CVE-2022-22127

Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity Store for managing users. The vulnerability allows a malicious site administrator to change passwords for users in different sites hosted on the same Tableau Server, resulting in the potential for unauthorized access to data.Tableau Server versions affected are:2020.4.16, 2021.1.13, 2021.2.10, 2021.3.9, 2021.4.4 and earlierNote: All future releases of Tableau Server will address this security issue. Versions that are no longer supported are not tested and may be vulnerable.

Source: CVE-2022-22127

CVE-2022-29651

An arbitrary file upload vulnerability in the Select Image function of Online Food Ordering System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.

Source: CVE-2022-29651

CVE-2022-29379

Nginx NJS v0.7.3 was discovered to contain a stack overflow in the function njs_default_module_loader at /src/njs/src/njs_module.c.

Source: CVE-2022-29379

CVE-2022-29650

Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the Search parameter at /online-food-order/food-search.php.

Source: CVE-2022-29650

CVE-2022-1851

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.

Source: CVE-2022-1851

CVE-2022-30322

HashiCorp go-getter through 2.0.2 does not safely perform downloads (issue 2 of 3).

Source: CVE-2022-30322

CVE-2022-30595

libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.

Source: CVE-2022-30595

CVE-2022-30321

HashiCorp go-getter through 2.0.2 does not safely perform downloads (issue 1 of 3).

Source: CVE-2022-30321

CVE-2022-26945

HashiCorp go-getter before 2.0.2 allows Command Injection.

Source: CVE-2022-26945

CVE-2022-28862

In Archibus Web Central before 26.2, multiple SQL Injection vulnerabilities occur in dwr/call/plaincall/workflow.runWorkflowRule.dwr. Through the injection of arbitrary SQL statements, a potential attacker can modify query syntax and perform unauthorized (and unexpected) operations against the remote database. This is fixed in all recent versions, such as version 26.2.

Source: CVE-2022-28862