βΌ CVE-2021-26636 βΌ
π Read
via "National Vulnerability Database".
Stored XSS and SQL injection vulnerability in MaxBoard could lead to occur Remote Code Execution, which could lead to information exposure and privilege escalation.π Read
via "National Vulnerability Database".
βΌ CVE-2022-34186 βΌ
π Read
via "National Vulnerability Database".
Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape the name and description of Moded Extended Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.π Read
via "National Vulnerability Database".
βΌ CVE-2022-32128 βΌ
π Read
via "National Vulnerability Database".
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/service/increment/add/im.π Read
via "National Vulnerability Database".
βΌ CVE-2022-33093 βΌ
π Read
via "National Vulnerability Database".
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the key parameter at /freelance/resume_list.π Read
via "National Vulnerability Database".
βΌ CVE-2022-22967 βΌ
π Read
via "National Vulnerability Database".
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.π Read
via "National Vulnerability Database".
βΌ CVE-2022-33067 βΌ
π Read
via "National Vulnerability Database".
Lrzip v0.651 was discovered to contain multiple invalid arithmetic shifts via the functions get_magic in lrzip.c and Predictor::init in libzpaq/libzpaq.cpp. These vulnerabilities allow attackers to cause a Denial of Service via unspecified vectors.π Read
via "National Vulnerability Database".
βΌ CVE-2022-33069 βΌ
π Read
via "National Vulnerability Database".
Ethereum Solidity v0.8.14 contains an assertion failure via SMTEncoder::indexOrMemberAssignment() at SMTEncoder.cpp.π Read
via "National Vulnerability Database".
βΌ CVE-2021-40956 βΌ
π Read
via "National Vulnerability Database".
LaiKetui v3.5.0 has SQL injection in the background through the menu management function, and sensitive data can be obtained.π Read
via "National Vulnerability Database".
βΌ CVE-2022-34175 βΌ
π Read
via "National Vulnerability Database".
Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments containing sensitive information, bypassing any permission checks in the corresponding view.π Read
via "National Vulnerability Database".
βΌ CVE-2022-33127 βΌ
π Read
via "National Vulnerability Database".
The function that calls the diff tool in Diffy 3.4.1 does not properly handle double quotes in a filename when run in a windows environment. This allows attackers to execute arbitrary commands via a crafted string.π Read
via "National Vulnerability Database".
βΌ CVE-2022-32554 βΌ
π Read
via "National Vulnerability Database".
Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases are vulnerable to possibly exposed credentials for accessing the productΓ’β¬β’s management interface. The password may be known outside Pure Storage and could be used on an affected system, if reachable, to execute arbitrary instructions with root privileges. No other Pure Storage products or services are affected. Remediation is available from Pure Storage via a self-serve Γ’β¬Εopt-inΓ’β¬οΏ½ patch, manual patch application or a software upgrade to an unaffected version of Purity software.π Read
via "National Vulnerability Database".
βΌ CVE-2022-34195 βΌ
π Read
via "National Vulnerability Database".
Jenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.π Read
via "National Vulnerability Database".
βΌ CVE-2022-34192 βΌ
π Read
via "National Vulnerability Database".
Jenkins ontrack Jenkins Plugin 4.0.0 and earlier does not escape the name of Ontrack: Multi Parameter choice, Ontrack: Parameter choice, and Ontrack: SingleParameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.π Read
via "National Vulnerability Database".
βΌ CVE-2022-33032 βΌ
π Read
via "National Vulnerability Database".
LibreDWG v0.12.4.4608 was discovered to contain a heap-buffer-overflow via the function decode_preR13_section_hdr at decode_r11.c.π Read
via "National Vulnerability Database".
βΌ CVE-2021-46824 βΌ
π Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in sourcecodester School File Management System 1.0 via the Lastname parameter to the Update Account form in student_profile.php.π Read
via "National Vulnerability Database".
βΌ CVE-2022-33024 βΌ
π Read
via "National Vulnerability Database".
There is an Assertion `int decode_preR13_entities(BITCODE_RL, BITCODE_RL, unsigned int, BITCODE_RL, BITCODE_RL, Bit_Chain *, Dwg_Data *' failed at dwg2dxf: decode.c:5801 in libredwg v0.12.4.4608.π Read
via "National Vulnerability Database".
βΌ CVE-2022-34171 βΌ
π Read
via "National Vulnerability Database".
In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability.π Read
via "National Vulnerability Database".
βΌ CVE-2022-33026 βΌ
π Read
via "National Vulnerability Database".
LibreDWG v0.12.4.4608 was discovered to contain a heap buffer overflow via the function bit_calc_CRC at bits.c.π Read
via "National Vulnerability Database".
βΌ CVE-2022-34178 βΌ
π Read
via "National Vulnerability Database".
Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible values, resulting in a reflected cross-site scripting (XSS) vulnerability.π Read
via "National Vulnerability Database".
βΌ CVE-2022-34211 βΌ
π Read
via "National Vulnerability Database".
A cross-site request forgery (CSRF) vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP POST request to an attacker-specified URL.π Read
via "National Vulnerability Database".
βΌ CVE-2022-34204 βΌ
π Read
via "National Vulnerability Database".
A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.π Read
via "National Vulnerability Database".