CVE-2022-34258 Adobe Commerce Stored XSS Arbitrary code execution

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

PT-2022-4402 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.3-p2 and earlier Adobe Commerce versions 2.3.7-p3 and earlier Adobe Commerce versions 2.4.4 and earlier Description: The issue is related to an Improper Access Control that could result in a Security feature bypass...

PT-2022-7069 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.3-p2 through 2.4.4 Adobe Commerce versions 2.3.7-p3 and earlier Description: The issue is related to an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could levera...

WordPress plugin User Meta 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions of WordPress User Meta plugin prior to 2.4.3, which ste...

Code injection

In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matchesconditionData.getParamValue, realData to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource...

CVE-2022-26650 Apache ShenYu (incubating) Regular expression denial of service

In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matchesconditionData.getParamValue, realData to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource...

PT-2022-17983 · Apache · Apache Shenyu

Name of the Vulnerable Software and Affected Versions: Apache ShenYu incubating versions 2.4.0 through 2.4.2 Description: The issue arises from the use of Pattern.matches in RegexPredicateJudge.java, where both parameters are controllable by the user. This allows an attacker to pass in malicious...

SQL Injection

Overview katello is a package that adds Content and Subscription Management to Foreman Affected versions of this package are vulnerable to SQL Injection in the scopedsearch function in app/controllers/katello/api/v2/apicontroller.rb, exploitable via the sortby and sortorder parameters. Remediatio...

GHSA-XPHJ-M9CC-8FMQ Deserialization of Untrusted Data in Groovy

When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized...

WordPress User Meta plugin <= 2.4.2 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Niraj Mahajan in WordPress User Meta plugin versions = 2.4.2. Solution Update the WordPress User Meta plugin to the latest available version at least 2.4.3...

Moderate: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.3 security updates and bug fixes

Red Hat Advanced Cluster Management for Kubernetes 2.4.3 General Availability release images. This update provides security fixes, bug fixes, and updates the container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring...

CVE-2022-22824 affecting package expat for versions less than 2.4.3-1

CVE-2022-22824 affecting package expat for versions less than 2.4.3-1. An upgraded version of the package is available that resolves this issue...

CVE-2022-22822 affecting package expat for versions less than 2.4.3-1

CVE-2022-22822 affecting package expat for versions less than 2.4.3-1. An upgraded version of the package is available that resolves this issue...

CVE-2022-22827 affecting package expat for versions less than 2.4.3-1

CVE-2022-22827 affecting package expat for versions less than 2.4.3-1. An upgraded version of the package is available that resolves this issue...

CVE-2022-22825 affecting package expat for versions less than 2.4.3-1

CVE-2022-22825 affecting package expat for versions less than 2.4.3-1. An upgraded version of the package is available that resolves this issue...

CVE-2021-45960 affecting package expat for versions less than 2.4.3-1

CVE-2021-45960 affecting package expat for versions less than 2.4.3-1. An upgraded version of the package is available that resolves this issue...

CVE-2022-22826 affecting package expat for versions less than 2.4.3-1

CVE-2022-22826 affecting package expat for versions less than 2.4.3-1. An upgraded version of the package is available that resolves this issue...

WordPress myCred plugin <= 2.4.3 - Import/Export to Email Address Disclosure vulnerability

Import/Export to Email Address Disclosure vulnerability discovered by David Hamann in WordPress myCred plugin versions = 2.4.3. Solution Update the WordPress myCred plugin to the latest available version at least 2.4.4...

CVE-2022-0600

The Conference Scheduler WordPress plugin before 2.4.3 does not sanitize and escape the tab parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting...

WordPress Conference Scheduler plugin <= 2.4.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Conference Scheduler plugin versions = 2.4.2. Solution Update the WordPress Conference Scheduler plugin to the latest available version at least 2.4.3...