CVE漏洞

OStack程序员社区-中国程序员成长平台 › 门户 › 漏洞›CVE漏洞

RSS

CVE-2021-23163

JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints. This issue affects: JFrog JFrog Artifactory JFrog Artifactory version ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：534 | 回复：0
CVE-2021-45721

JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API endpoint. This issue affects: JFrog JFro ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：1043 | 回复：0
CVE-2021-46687

JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects: JFrog JFrog Artifactory JFrog Artifactor ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：574 | 回复：0
CVE-2022-32533

** UNSUPPORTED WHEN ASSIGNED ** Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configurati ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：458 | 回复：0
CVE-2022-35229

An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of th ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：487 | 回复：0
CVE-2022-35230

An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the v ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：738 | 回复：0
CVE-2022-30591

** DISPUTED ** quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QUIC or HTTP/3 requests are sent. This occurs b ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：1467 | 回复：0
CVE-2022-32290

The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control. It listens on a random, unprivileged TCP port and exposes an HTTP proxy to facilitate API calls from additional ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：696 | 回复：0
CVE-2022-32383

Tenda AC23 v16.03.07.44 was discovered to contain a stack overflow via the AdvSetMacMtuWan function.……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：466 | 回复：0
CVE-2022-32385

Tenda AC23 v16.03.07.44 is vulnerable to Stack Overflow that will allow for the execution of arbitrary code (remote).……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：677 | 回复：0
CVE-2022-32386

Tenda AC23 v16.03.07.44 was discovered to contain a buffer overflow via fromAdvSetMacMtuWan.……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：754 | 回复：0
CVE-2021-31676

A reflected XSS was discovered in PESCMS-V2.3.3. When combined with CSRF in the same file, they can cause bigger destruction.……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：871 | 回复：0
CVE-2021-31677

An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that can modify admin and other members' passwords.……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：1222 | 回复：0
CVE-2021-31678

An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that can delete import information about a user's company.……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：646 | 回复：0
CVE-2021-31679

An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that allows attackers to delete admin and other members' account numbers.……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：669 | 回复：0
CVE-2021-37839

Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：503 | 回复：0
CVE-2022-24138

IOBit Advanced System Care (Asc.exe) 15 and Action Download Center both download components of IOBit suite into ProgramData folder, ProgramData folder has rwx permissions for unprivileged users. Low p ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：504 | 回复：0
CVE-2022-24139

In IOBit Advanced System Care (AscService.exe) 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService's named pipes. ASCService first tries to ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：461 | 回复：0
CVE-2022-24140

IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in order to download a config file. After dow ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：506 | 回复：0
CVE-2022-24141

The iTopVPNmini.exe component of iTop VPN 3.2 will try to connect to datastate_iTopVPN_Pipe_Server on a loop. An attacker that opened a named pipe with the same name can use it to gain the token of an ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：798 | 回复：0
CVE-2022-28935

Totolink A830R V5.9c.4729_B20191112, Totolink A3100R V4.1.2cu.5050_B20200504, Totolink A950RG V4.1.2cu.5161_B20200903, Totolink A800R V4.1.2cu.5137_B20200730, Totolink A3000RU V5.9c.5185_B20201128, To ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：474 | 回复：0
CVE-2022-33980

Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is ${prefix:name}, where prefix is use ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：464 | 回复：0
CVE-2022-20082

In GPU, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：1893 | 回复：0
CVE-2022-20083

In Modem 2G/3G CC, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution when decoding combined FACILITY with no additional execution privileg ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：731 | 回复：0
CVE-2022-21744

In Modem 2G RR, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution when decoding GPRS Packet Neighbour Cell Data (PNCD) improper neighbouri ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：933 | 回复：0
CVE-2022-21763

In telecom service, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User i ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：626 | 回复：0
CVE-2022-21764

In telecom service, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User i ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：448 | 回复：0
CVE-2022-21765

In CCCI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：1269 | 回复：0
CVE-2022-21766

In CCCI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：1610 | 回复：0
CVE-2022-21767

In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction i ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：714 | 回复：0
CVE-2022-21768

In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction i ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：958 | 回复：0
CVE-2022-21769

In CCCI, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed f ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：540 | 回复：0
CVE-2022-21770

In sound driver, there is a possible information disclosure due to symlink following. This could lead to local information disclosure with System execution privileges needed. User interaction is not n ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：518 | 回复：0
CVE-2022-21771

In GED driver, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：1229 | 回复：0
CVE-2022-21772

In TEEI driver, there is a possible type confusion due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：430 | 回复：0
CVE-2022-21773

In TEEI driver, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：522 | 回复：0
CVE-2022-21774

In TEEI driver, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：892 | 回复：0
CVE-2022-21775

In sched driver, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed fo ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：1025 | 回复：0
CVE-2022-21776

In MDP, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploit ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：1294 | 回复：0
CVE-2022-21777

In Autoboot, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...……

作者：菜鸟教程小白 | 时间：2022-7-8 08:05 | 阅读：652 | 回复：0