CVE漏洞

OGeek|极客世界-中国程序员成长平台 › 门户 › 漏洞›CVE漏洞

RSS

CVE-2022-2189

The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web brow ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：785 | 回复：0
CVE-2022-2219

The Unyson WordPress plugin before 2.7.27 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：480 | 回复：0
CVE-2022-2239

The Request a Quote WordPress plugin through 2.3.7 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：612 | 回复：0
CVE-2022-2240

The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection o ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：491 | 回复：0
CVE-2022-2299

The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：568 | 回复：0
CVE-2022-2340

The W-DALIL WordPress plugin through 2.0 does not sanitise and escape some of its fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the u ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：543 | 回复：0
CVE-2022-2341

The Simple Page Transition WordPress plugin through 1.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：545 | 回复：0
CVE-2020-28422

All versions of package git-archive are vulnerable to Command Injection via the exports function.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：447 | 回复：0
CVE-2020-28435

This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：423 | 回复：0
CVE-2020-28436

This affects all versions of package google-cloudstorage-commands.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：442 | 回复：0
CVE-2020-28438

This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：449 | 回复：0
CVE-2020-28441

This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This c ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：559 | 回复：0
CVE-2020-28443

This affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：541 | 回复：0
CVE-2020-28445

This affects all versions of package npm-help. The injection point is located in line 13 in index.js file in export.latestVersion() function.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：851 | 回复：0
CVE-2020-28446

The package ntesseract before 0.2.9 are vulnerable to Command Injection via lib/tesseract.js.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：392 | 回复：0
CVE-2020-28447

This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopen(filepath)……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：463 | 回复：0
CVE-2020-28455

This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：547 | 回复：0
CVE-2020-28459

This affects all versions of package markdown-it-decorate. An attacker can add an event handler or use javascript:xxx for the link.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：437 | 回复：0
CVE-2020-28461

This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：510 | 回复：0
CVE-2020-28462

This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：600 | 回复：0
CVE-2020-28471

This affects the package properties-reader before 2.2.0.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：455 | 回复：0
CVE-2020-7649

This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：453 | 回复：0
CVE-2020-7677

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sani ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：643 | 回复：0
CVE-2020-7678

This affects all versions of package node-import. The params argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located i ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：417 | 回复：0
CVE-2021-23373

All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：402 | 回复：0
CVE-2021-23397

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：643 | 回复：0
CVE-2021-23451

The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：481 | 回复：0
CVE-2022-0670

A flaw was found in Openstack manilla owning a Ceph File system share, which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the volumes p ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：457 | 回复：0
CVE-2022-1232

Type confusion in V8 in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：444 | 回复：0
CVE-2022-1305

Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：457 | 回复：0
CVE-2022-1306

Inappropriate implementation in compositing in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：459 | 回复：0
CVE-2022-1307

Inappropriate implementation in full screen in Google Chrome on Android prior to 100.0.4896.88 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：469 | 回复：0
CVE-2022-1308

Use after free in BFCache in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：493 | 回复：0
CVE-2022-1309

Insufficient policy enforcement in developer tools in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：610 | 回复：0
CVE-2022-1310

Use after free in regular expressions in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:18 | 阅读：610 | 回复：0
CVE-2022-2193

Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attackers to add a FIDO2 authenticator to arbitrary accounts via parameter tampering in ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:17 | 阅读：797 | 回复：0
CVE-2022-35405

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:17 | 阅读：509 | 回复：0
CVE-2022-27544

BigFix Web Reports authorized users may see SMTP credentials in clear text.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:17 | 阅读：540 | 回复：0
CVE-2022-27545

BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:17 | 阅读：501 | 回复：0
CVE-2022-27579

A deserialization vulnerability in a .NET framework class used and not properly checked by Flexi Soft Designer in all versions up to and including 1.9.4 SP1 allows an attacker to craft malicious proje ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:17 | 阅读：561 | 回复：0