BigBlueButton 数据伪造问题漏洞

BigBlueButton is an open source web conferencing system from the BigBlueButton community. A data forgery issue vulnerability exists in BigBlueButton versions prior to 2.4.3, which stems from being bound by insufficient data authenticity validation, resulting in a denial of service...

CVE-2022-41960 BigBlueButton contains DoS via failed authToken validation

BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in Denial of Service. An attacker can make a Meteor call to validateAuthToken using a victim's userId, meetingId, and an invalid authToken. Th...

CVE-2022-41960 BigBlueButton contains DoS via failed authToken validation

BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in Denial of Service. An attacker can make a Meteor call to validateAuthToken using a victim's userId, meetingId, and an invalid authToken. Th...

PYSEC-2022-42984

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's /login endpoint...

Apache Airflow 输入验证错误漏洞

Apache Airflow is an open source platform for creating, managing, and monitoring workflows from the Apache Foundation. The platform features scalable and dynamic monitoring.Apache Airflow versions prior to 2.4.3 are vulnerable to an input validation error that stems from an open redirect in the...

PT-2022-27504 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.4.3 Description: The issue is related to an open redirect in the webserver's "/login" endpoint. This means that an attacker could potentially redirect users to a malicious website after they attempt to log i...

CVE-2022-37298

Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nodes to the Shinken monitoring server...

CVE-2022-37298

Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nodes to the Shinken monitoring server...

PT-2022-23910

Name of the Vulnerable Software and Affected Versions Shinken Monitoring version 2.4.3 Description The issue is related to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nod...

CVE-2022-39238

Arvados is an open source platform for managing and analyzing biomedical big data. In versions prior to 2.4.3, when using Portable Authentication Modules PAM for user authentication, if a user presented valid credentials but the account is disabled or otherwise not allowed to access the host such...

PT-2022-24832 · Arvados · Arvados

Name of the Vulnerable Software and Affected Versions: Arvados versions prior to 2.4.3 Description: The issue affects Arvados, an open source platform for managing and analyzing biomedical big data. When using Portable Authentication Modules PAM for user authentication, if a user presents valid...

CVE-2022-3221

Cross-Site Request Forgery CSRF in GitHub repository ikus060/rdiffweb prior to 2.4.3...

PYSEC-2022-278

Cross-Site Request Forgery CSRF in GitHub repository ikus060/rdiffweb prior to 2.4.3...

io.github.shuigedeng:taotao-cloud-starter-agent (>=2022.09 <=2022.10), io.github.shuigedeng:taotao-cloud-starter-apt (>=2022.09 <=2022.10) +234 more potentially affected by CVE-2022-37435 via org.apache.shenyu:shenyu-common (>=2.4.2 <=2.4.3)

org.apache.shenyu:shenyu-common MAVEN version =2.4.2, =2022.09, =2022.09, =2022.09, =2022.09, =2022.09, =2022.09, =2022.09, =2022.09, =2022.09, =2022.09, =2022.09, =2022.09, =2022.09, =2022.09, =2022.09, =2022.10 and more Source cves: CVE-2022-37435 Source advisory: OSV:GHSA-FJJW-82XW-VFC2https:...

CVE-2022-37435

Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue affects Apache ShenYu 2.4.2 and 2.4.3...

Apache ShenYu 安全漏洞

Apache ShenYu is an asynchronous, high-performance, cross-language, responsive API gateway from the Apache Foundation. A security vulnerability exists in Apache ShenYu Admin versions 2.4.2 and 2.4.3, which stems from an insecure privilege that could allow a low-privileged administrator to change...

PT-2022-23995 · Apache · Apache Shenyu

Name of the Vulnerable Software and Affected Versions: Apache ShenYu versions 2.4.2 through 2.4.3 Description: The issue is related to insecure permissions in Apache ShenYu Admin, which may allow low-privilege administrators to modify high-privilege administrator's passwords. Recommendations: For...

GHSA-RG7P-WMGJ-F374 Magento stored Cross-Site Scripting (XSS) vulnerability

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s...

CVE-2022-34256 Adobe Commerce Improper Authorization Privilege escalation

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does no...

CVE-2022-34258

Adobe Commerce and Magento Open Source are affected by a stored XSS vulnerability in versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier, and 2.4.4 and earlier. The issue can be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields, with malicious Jav...