WordPress Plugin Private Messages Cross-Site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Private Messages plugin 2.1.10 and earlier versions are vulnerable to a cross-site scriptin...

SUSE SLES12 Security Update : kernel (SUSE-SU-2022:2083-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2083-1 advisory. - An issue was discovered in the Linux kernel before 5.0.6. In rxqueueaddkobject and netdevqueueaddkobject in net/core/net-sysfs.c,...

CVE-2022-31845

A vulnerability in livecheck.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd function...

CVE-2022-31308

A vulnerability in livemfg.shtml of WAVLINK AERIAL X 1200M M79X3.V5030.191012 allows attackers to obtain sensitive router information via execution of the exec cmd function...

WAVLINK WN535 G3 has security vulnerabilities

The WAVLINK WN535 G3 is a wireless router from the Chinese company WAVLINK. A security vulnerability exists in the WAVLINK WN535 G3 M35G3R.V5030.180927 version, which originates from a vulnerability in livemfg.shtml. An attacker can exploit this vulnerability to obtain sensitive router informatio...

Vulnerabilities fixed in Microsoft Office

Vulnerabilities have been fixed in several Microsoft Office products. The table below lists the vulnerabilities that have been fixed by Microsoft with the corresponding CVSSv3 scores. Misuse of the vulnerabilities in SharePoint requires prior authentication. Abuse of the vulnerabilities in Excel...

PT-2022-20681 · Wavlink · Wavlink Aerial X 1200M

Name of the Vulnerable Software and Affected Versions: WAVLINK AERIAL X 1200M version M79X3.V5030.180719 Description: A vulnerability in live check.shtml allows attackers to obtain sensitive router information via execution of the exec cmd function. Recommendations: For version M79X3.V5030.180719...

CVE-2022-32278

XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server...

Exploit for OS Command Injection in Zyxel Usg_Flex_100W_Firmware

CVE-2022-30525 Zyxel Firewall Remote Command Injection A py...

PT-2022-5190 · Realvnc · Realvnc Vnc Server

Name of the Vulnerable Software and Affected Versions: RealVNC VNC Server versions 5.1.0 through 6.9.0 for Windows Description: The issue is related to the execution of files in the %TEMP% directory as SYSTEM, allowing an attacker to escalate privileges. This occurs because an installer repair...

Security Bulletin: CVE-2020-17530 may affect Apache struts2-core used by Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections

Summary Vulnerability found in Apache struts2-core-2.5.22 used by Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections Vulnerability Details CVEID: CVE-2020-17530 DESCRIPTION: Apache Struts could allo...

D-Link DIR-859 Buffer Overflow (CVE-2022-25106)

A buffer overflow vulnerability exists in D-Link DIR-859. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

VulnCheck KEV: CVE-2016-2386

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability

The Universal 3D U3D component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service DoS...

Microsoft Office Object Record Corruption Vulnerability

Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object...

Exploit for CVE-2022-30190

CVE-2022-30190 - Microsoft Support Diagnostic Tool About...

CVE-2022-30927

A SQL injection vulnerability exists in Simple Task Scheduling System 1.0 when MySQL is being used as the application database. An attacker can issue SQL commands to the MySQL database through the vulnerable "id" parameter...

CVE-2022-30190 (Follina) vulnerability in MSDT: description and counteraction

At the end of May, researchers from the naosec team reported a new zero-day vulnerability in Microsoft Support Diagnostic Tool MSDT that can be exploited using Microsoft Office documents. It allowed attackers to remotely execute code on Windows systems, while the victim could not even open the...

Avantune Genialcloud ProJ Cross-Site Scripting Vulnerability

Avantune Genialcloud ProJ is a cloud-based ERP platform from Avantune Canada. version 10 of Avantune Genialcloud ProJ is vulnerable to a cross-site scripting vulnerability that could be exploited by attackers to inject and execute arbitrary web scripts or HTML via a crafted payload...

GHSA-8RP2-J3VJ-HGJ4 Cross site scripting in Jfinal

A cross-site scripting XSS vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-Forwarded-For request...