PT-2023-14142 · WordPress · Replyable

Name of the Vulnerable Software and Affected Versions: Replyable WordPress plugin versions prior to 2.2.10 Description: The issue arises from the lack of validation of the class name submitted by the request when instantiating an object in the prompt dismiss notice action, and the absence of a CS...

SUSE CVE-2018-4300

The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10...

Replyable < 2.2.10 - Subscriber+ PHP Object Injection

The plugin does not validate the class name submitted by the request when instantiating an object in the promptdismissnotice action and also lacks CSRF check in the related action. This could allow any authenticated users, such as subscriber to perform Object Injection attacks. The attack could...

[SECURITY] Fedora 35 Update: golang-github-mmarkdown-mmark-2.2.10-5.fc35

Mmark is a powerful markdown processor written in Go, geared towards writing IETF documents. It is, however, also suited for writing complete books and ot her technical documentation, like the Learning Go book mmark source, and I-D text output...

PT-2022-10597 · Undertow · Undertow

Name of the Vulnerable Software and Affected Versions: Undertow versions prior to 2.0.40 Undertow versions prior to 2.2.10 Description: A flaw was found in Undertow, where a buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion, allowing an attacker to cause a denial of...

PT-2022-3256 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 1.0.0 through 2.4.0 Argo CD versions 2.1.0 through 2.1.15 Argo CD versions 2.2.0 through 2.2.9 Argo CD versions 2.3.0 through 2.3.4 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The...

Magento remote code execution vulnerability

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to modify product catalogs can trigger PHP file inclusion through a crafted XML file that specifies product design update. As per the Magento...

GHSA-6M27-3R8Q-C7F7 Magento 2 Community Edition XSS Vulnerability

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code when adding a new customer attribute for stores. As per the Magento Release 2.3.3, if you have already...

Magento 2 Community Edition XSS Vulnerability

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code into code field of an inventory source...

Magento Cross-Site Scripting via Signifyd Guarantee Option Translation Override

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can exploit it by injecting an embedded expression into a translation...

Request injection in Spring Cloud Gateway

Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or...

CVE-2021-22051

Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or...

Basecamp: Insecure Bundler configuration fetching internal Gems (okra) from Rubygems.org

I believe most likely that one of your projects is not set up correctly to only pull internal gems from your internal gem server, and instead will pull gems from Rubygems.org if the version number there is higher. Specifically, the "okra" gem. At around 15:21 today UTC the okra gem that I wrote –...

PT-2020-14293 · Nette +1 · Nette +1

Name of the Vulnerable Software and Affected Versions: Nette versions prior to 2.0.19 Nette versions prior to 2.1.13 Nette versions prior to 2.2.10 Nette versions prior to 2.3.14 Nette versions prior to 2.4.16 Nette versions prior to 3.0.6 Description: The issue allows for a code injection attack...

cups: Session cookie generated by the CUPS web interface is easy to guess

The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10...

CVE-2020-5554

Directory traversal vulnerability in Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write arbitrary files via unspecified vectors...

CVE-2020-5555

Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write data of the files placed in the same directory where it is placed via unspecified vector due to the improper input validation issue...

EKAKIN Shihonkanri Plus GOOUT Operating System Command Injection Vulnerability

EKAKIN Shihonkanri Plus GOOUT is a CGI Common Gateway Interface from EKAKIN Japan. An operating system command injection vulnerability exists in EKAKIN Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10. A remote attacker could exploit this vulnerability to execute arbitrary operating system commands...

EKAKIN Shihonkanri Plus GOOUT Input Validation Error Vulnerability

EKAKIN Shihonkanri Plus GOOUT is a CGI Common Gateway Interface from EKAKIN Japan. An input validation error vulnerability exists in EKAKIN shihonkanri Plus GOOUT versions 1.5.8 and 2.2.10. The vulnerability originates from a network system or product that does not properly validate incoming data...

EKAKIN Shihonkanri Plus GOOUT Path Traversal Vulnerability

EKAKIN Shihonkanri Plus GOOUT is a CGI Common Gateway Interface from EKAKIN Japan. A path traversal vulnerability exists in EKAKIN shihonkanri Plus GOOUT versions 1.5.8 and 2.2.10. The vulnerability stems from a failure of a network system or product to properly filter special elements in the pat...