Multiple vulnerabilities within the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.

Out-of-bounds read vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by having a user to open a specially crafted project file.

In hevc decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07491374; Issue ID: ALPS07491374.

In keyinstall, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07510064; Issue ID: ALPS07510064.

HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - Arbitrary File Upload

The File Upload function of EasyTest has insufficient filtering for special characters and file type. A remote attacker authenticated as a general user can upload and execute arbitrary files, to manipulate system or disrupt service.

HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - SQL Injection

The Download function’s parameter of EasyTest has insufficient validation for user input. A remote attacker authenticated as a general user can inject arbitrary SQL command to access, modify or delete database.

Infoblox NIOS through 8.6.4 and 9.x through 9.0.3 has Improper Input Validation.

Improper Authorization in usememos/memos

Improper Authorization in GitHub repository usememos/memos prior to 0.9.1.

Infoblox NIOS through 8.6.4 has Improper Access Control for Grids.

Infoblox NIOS through 8.6.4 has Improper Authentication for Grids.

Incorrect Use of Privileged APIs in usememos/memos

Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.

Improper Access Control in usememos/memos

Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.

Authorization Bypass Through User-Controlled Key in usememos/memos

Authorization Bypass Through User-Controlled Key vulnerability in usememos usememos/memos.This issue affects usememos/memos before 0.9.1.

Authorization Bypass Through User-Controlled Key in usememos/memos

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

Insufficient Granularity of Access Control in usememos/memos

Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.

Improper Access Control in usememos/memos

Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.

centic9 jgit-cookbook temp file

A vulnerability was found in centic9 jgit-cookbook. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to insecure temporary file. The attack can be initiated remotely. The name of the patch is b8cb29b43dc704708d598c60ac1881db7cf8e9c3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216988.

Cross-Site Request Forgery (CSRF) in usememos/memos

Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.

Cross-Site Request Forgery (CSRF) in usememos/memos

Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.

Cross-Site Request Forgery (CSRF) in usememos/memos

Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.