can exploit this vulnerability to take the switch offline.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24070 ‼
📖 Read
via "National Vulnerability Database".
Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory which has already been freed. Affected Subversion mod_dav_svn servers 1.10.0 through 1.14.1 (inclusive). Servers that do not use mod_dav_svn are not affected.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22549 ‼
📖 Read
via "National Vulnerability Database".
Dell PowerScale OneFS, 8.2.x-9.3.x, contains a Improper Certificate Validation. A unauthenticated remote attacker could potentially exploit this vulnerability, leading to a man-in-the-middle capture of administrative credentials.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24767 ‼
📖 Read
via "National Vulnerability Database".
Git for Windows is a fork of Git containing Windows-specific patches. Since part of Git for Windows' uninstaller is copied into the current user's temporary directory and run in that place, it is important to ensure that there are no malicious `.dll` file in that directory that might be loaded as part of loading the executable. However, the default system settings for `TMP` and `TEMP` are to point to `C:\Windows\Temp`, a folder that is world-writable (for historical reasons), and the SYSTEM user account inherits those settings. This means that any authenticated user can place malicious `.dll` files that are loaded when Git for Windows' uninstaller is run via the SYSTEM account. Fixes are available in Git for Windows v2.35.2 or newer. Users unable to upgrade may override SYSTEM's `TMP` environment variable to point to a directory exclusively under SYSTEM's control before running the uninstaller, clear `C:\Windows\Temp` of all `.dll` files before running the uninstaller, or run the uninstaller under an admin account rather than SYSTEM as a workaround.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23159 ‼
📖 Read
via "National Vulnerability Database".
Dell PowerScale OneFS, 8.2.2 - 9.3.0.x, contain a missing release of memory after effective lifetime vulnerability. An authenticated user with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE and ISI_PRIV_AUTH_PROVIDERS privileges could exploit this vulnerability, leading to a Denial-Of-Service. This can also impact a cluster in Compliance mode. Dell recommends to update at the earliest opportunity.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24765 ‼
📖 Read
via "National Vulnerability Database".
Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are vulnerable: simply creating a new project would already read and respect the config specified in `C:\.git\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git` on all drives where Git commands are run, and remove read/write access from those folders as a workaround. Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user profile, e.g. `C:\Users` if the user profile is located in `C:\Users\my-user-name`.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22550 ‼
📖 Read
via "National Vulnerability Database".
Dell PowerScale OneFS, versions 8.2.2 and above, contain a password disclosure vulnerability. An unprivileged local attacker could potentially exploit this vulnerability, leading to account take over.📖 Read
via "National Vulnerability Database".