CVE漏洞

OStack程序员社区-中国程序员成长平台 › 门户 › 漏洞›CVE漏洞

RSS

CVE-2022-1500

Insufficient data validation in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass content security policy via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：1055 | 回复：0
CVE-2022-1501

Inappropriate implementation in iframe in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：679 | 回复：0
CVE-2022-1633

Use after free in Sharesheet in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corru ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：722 | 回复：0
CVE-2022-1634

Use after free in Browser UI in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who had convinced a user to engage in specific UI interaction to potentially exploit heap corruption via ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：670 | 回复：0
CVE-2022-1635

Use after free in Permission Prompts in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：1476 | 回复：0
CVE-2022-1636

Use after free in Performance APIs in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：714 | 回复：0
CVE-2022-1637

Inappropriate implementation in Web Contents in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to leak cross-origin data via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：764 | 回复：0
CVE-2022-1638

Heap buffer overflow in V8 Internationalization in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：1169 | 回复：0
CVE-2022-1639

Use after free in ANGLE in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：832 | 回复：0
CVE-2022-1640

Use after free in Sharing in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a craf ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：1074 | 回复：0
CVE-2022-1641

Use after free in Web UI Diagnostics in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit he ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：805 | 回复：0
CVE-2022-27105

InMailX Outlook Plugin 3.22.0101 is vulnerable to Cross Site Scripting (XSS). InMailX Connection names are not sanitzed in the Outlook tab, which allows a local user or network administrator to execu ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：705 | 回复：0
CVE-2022-29951

JTEKT TOYOPUC PLCs through 2022-04-29 mishandle authentication. They utilize the CMPLink/TCP protocol (configurable on ports 1024-65534 on either TCP or UDP) for a wide variety of engineering purposes ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：1030 | 回复：0
CVE-2022-29952

Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols (60005/TCP, 60007/TCP) for communications between the monitori ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：675 | 回复：0
CVE-2022-29953

The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded credentials. An attacker capable of connect ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：710 | 回复：0
CVE-2022-29957

The Emerson DeltaV Distributed Control System (DCS) through 2022-04-29 mishandles authentication. It utilizes several proprietary protocols for a wide variety of functionality. These protocols include ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：947 | 回复：0
CVE-2022-29958

JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity. They utilize the unauthenticated CMPLink/TCP protocol for engineering purposes, including downloading projects and control logic to ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：736 | 回复：0
CVE-2022-29960

Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. DES with hardcoded cryptographic keys is used for prot ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：692 | 回复：0
CVE-2022-29962

The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：814 | 回复：0
CVE-2022-29963

The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. TELNET on port 18550 provides access to a root shell via hardcoded credentials. This a ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：987 | 回复：0
CVE-2022-29964

The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root, DeltaV, or backup via hardcoded credentia ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：758 | 回复：0
CVE-2022-29965

The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface (23/TCP) on M ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：776 | 回复：0
CVE-2022-30273

The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In Legacy Encryption mode, traffic is encryp ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：883 | 回复：0
CVE-2022-30275

The Motorola MOSCAD Toolbox software through 2022-05-02 relies on a cleartext password. It utilizes an MDLC driver to communicate with MOSCAD/ACE RTUs for engineering purposes. Access to these communi ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：1275 | 回复：0
CVE-2022-31204

Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. They feature a UM Protection setting that allows users or system integrators to configure a password in order ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：1185 | 回复：0
CVE-2022-31205

In Omron CS series, CJ series, and CP series PLCs through 2022-05-18, the password for access to the Web UI is stored in memory area D1449...D1452 and can be read out using the Omron FINS protocol wit ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：846 | 回复：0
CVE-2022-31206

The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engin ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：2089 | 回复：0
CVE-2022-31207

The Omron SYSMAC Cx product family PLCs (CS series, CJ series, and CP series) through 2022-05-18 lack cryptographic authentication. They utilize the Omron FINS (9600/TCP) protocol for engineering purp ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：652 | 回复：0
CVE-2021-33057

The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) for determining the device's physical location. An attacke ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：1072 | 回复：0
CVE-2021-40180

In the WeChat application 8.0.10 for Android and iOS, a mini program can obtain sensitive information from a user's address book via wx.searchContacts.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：852 | 回复：0
CVE-2022-30269

Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity. They allow for custom application installation via either STS software, the C toolkit, or the ACE1000 Easy Configurator. In th ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：951 | 回复：0
CVE-2022-30270

The Motorola ACE1000 RTU through 2022-05-02 has default credentials. It exposes an SSH interface on port 22/TCP. This interface is used for remote maintenance and for SFTP file-transfer operations tha ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：656 | 回复：0
CVE-2022-30271

The Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_service) only generate a new key if no private-key file exists. ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：664 | 回复：0
CVE-2022-30272

The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity. It utilizes either the STS software suite or ACE1000 Easy Configurator for performing firmware updates. In case of the Easy C ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：762 | 回复：0
CVE-2022-30274

The Motorola ACE1000 RTU through 2022-05-02 uses ECB encryption unsafely. It can communicate with an XRT LAN-to-radio gateway by means of an embedded client. Credentials for accessing this gateway are ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：756 | 回复：0
CVE-2022-30276

The Motorola MOSCAD and ACE line of RTUs through 2022-05-02 omit an authentication requirement. They feature IP Gateway modules which allow for interfacing between Motorola Data Link Communication (MD ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：1120 | 回复：0
CVE-2022-36129

HashiCorp Vault and Vault Enterprise through 2022-07-17 have Incorrect Access Control.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：699 | 回复：0
CVE-2022-34594

Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component ip/school/moudel/update_subject.php. This vulnerability allows attackers t ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：687 | 回复：0
CVE-2022-34611

A cross-site scripting (XSS) vulnerability in /index.php/?p=report of Online Fire Reporting System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into th ...……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：672 | 回复：0
CVE-2022-34612

Rizin v0.4.0 and below was discovered to contain an integer overflow via the function get_long_object(). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted binary.……

作者：菜鸟教程小白 | 时间：2022-7-29 17:19 | 阅读：631 | 回复：0