RCE vulnerability in Jenkins Azure Container Service Plugin

Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution RCE vulnerability exploitable by users able to provide YAML input files to Azure Container Service Plugin’s build step. Azur...

CVE-2022-1558

The Curtain WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed...

CVE-2022-28995

Rengine v1.0.2 was discovered to contain a remote code execution RCE vulnerability via the yaml configuration function...

PT-2022-19351 · Rengine · Rengine

Name of the Vulnerable Software and Affected Versions: Rengine version 1.0.2 Description: The issue is related to a remote code execution RCE vulnerability via the yaml configuration function. Recommendations: For Rengine version 1.0.2, consider disabling the yaml configuration function as a...

PT-2022-13876 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 1.0.2 through 14.8.5 GitLab CE/EE versions 14.9.0 through 14.9.3 GitLab CE/EE versions 14.10.0 Description: The issue is related to improper access control in the CI/CD cache mechanism, allowing a malicious actor with...

PT-2022-13869 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 1.0.2 through 14.8.6 GitLab CE/EE versions 14.9.0 through 14.9.4 GitLab CE/EE versions 14.10.0 through 14.10.1 Description: The issue is related to missing input masking in GitLab CE/EE, which causes potentially sensitiv...

JBoss KeyCloak is vulnerable to soft token deletion via CSRF

JBoss KeyCloak is vulnerable to soft token deletion via CSRF. This issue is fixed in Keycloak 1.0.2.Final...

GHSA-34VW-8CJW-CWJJ GeniXCMS SQL Injection

GeniXCMS 1.0.2 has SQL Injection in inc/lib/Control/Backend/menus.control.php via the menuid parameter...

GHSA-5HF2-7XF4-W3J6 GeniXCMS Cross-site Scripting

GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a malformed P element...

GHSA-559C-W54X-8342 GeniXCMS Mailbox validation logic vulnerability

GeniXCMS 1.0.2 allows remote attackers to bypass the alertDanger MSGUSEREMAILEXIST protection mechanism via a register.php?act=edit&id=1 request...

EulerOS 2.0 SP10 : openssl (EulerOS-SA-2022-1649)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3...

OpenSSL: c_rehash script allows command injection (CVE-2022-1292) - Linux

OpenSSL is prone to a command injection vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you ca...

EulerOS 2.0 SP5 : openssl098e (EulerOS-SA-2022-1546)

According to the versions of the openssl098e package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli...

Hotdog 安全漏洞

Hotdog is a set of OCI hooks for injecting Log4j Hot Patch into containers. A resource management error vulnerability exists in Hotdog versions prior to v1.0.2, which arises from an application that does not effectively perform resource limiting, device limiting, or syscall filters on the target...

EulerOS 2.0 SP9 : openssl (EulerOS-SA-2022-1455)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3...

Oracle Linux 6 : openssl (ELSA-2022-9272)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9272 advisory. - Fix possible infinite loop in BNmodsqrt CVE-2022-0778Orabug: 33969800 - Backport fixes for CVE-2020-1971 Orabug: 32654738 - Oracle bug 28730228: backport...

PT-2022-2516 · D Link · D-Link Dir-823-Pro

Name of the Vulnerable Software and Affected Versions: D-Link DIR-823-Pro version 1.0.2 Description: The issue is related to the implementation of the SetNTPserverSeting function in the D-Link DIR-823-Pro wireless router's firmware, which fails to properly sanitize data at the management level...

Oracle Linux 7 : openssl (ELSA-2022-1066)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-1066 advisory. - Fixes CVE-2022-2078 Infinite loop in BNmodsqrt reachable when parsing certificates Tenable has extracted the preceding description block directly from the...

SUSE SLES12 Security Update : nodejs12 (SUSE-SU-2022:0935-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0935-1 advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli...

SUSE SLES11: libopenssl-devel / libopenssl0_9_8 / libopenssl0_9_8-32bit / etc (SUSE-SU-2022:14915-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:14915-1 advisory. - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877. Tenable has extracted the preceding description block...