βΌ CVE-2022-3514 βΌ
π Read
via "National Vulnerability Database".
An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in the submodule URL parser.π Read
via "National Vulnerability Database".
βΌ CVE-2022-4365 βΌ
π Read
via "National Vulnerability Database".
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak the sentry token by changing the configured URL in the Sentry error tracking settings page.π Read
via "National Vulnerability Database".
βΌ CVE-2022-4345 βΌ
π Read
via "National Vulnerability Database".
Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture fileπ Read
via "National Vulnerability Database".
βΌ CVE-2022-3613 βΌ
π Read
via "National Vulnerability Database".
An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A crafted Prometheus Server query can cause high resource consumption and may lead to Denial of Service.π Read
via "National Vulnerability Database".
βΌ CVE-2022-4037 βΌ
π Read
via "National Vulnerability Database".
An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A race condition can lead to verified email forgery and takeover of third-party accounts when using GitLab as an OAuth provider.π Read
via "National Vulnerability Database".
ποΈ New tool protects against vulnerabilities in popular file converter ImageMagick ποΈ
π Read
via "The Daily Swig".
Library has somewhat of an image problem given history of serious bugsπ Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
New tool protects against vulnerabilities in popular file converter ImageMagick
Library has somewhat of an image problem given history of serious bugs
βΌ CVE-2022-39183 βΌ
π Read
via "National Vulnerability Database".
Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors.π Read
via "National Vulnerability Database".
βΌ CVE-2022-39184 βΌ
π Read
via "National Vulnerability Database".
EXFO - BV-10 Performance Endpoint Unit authentication bypass User can manually manipulate access enabling authentication bypass.π Read
via "National Vulnerability Database".
βΌ CVE-2012-10005 βΌ
π Read
via "National Vulnerability Database".
A vulnerability has been found in manikandan170890 php-form-builder-class and classified as problematic. Affected by this vulnerability is an unknown functionality of the file PFBC/Element/Textarea.php of the component Textarea Handler. The manipulation of the argument value leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 74897993818d826595fd5857038e6703456a594a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218155.π Read
via "National Vulnerability Database".
βΌ CVE-2022-3592 βΌ
π Read
via "National Vulnerability Database".
A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks to files outside the 'smbd' configured share path and gain access to another restricted server's filesystem.π Read
via "National Vulnerability Database".
βΌ CVE-2013-10011 βΌ
π Read
via "National Vulnerability Database".
A vulnerability was found in aeharding classroom-engagement-system and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to sql injection. The attack may be launched remotely. The name of the patch is 096de5815c7b414e7339f3439522a446098fb73a. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218156.π Read
via "National Vulnerability Database".
βΌ CVE-2023-0244 βΌ
π Read
via "National Vulnerability Database".
A vulnerability classified as critical was found in TuziCMS 2.0.6. This vulnerability affects the function delall of the file \App\Manage\Controller\KefuController.class.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-218152.π Read
via "National Vulnerability Database".
βΌ CVE-2022-3341 βΌ
π Read
via "National Vulnerability Database".
A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.π Read
via "National Vulnerability Database".
βΌ CVE-2022-46503 βΌ
π Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in the component /admin/register.php of Online Student Enrollment System v1.0 allows attackers to execute arbitrary web scripts via a crafted payload injected into the name parameter.π Read
via "National Vulnerability Database".
βΌ CVE-2022-2155 βΌ
π Read
via "National Vulnerability Database".
A vulnerability exists in the affected versions of Lumada APMΓ’β¬β’s User Asset Group feature due to a flaw in access control mechanism implementation on the Γ’β¬ΕLimited EngineerΓ’β¬οΏ½ role, granting it access to the embedded Power BI reports feature. An attacker that manages to exploit the vulnerability on a customerΓ’β¬β’s Lumada APM could access unauthorized information by gaining unauthorized access to any Power BI reports installed by the customer. Furthermore, the vulnerability enables an attacker to manipulate asset issue comments on assets, which should not be available to the attacker. Affected versions * Lumada APM on-premises version 6.0.0.0 - 6.4.0.* List of CPEs: * cpe:2.3:a:hitachienergy:lumada_apm:6.0.0.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:lumada_apm:6.1.0.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:lumada_apm:6.2.0.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:lumada_apm:6.3.0.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:lumada_apm:6.4.0.0:*:*:*:*:*:*:*π Read
via "National Vulnerability Database".
βΌ CVE-2022-39187 βΌ
π Read
via "National Vulnerability Database".
Rumpus - FTP server version 9.0.7.1 has a Reflected cross-site scripting (RXSS) vulnerability through unspecified vectors.π Read
via "National Vulnerability Database".
βΌ CVE-2022-3515 βΌ
π Read
via "National Vulnerability Database".
A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.π Read
via "National Vulnerability Database".
βΌ CVE-2022-46370 βΌ
π Read
via "National Vulnerability Database".
Rumpus - FTP server version 9.0.7.1 Improper Token VerificationΓ’β¬β vulnerability may allow bypassing identity verification.π Read
via "National Vulnerability Database".
βΌ CVE-2023-0245 βΌ
π Read
via "National Vulnerability Database".
A vulnerability, which was classified as critical, has been found in SourceCodester Online Flight Booking Management System. This issue affects some unknown processing of the file add_contestant.php. The manipulation of the argument add_contestant leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-218153 was assigned to this vulnerability.π Read
via "National Vulnerability Database".
βΌ CVE-2022-46368 βΌ
π Read
via "National Vulnerability Database".
Rumpus - FTP server version 9.0.7.1 Cross-site request forgery (CSRF) Γ’β¬β vulnerability may allow unauthorized action on behalf of authenticated users.π Read
via "National Vulnerability Database".
βΌ CVE-2023-0243 βΌ
π Read
via "National Vulnerability Database".
A vulnerability classified as critical has been found in TuziCMS 2.0.6. This affects the function index of the file App\Manage\Controller\ArticleController.class.php of the component Article Module. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-218151.π Read
via "National Vulnerability Database".