PT-2022-18717 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.3.1 Description: A vulnerability in the UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks that were not executed, such as when tasks were depending on pas...

Apache Airflow 信息泄露漏洞

Apache Airflow is an open source platform for creating, managing and monitoring workflows from the Apache Foundation. The platform is scalable and dynamically monitored, etc. An information disclosure vulnerability exists in versions prior to Apache Airflow 2.3.1, which stems from the application...

Keystone 授权问题漏洞

Keystone is a powerful CMS designed to help you build and scale faster than any other Cms or application framework. An authorization issue vulnerability exists in versions of Keystone prior to 2.3.1, which stems from the fact that users who use field-level access controls are vulnerable to not...

An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.

...

PT-2022-26517 · Hashicorp · Hashicorp Packer +1

Name of the Vulnerable Software and Affected Versions: Hashicorp Packer versions prior to 2.3.1 Description: An issue was discovered in the recommended sudoers configuration for Vagrant on Linux, which is insecure. Non-privileged users on the host can leverage a wildcard in the sudoers...

PT-2022-22404 · Yoomoney · Yoomoney Юkassa Для Woocommerce

Name of the Vulnerable Software and Affected Versions: YooMoney ЮKassa для WooCommerce plugin versions prior to 2.3.1 Description: The issue allows for authenticated arbitrary settings update. Recommendations: For versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue...

PT-2022-23482 · Jizhicms · Jizhicms

Name of the Vulnerable Software and Affected Versions: jizhicms version 2.3.1 Description: The issue is related to SQL injection in the background of the software. Recommendations: For jizhicms version 2.3.1, at the moment, there is no information about a newer version that contains a fix for thi...

PT-2022-23481 · Jizhicms · Jizhicms

Name of the Vulnerable Software and Affected Versions: jizhicms version 2.3.1 Description: An issue was discovered that allows for a CSRF vulnerability, which can be exploited to add an admin. Recommendations: For jizhicms version 2.3.1, as a temporary workaround, consider implementing CSRF...

VR Calendar < 2.3.1 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/plugins.php?vrcmsg=msgtype="...

WordPress VR Calendar plugin < 2.3.1 - Unauthenticated Arbitrary Function Call vulnerability

Unauthenticated Arbitrary Function Call vulnerability discovered by Vinay Varma Mudunuri and Krishna Harsha Kondaveeti in WordPress VR Calendar plugin versions 2.3.1. Solution Update the WordPress VR Calendar plugin to the latest available version at least 2.3.1...

[SECURITY] Fedora 35 Update: golang-github-letsencrypt-pebble-2.3.1-5.fc35

A miniature version of Boulder, Pebble is a small RFC 8555 ACME test server n ot suited for a production certificate authority...

AZL-45039 CVE-2022-34266 affecting package openjpeg2 2.3.1-12

The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service application crash, a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset function within...

[SECURITY] Fedora 36 Update: golang-github-letsencrypt-pebble-2.3.1-5.fc36

A miniature version of Boulder, Pebble is a small RFC 8555 ACME test server n ot suited for a production certificate authority...

CVE-2022-1951

The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leading to a Reflected...

WordPress Core plugin for Kitestudio themes <= 2.3.0 - Reflected Cross-Site-Scripting (XSS) vulnerability

Reflected Cross-Site-Scripting XSS vulnerability discovered by cydave in WordPress Core plugin for Kitestudio themes versions = 2.3.0. Solution Update the WordPress Core plugin for Kitestudio themes to the latest available version at least 2.3.1...

CVE-2022-1299

The Slideshow WordPress plugin through 2.3.1 does not sanitize and escape some of its default slideshow settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Apache Jetspeed vulnerable to SQL Injection

Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the 1 role or 2 user parameter to services/usermanager/users/...

Weak Password Recovery Mechanism for Forgotten Password

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password via an empty confirmhash value to verify.php. Remediation Upgrade mantisbt/mantisbt to version 1.3.10, 2.2.4, 2.3.1 or higher. References...

PT-2022-13713 · WordPress · Ultimate Member

Name of the Vulnerable Software and Affected Versions: The Ultimate Member plugin for WordPress versions up to, and including, 2.3.1 Description: The issue is related to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page. This makes it...

WordPress Slideshow plugin <= 2.3.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Slideshow plugin versions = 2.3.1. Solution Deactivate and delete. This plugin has been closed as of April 11, 2022 and is not available for download. This closure is temporary, pending a full review...