βΌ CVE-2021-26637 βΌ
π Read
via "National Vulnerability Database".
There is no account authentication and permission check logic in the firmware and existing apps of SiHAS's SGW-300, ACM-300, GCM-300, so unauthorized users can remotely control the device.π Read
via "National Vulnerability Database".
βΌ CVE-2022-34201 βΌ
π Read
via "National Vulnerability Database".
A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.π Read
via "National Vulnerability Database".
βΌ CVE-2022-33094 βΌ
π Read
via "National Vulnerability Database".
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/map.π Read
via "National Vulnerability Database".
βΌ CVE-2022-34199 βΌ
π Read
via "National Vulnerability Database".
Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.π Read
via "National Vulnerability Database".
βΌ CVE-2022-34189 βΌ
π Read
via "National Vulnerability Database".
Jenkins Image Tag Parameter Plugin 1.10 and earlier does not escape the name and description of Image Tag parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.π Read
via "National Vulnerability Database".
βΌ CVE-2022-32124 βΌ
π Read
via "National Vulnerability Database".
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /index/jobfairol/show/.π Read
via "National Vulnerability Database".
βΌ CVE-2021-29055 βΌ
π Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in sourcecodester School File Management System 1.0 via the Firtstname parameter to the Update Account form in student_profile.php.π Read
via "National Vulnerability Database".
βΌ CVE-2021-26636 βΌ
π Read
via "National Vulnerability Database".
Stored XSS and SQL injection vulnerability in MaxBoard could lead to occur Remote Code Execution, which could lead to information exposure and privilege escalation.π Read
via "National Vulnerability Database".
βΌ CVE-2022-34186 βΌ
π Read
via "National Vulnerability Database".
Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape the name and description of Moded Extended Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.π Read
via "National Vulnerability Database".
βΌ CVE-2022-32128 βΌ
π Read
via "National Vulnerability Database".
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/service/increment/add/im.π Read
via "National Vulnerability Database".
βΌ CVE-2022-33093 βΌ
π Read
via "National Vulnerability Database".
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the key parameter at /freelance/resume_list.π Read
via "National Vulnerability Database".
βΌ CVE-2022-22967 βΌ
π Read
via "National Vulnerability Database".
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.π Read
via "National Vulnerability Database".
βΌ CVE-2022-33067 βΌ
π Read
via "National Vulnerability Database".
Lrzip v0.651 was discovered to contain multiple invalid arithmetic shifts via the functions get_magic in lrzip.c and Predictor::init in libzpaq/libzpaq.cpp. These vulnerabilities allow attackers to cause a Denial of Service via unspecified vectors.π Read
via "National Vulnerability Database".
βΌ CVE-2022-33069 βΌ
π Read
via "National Vulnerability Database".
Ethereum Solidity v0.8.14 contains an assertion failure via SMTEncoder::indexOrMemberAssignment() at SMTEncoder.cpp.π Read
via "National Vulnerability Database".
βΌ CVE-2021-40956 βΌ
π Read
via "National Vulnerability Database".
LaiKetui v3.5.0 has SQL injection in the background through the menu management function, and sensitive data can be obtained.π Read
via "National Vulnerability Database".
βΌ CVE-2022-34175 βΌ
π Read
via "National Vulnerability Database".
Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments containing sensitive information, bypassing any permission checks in the corresponding view.π Read
via "National Vulnerability Database".
βΌ CVE-2022-33127 βΌ
π Read
via "National Vulnerability Database".
The function that calls the diff tool in Diffy 3.4.1 does not properly handle double quotes in a filename when run in a windows environment. This allows attackers to execute arbitrary commands via a crafted string.π Read
via "National Vulnerability Database".
βΌ CVE-2022-32554 βΌ
π Read
via "National Vulnerability Database".
Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases are vulnerable to possibly exposed credentials for accessing the productΓ’β¬β’s management interface. The password may be known outside Pure Storage and could be used on an affected system, if reachable, to execute arbitrary instructions with root privileges. No other Pure Storage products or services are affected. Remediation is available from Pure Storage via a self-serve Γ’β¬Εopt-inΓ’β¬οΏ½ patch, manual patch application or a software upgrade to an unaffected version of Purity software.π Read
via "National Vulnerability Database".
βΌ CVE-2022-34195 βΌ
π Read
via "National Vulnerability Database".
Jenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.π Read
via "National Vulnerability Database".
βΌ CVE-2022-34192 βΌ
π Read
via "National Vulnerability Database".
Jenkins ontrack Jenkins Plugin 4.0.0 and earlier does not escape the name of Ontrack: Multi Parameter choice, Ontrack: Parameter choice, and Ontrack: SingleParameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.π Read
via "National Vulnerability Database".
βΌ CVE-2022-33032 βΌ
π Read
via "National Vulnerability Database".
LibreDWG v0.12.4.4608 was discovered to contain a heap-buffer-overflow via the function decode_preR13_section_hdr at decode_r11.c.π Read
via "National Vulnerability Database".