BTicino DoorEntry HOMETOUCH 信任管理问题漏洞

BTicino DoorEntry HOMETOUCH is an application from the Italian company BTicino. It can be connected to video intercoms inside and outside the home. A vulnerability with trust management issues exists in BTicino DoorEntry HOMETOUCH iOS version 1.4.2, which stems from a missing SSL certificate...

WordPress Material Design Icons for Page Builders Plugin <= 1.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Material Design Icons for Page Builders Type Plugin Vulnerable versions = 1.4.2 Fixed in 1.4.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-24374 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ca964ff46b5b Credits...

WordPress Plugin The Login with Phone Number SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...

PT-2023-6551 · WordPress · Login With Phone Number Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: Login with Phone Number WordPress Plugin version 1.4.2 Description: The issue is related to an authenticated SQL injection vulnerability in the lwp forgot password action. Specifically, the vulnerability is associated with the lack of...

CVE-2023-23492

The Login with Phone Number WordPress Plugin, version 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwpforgotpassword' action...

IBM WebSphere Automation 授权问题漏洞

IBM WebSphere Automation is an operations platform from International Business Machines IBM. automates operational activities to proactively mitigate security risks and accelerate threat remediation. A security vulnerability exists in IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps...

PT-2022-27042 · Ibm · Ibm Websphere Automation For Ibm Cloud Pak For Watson Aiops

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps version 1.4.2 Description: A local attacker can create an outbound network connection to another system due to weaker than expected security in the software. Recommendations: For...

HashiCorp Nomad vulnerable to non-sensitive metadata exposure

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2...

CVE-2022-3867 Nomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage Collected

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2...

PT-2022-24518 · Hashicorp · Nomad Enterprise +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Nomad and Nomad Enterprise versions 1.4.0 through 1.4.1 Description: The issue affects event stream subscribers using a token with TTL, allowing them to receive updates until token garbage is collected. Recommendations: For versions...

GHSA-HHQ3-FF78-JV3G loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)

A regular expression denial of service ReDoS flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils via the resourcePath variable in interpolateName.js. A badly or maliciously formed string could be used to send crafted requests that cause a system to crash or ta...

PT-2022-15471 · Ibm · Ibm Websphere Automation For Ibm Cloud Pak For Watson Aiops

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Automation for Cloud Pak for Watson AIOps version 1.4.2 Description: The issue is related to cross-site request forgery, caused by improper cookie attribute setting. Recommendations: For IBM WebSphere Automation for Cloud Pak fo...

CVE-2022-3026

The WP Users Exporter plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.2 via the 'Export Users' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into profile information like First Names that...

WordPress Plugin Email Templates 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2022-28888

Spryker Commerce OS 1.4.2 allows Remote Command Execution...

CVE-2022-28888

Spryker Commerce OS 1.4.2 allows Remote Command Execution...

CVE-2022-28888

Spryker Commerce OS 1.4.2 allows Remote Command Execution...

PT-2022-19293 · Spryker · Spryker Commerce Os

Name of the Vulnerable Software and Affected Versions: Spryker Commerce OS version 1.4.2 Description: The issue allows for Remote Command Execution. Recommendations: For Spryker Commerce OS version 1.4.2, at the moment, there is no information about a newer version that contains a fix for this...

CVE-2022-28888

CVE-2022-28888 affects Spryker Commerce OS 1.4.2 and specifically the spryker/http module versions below 1.7.0. The root cause is described as a predictable value used to sign/verify special _fragment URLs, enabling an attacker to cause remote command execution in many setups. Advisories state th...

Spryker Commerce OS 操作系统命令注入漏洞

Spryker Commerce OS is a B2B, B2C and Marketplace solution from Spryker Germany. A security vulnerability exists in Spryker Commerce OS version 1.4.2 that originates from allowing an attacker to perform remote command execution...