2022 年重大安全事件归档，按月分组回访。
【中文导读】Garage Management System 存在远程代码执行风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Garage Management System 1.0 is vulnerable to the Remote Code Execution (RCE) due to the lack of filtering from the file upload function. The vulnerability exist during adding parts and from the upload function, the attacker can upload PHP Reverse Shell straight away to gain RCE.
【中文导读】Hospital Information System 存在SQL 注入、认证绕过风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Hospital Information System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.
【中文导读】该 CVE 涉及访问控制（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Incorrect Access Control issue in Yellowfin Business Intelligence 7.3 allows remote attackers to escalate privilege via MIAdminStyles.i4 Admin UI.
【中文导读】issue was discovered in Keyfactor PrimeKey EJBCA 存在安全缺陷风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】An issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, related to possible inconsistencies in DNS identifiers submitted in an ACME order and the corresponding CSR submitted during finalization. During the ACME enrollment process, an order is submitted containing an identifier for one or multiple dnsNames. These are validated properly in the ACME challenge. However, if the validation passes, a non-compliant client can include additional dnsNames the CSR sent to the finalize endpoint, resulting in EJBCA issuing a certificate including the identifiers that were not validated. This occurs even if the certificate profile is configured to not allow a DN override by the CSR.
【中文导读】该 CVE 涉及服务端请求伪造（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.
【中文导读】OSU Open Source Lab VNCAuthProxy 存在安全缺陷风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】OSU Open Source Lab VNCAuthProxy through 1.1.1 is affected by an vncap/vnc/protocol.py VNCServerAuthenticator authentication-bypass vulnerability that could allow a malicious actor to gain unauthorized access to a VNC session or to disconnect a legitimate user from a VNC session. A remote attacker with network access to the proxy server could leverage this vulnerability to connect to VNC servers protected by the proxy server without providing any authentication credentials. Exploitation of this issue requires that the proxy server is currently accepting connections for the target VNC server.
【中文导读】该 CVE 涉及SQL 注入（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】The library automation system product KOHA developed by Parantez Teknoloji before version 19.05.03 has an unauthenticated SQL Injection vulnerability. This has been fixed in the version 19.05.03.01.
【中文导读】Keylime 存在远程代码执行风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】A vulnerability in Keylime before 6.3.0 allows an attacker to craft a request to the agent that resets the U and V keys as if the agent were being re-added to a verifier. This could lead to a remote code execution.
【中文导读】flaw was found in Keylime 存在信息泄露风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】A flaw was found in Keylime before 6.3.0. The logic in the Keylime agent for checking for a secure mount can be fooled by previously created unprivileged mounts allowing secrets to be leaked to other processes on the host.
【中文导读】In Keylime 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar.
【中文导读】In Keylime 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime operations.
【中文导读】In Keylime 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】In Keylime before 6.3.0, current keylime installer installs the keylime.conf file, which can contain sensitive data, as world-readable.
【中文导读】该 CVE 涉及安全缺陷（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Improper detection of complete HTTP body decompression SwiftNIO Extras provides a pair of helpers for transparently decompressing received HTTP request or response bodies. These two objects (HTTPRequestDecompressor and HTTPResponseDecompressor) both failed to detect when the decompressed body was considered complete. If trailing junk data was appended to the HTTP message body, the code would repeatedly attempt to decompress this data and fail. This would lead to an infinite loop making no forward progress, leading to livelock of the system and denial-of-service. This issue can be triggered by any attacker capable of sending a compressed HTTP message. Most commonly this is HTTP servers, as compressed HTTP messages cannot be negotiated for HTTP requests, but it is possible that users have configured decompression for HTTP requests as well. The attack is low effort, and likely to be reached without requiring any privilege or system access. The impact on availability is high: the process immediately becomes unavailable but does not immediately crash, meaning that it is possible for the process to remain in this state until an administrator intervenes or an automated circuit breaker fires. If left unchecked this issue will very slowly exhaust memory resources due to repeated buffer allocation, but the buffers are not written to and so it is possible that the processes will not terminate for quite some time. This risk can be mitigated by removing transparent HTTP message decompression. The issue is fixed by correctly detecting the termination of the compressed body as reported by zlib and refusing to decompress further data. The issue was found by Vojtech Rylko (https://github.com/vojtarylko) and reported publicly on GitHub.
【中文导读】Code by Zapier 存在权限提升、访问控制风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapier was providing a customer-controlled general-purpose virtual machine that unintentionally granted full access to all users of a company's account, but was supposed to enforce role-based access control within that company's account. Before 2022-08-17, a customer could have resolved this by (in effect) using a separate virtual machine for an application that held credentials - or other secrets - that weren't supposed to be shared among all of its employees. (Multiple accounts would have been needed to operate these independent virtual machines.)
【中文导读】该 CVE 涉及远程代码执行（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress.
【中文导读】该 CVE 涉及远程代码执行、内存破坏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The FwBlockSericceSmm driver does not properly validate input parameters for a software SMI routine, leading to memory corruption of arbitrary addresses including SMRAM, and possible arbitrary code execution.
【中文导读】该 CVE 涉及命令注入（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Arr-pm is an RPM reader/writer library written in Ruby. Versions prior to 0.0.12 are subject to OS command injection resulting in shell execution if the RPM contains a malicious "payload compressor" field. This vulnerability impacts the `extract` and `files` methods of the `RPM::File` class of this library. Version 0.0.12 patches these issues. A workaround for this issue is to ensure any RPMs being processed contain valid/known payload compressor values such as gzip, bzip2, xz, zstd, and lzma. The payload compressor field in an rpm can be checked by using the rpm command line tool.
【中文导读】SmartVista SVFE2 存在SQL 注入风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /SVFE2/pages/feegroups/mcc_group.jsf.
【中文导读】该 CVE 涉及路径遍历（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads. Path traversal in McWebserver Minecraft Mod for Fabric and Quilt up to and including 0.1.2.1 and McWebserver Minecraft Mod for Forge up to and including 0.1.1 allows all files, accessible by the program, to be read by anyone via HTTP request. Version 0.2.0 with patches are released to both platforms (Fabric and Quilt, Forge). As a workaround, the McWebserver mod can be disabled by removing the file from the `mods` directory.
【中文导读】md2roff 存在内存破坏风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】md2roff 1.9 has a stack-based buffer overflow via a Markdown file, a different vulnerability than CVE-2022-34913. NOTE: the vendor's position is that the product is not intended for untrusted input
【中文导读】该 CVE 涉及SQL 注入（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2.
【中文导读】In Apache Airflow 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.
【中文导读】该 CVE 涉及内存破坏、释放后使用（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move.
【中文导读】该 CVE 涉及安全缺陷（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.
【中文导读】该 CVE 涉及信息泄露、内存泄漏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
【中文导读】该 CVE 涉及信息泄露、内存泄漏（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
【中文导读】该 CVE 涉及安全缺陷（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】By sending specific queries to the resolver, an attacker can cause named to crash.
【中文导读】该 CVE 涉及安全缺陷（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3.
【中文导读】XPDF 存在空指针风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】XPDF 4.04 is vulnerable to Null Pointer Dereference in FoFiType1C.cc:2393.
【中文导读】该 CVE 涉及路径遍历（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】The Identity and Directory Management System developed by Çekino Bilgi Teknolojileri before version 2.1.25 has an unauthenticated Path traversal vulnerability. This has been fixed in the version 2.1.25
【中文导读】该 CVE 涉及认证绕过（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.
【中文导读】Jenkins Compuware Common Configuration Plugin 存在XXE风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
【中文导读】该 CVE 涉及跨站请求伪造（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】A cross-site request forgery (CSRF) vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers to connect to an attacker-specified webserver using attacker-specified credentials.
【中文导读】该 CVE 涉及访问控制（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to connect to an attacker-specified webserver using attacker-specified credentials.
【中文导读】该 CVE 涉及跨站请求伪造（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】A cross-site request forgery (CSRF) vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.xml file on the Jenkins controller file system with an empty file by providing a crafted file name to an API endpoint.
【中文导读】Jenkins Rundeck Plugin 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to trigger jobs that are configured to be triggerable via Rundeck.
【中文导读】该 CVE 涉及跨站请求伪造（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】A cross-site request forgery (CSRF) vulnerability in Jenkins Security Inspector Plugin 117.v6eecc36919c2 and earlier allows attackers to replace the generated report stored in a per-session cache and displayed to authorized users at the .../report URL with a report based on attacker-specified report generation options.
【中文导读】Jenkins DotCi Plugin 存在远程代码执行风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
【中文导读】missing permission check in Jenkins DotCi Plugin 存在访问控制风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】A missing permission check in Jenkins DotCi Plugin 2.40.00 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for attacker-specified commits.
【中文导读】Jenkins RQM Plugin 存在XXE风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Jenkins RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
【中文导读】Jenkins SmallTest Plugin 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Jenkins SmallTest Plugin 1.0.4 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a man-in-the-middle attack to intercept these connections.
【中文导读】Jenkins View26 Test-Reporting Plugin 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Jenkins View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a man-in-the-middle attack to intercept these connections.
【中文导读】该 CVE 涉及跨站请求伪造（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】A cross-site request forgery (CSRF) vulnerability in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
【中文导读】该 CVE 涉及跨站请求伪造（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】A cross-site request forgery (CSRF) vulnerability in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
【中文导读】该 CVE 涉及跨站请求伪造（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】A cross-site request forgery (CSRF) vulnerability in Jenkins CONS3RT Plugin 1.0.0 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
【中文导读】Ahsay AhsayCBS 存在远程代码执行风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options. Administrators that can modify the Runtime Options in the web interface can inject Java Runtime Options. These take effect after a restart. For example, an attacker can enable JMX services and consequently achieve remote code execution as the system user.
【中文导读】IBM Maximo Asset Management 存在认证绕过风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, and 7.6.1.3 could allow a user to bypass authentication and obtain sensitive information or perform tasks they should not have access to. IBM X-Force ID: 236311.
【中文导读】该 CVE 涉及跨站脚本（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】The Web Server component of TIBCO Software Inc.'s TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 6.0.0 through 6.0.8.
【中文导读】该 CVE 涉及跨站脚本（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】The Web Server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 5.4.1 and below.
【中文导读】SourceCodester Simple Task Managing System 存在SQL 注入风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】SourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at board.php.
【中文导读】SourceCodester Simple Task Managing System 存在SQL 注入风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】SourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at changeStatus.php.
【中文导读】In Progress WhatsUp Gold 存在安全缺陷风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】In Progress WhatsUp Gold before 22.1.0, an SNMP MIB Walker application endpoint failed to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser.
【中文导读】Online Pet Shop We App 存在SQL 注入风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/view_order.
【中文导读】Online Pet Shop We App 存在SQL 注入风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/view_order.
【中文导读】Open Source SACCO Management System 存在SQL 注入风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.php?action=delete_borrower.
【中文导读】该 CVE 涉及安全缺陷（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Prototype pollution vulnerability in tschaub gh-pages 3.1.0 via the partial variable in util.js.
【中文导读】Open Source SACCO Management System 存在SQL 注入风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.php?action=delete_plan.
【中文导读】该 CVE 涉及拒绝服务、访问控制（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Multiple Improper Access Control was discovered in Nokia AirFrame BMC Web GUI < R18 Firmware v4.13.00. It does not properly validate requests for access to (or editing of) data and functionality in all endpoints under /#settings/* and /api/settings/*. By not verifying the permissions for access to resources, it allows a potential attacker to view pages, with sensitive data, that are not allowed, and modify system configurations also causing DoS, which should be accessed only by user with administration profile, bypassing all controls (without checking for user identity).
【中文导读】iKuai OS 存在远程代码执行风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】iKuai OS v3.6.7 was discovered to contain an authenticated remote code execution (RCE) vulnerability.
【中文导读】DedeCMS 存在任意文件上传风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】DedeCMS V5.7.99 was discovered to contain an arbitrary file upload vulnerability via the component /dede/file_manage_control.php.
【中文导读】该 CVE 涉及任意文件上传（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】An arbitrary file upload vulnerability in the /admin/admin_pic.php component of Church Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.