Security Bulletin: Potential security exposure when using InfoSphere BigInsights due to vulnerability in Java JDK Version 6

Abstract IBM InfoSphere BigInsights makes use of Java Development Kit JDK Version 6. An unspecified vulnerability affecting availability has been identified in IBM Java 6 that may affect InfoSphere BigInsights. Content VULNERABILITY DETAILS: CVE-2012-0501 DESCRIPTION: An unspecified vulnerability...

Security Bulletin: Multiple Vulnerabilities in InfoSphere BigInsights due to vulnerabilities in IBM Java JDK Version 6 (CVE-2012-1717, CVE-2012-1718)

Abstract IBM InfoSphere BigInsights makes use of IBM Java Development Kit JDK Version 6. Multiple vulnerabilities have been identified in IBM Java 6, and addressed in IBM Java 6 JDK SR 11. Content VULNERABILITYDETAILS: CVE-2012-1718, CVE-2012-1717 DESCRIPTION: Vulnerabilities in the Java...

Design/Logic Flaw

MZ Automation's libIEC61850 versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e accesses a resource using an incompatible type, which could allow an attacker to crash the server with a malicious payload...

PT-2022-4742 · Unknown +1 · Libiec61850 +1

Name of the Vulnerable Software and Affected Versions: libIEC61850 versions 1.4 and prior libIEC61850 version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e Description: The issue is related to errors in pointer dereferencing, which could allow a remote attacker to cause a denial of...

CVE-2022-2233

The Banner Cycler plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce protection on the pabcadminslidespostback function found in the /admin/admin.php file. This makes it possible for unauthenticated attackers to inje...

WordPress plugin Banner Cycler 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress plugin Charts and Maps 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

Library Management System SQL注入漏洞

Library Management System is a library management system with QR code attendance and automatic library card generation by King Albaracin Personal Developer. A security vulnerability exists in Library Management System v1.4 due to a SQL injection in the MId parameter of its /librarian/del.php...

RHEL 8 : 389-ds:1.4 (RHSA-2022:5823)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5823 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP...

RHEL 8 : 389-ds:1.4 (RHSA-2022:5620)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5620 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP...

CVE-2022-2001 DX Share Selection <= 1.4 - Cross-Site Request Forgery to Cross-Site Scripting

The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce protection on the dxssadminpage function found in the /dx-share-selection.php file. This makes it possible for unauthenticated attackers to...

WordPress plugin DX Share Selection 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

PT-2022-14256 · WordPress · Dx Share Selection

Name of the Vulnerable Software and Affected Versions: DX Share Selection plugin for WordPress versions up to, and including 1.4 Description: The issue is due to missing nonce protection on the dxss admin page function found in the /dx-share-selection.php file, making it possible for...

PT-2022-22337 · Jenkins · Jenkins Rich Text Publisher Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Rich Text Publisher Plugin versions 1.4 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the HTML message set by the post-build step is not escaped, allowing attackers...

Virtuozzo Hybrid Infrastructure 4.7 Update 1.4 (4.7.1-53)

This update provides important security fixes. Vulnerability id: VSTOR-53595 A security fix for CVE-2022-1552 in PostgreSQL. Vulnerability id: VSTOR-54722 A security fix for CVE-2018-25032 in zlib. Vulnerability id: VSTOR-53723 A security fix for CVE-2022-1271 in gzip...

Denial-of-service possibility in logout() view by filling session store

The 1 contrib.sessions.backends.base.SessionBase.flush and 2 cachedb.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service session stor...

Django Vulnerable to Cache Poisoning

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the 1 Vary: Cookie or 2 Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers...

Django denial of service via empty session record creation

contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service session store consumption or session record removal via a large number of requests to...

GHSA-9CWG-MHXF-HH59 Django cross-site scripting (XSS) vulnerability via is_safe_url function

The issafeurl function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting XSS or other vulnerabilities into Django applications that use this function, a...

Ember.js Cross-site Scripting vulnerability

Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting XSS attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value a...