Mysiteforme 代码问题漏洞

Mysiteforme is a privilege management system. A security vulnerability exists in Mysiteforme version v2.2.1, which can be exploited by an attacker to spoof requests to the server side...

WordPress WP 2FA plugin <= 2.2.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Utkarsh Agrawal in WordPress WP 2FA plugin versions = 2.2.0. Solution Update the WordPress WP 2FA plugin to the latest available version at least 2.2.1...

Low: Red Hat Security Advisory: Red Hat Integration Camel Extensions for Quarkus 2.2.1-1 security update

A security update to Red Hat Integration Camel Extensions for Quarkus 2.2.1 is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Red Hat Product Security has rated this update as having an impact of Low. A Common Vulnerability Scoring System CVS...

Session fixation

In DayByDay CRM, versions 2.2.0 through 2.2.1 latest are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed...

Bottelet Daybyday Crm 跨站脚本漏洞

Bottelet Daybyday Crm is a builder system for task, time, employee, and vacation management by Bottelet Individual Developers. Bottelet DayByDay CRM suffers from a cross-site scripting vulnerability that stems from an application-wide Client-Side Template Injection CSTI suffered in DayByDay CRM,...

CVE-2022-22113

In DayByDay CRM, versions 2.2.0 through 2.2.1 latest are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed...

CVE-2022-22112

In DayByDay CRM, versions 1.1 through 2.2.1 latest suffer from an application-wide Client-Side Template Injection CSTI. A low privileged attacker can input template injection payloads in the application at various locations to execute JavaScript on the client browser...

Security Bulletin: Two security vulnerabilities have been identified in IBM HTTP Server shipped with IBM eDiscovery Manager (CVE-2015-1283, CVE-2015-3183)

Abstract Security Bulletin: Two security vulnerabilities have been identified in IBM HTTP Server shipped with IBM eDiscovery Manager CVE-2015-1283, CVE-2015-3183 Body IBM HTTP Server is shipped as a component of IBM eDiscovery Manager. Information about two security vulnerabilities that affect IB...

Apache Storm Nimbus getTopologyHistory Unauthenticated Command Execution

This module exploits an unauthenticated command injection vulnerability within the Nimbus service component of Apache Storm. The getTopologyHistory RPC method method takes a single argument which is the name of a user which is concatenated into a string that is executed by bash. In order for the...

Hitachi Energy Relion 系列安全漏洞

Hitachi Energy Relion is a Swiss Hitachi Energy company used to protect, control, measure and monitor for power systems. A security vulnerability exists in the Hitachi Energy Relion Relion 670/650/SAM600-IO Series that allows an attacker to gain access to the front-end network port and cause a...

PT-2021-10652 · Muyucms · Muyucms

Name of the Vulnerable Software and Affected Versions: Myucms version 2.2.1 Description: The issue concerns a remote code execution RCE vulnerability. It is located in the controllerConfig.php component and can be exploited via the addqq method. Recommendations: For Myucms version 2.2.1, consider...

PT-2021-10651 · Muyucms · Muyucms

Name of the Vulnerable Software and Affected Versions: Myucms version 2.2.1 Description: The issue is related to a remote code execution RCE vulnerability in the controllerpoint.php component. This vulnerability can be exploited via the add method. Recommendations: For Myucms version 2.2.1,...

PT-2021-10650 · Muyucms · Muyucms

Name of the Vulnerable Software and Affected Versions: Myucms version 2.2.1 Description: The issue is related to a remote code execution RCE vulnerability in the controllerConfig.php component. This vulnerability can be exploited via the add method. Recommendations: For Myucms version 2.2.1,...

Python < 2.7.14, 3.3.x < 3.3.7, 3.4.x < 3.4.7, 3.5.x < 3.5.4, 3.6.x < 3.6.2 Expat 2.2.1 (bpo-30694) - Linux

'Expat SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python"; ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.118250";...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Netty

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Netty. Vulnerability Details CVEID: CVE-2021-21290 DESCRIPTION: Netty could allow a local authenticated attacker to obtain sensitive information, caused by an insecure temp file in Unix-like systems. By sendi...

WordPress Station Pro plugin <= 2.2.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by iohex and WPScanTeam in WordPress Station Pro plugin versions = 2.2.1. Solution Update the WordPress Station Pro plugin to the latest available version at least 2.2.2...

CVE-2021-36156

An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that locatio...

Directory traversal

An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that locatio...

PT-2021-21144

Name of the Vulnerable Software and Affected Versions: Grafana Loki versions through 2.2.1 Description: An issue was discovered where the header value X-Scope-OrgID is used to construct file paths for rules files. If this value is crafted to conduct directory traversal, such as...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Node.js. Vulnerability Details CVEID: CVE-2021-23362 DESCRIPTION: Node.js hosted-git-info module is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the fromUr...