WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to SQL Injection

Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-47151 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 3458eadeff2d Credits RE-ALTER Require...

PT-2023-12676 · Suse · Suse Rancher

Name of the Vulnerable Software and Affected Versions: SUSE Rancher versions prior to 2.5.17 SUSE Rancher versions prior to 2.6.10 SUSE Rancher versions prior to 2.7.1 Description: A Missing Authorization vulnerability in SUSE Rancher allows an authenticated user to create an unauthorized shell p...

CVE-2022-0517

Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privileges could leverage this to launch arbitrary code with SYSTEM privilege. This vulnerability affects Mozilla VPN 2.7.1...

PT-2022-25271 · Sauter Controls · Sauter Controls Moduweb

Name of the Vulnerable Software and Affected Versions: SAUTER Controls moduWeb firmware version 2.7.1 Description: The web application does not adequately sanitize request strings of malicious JavaScript, allowing an attacker to execute malicious code in users' browsers and steal sensitive...

HyperSQL DataBase vulnerable to remote code execution when processing untrusted input

Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb HyperSQL DataBase to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can...

UBUNTU-CVE-2022-41853

Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb HyperSQL DataBase to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can...

CVE-2022-41853 Remote code execution in HyperSQL DataBase

Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb HyperSQL DataBase to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can...

sanitize-html 安全漏洞

sanitize-html is an open source library from Apostrophe Technologies. It cleans up user-submitted HTML, keeping whitelisted elements and whitelisted attributes on a per-element basis. A security vulnerability exists in sanitize-html versions prior to 2.7.1, which stems from an insecure global...

PT-2022-17586

Name of the Vulnerable Software and Affected Versions sanitize-html versions prior to 2.7.1 Description The issue is related to Regular Expression Denial of Service ReDoS due to insecure global regular expression replacement logic of HTML comment removal. Recommendations For versions prior to...

WordPress plugin JS Help Desk 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in WordPress plugin JS...

WordPress Plugin JS Help Desk SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

This Week in Spring - June 28th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Im writing this from the Big Apple, New York City! Im here for the SpringOne Tour 2022 NYC event. This is my first time back in New York City since before the pandemic and it has been so much fun. Ive been catching up with...

Use After Free

A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev commit b5f1eacd and Gerbv forked 2.7.1. A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability...

GHSA-5J9F-5WMP-7F8H Jenkins Cadence vManager Plugin disables SSL/TLS and hostname verification

Jenkins Cadence vManager Plugin prior to version 2.7.1 disables SSL/TLS and hostname verification globally for the Jenkins master JVM. This issue is patched in 2.7.1...

Jenkins Cadence vManager Plugin disables SSL/TLS and hostname verification

Jenkins Cadence vManager Plugin prior to version 2.7.1 disables SSL/TLS and hostname verification globally for the Jenkins master JVM. This issue is patched in 2.7.1...

SimpleXML has XML External Entity (XXE) vulnerability

SimpleXML latest version 2.7.1 is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on...

Moodle remote code execution via quiz questions

Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to execute arbitrary code via a calculated question in a quiz...

URL Redirection to Untrusted Site ('Open Redirect') in express-openid-connect

Impact Users of the requiresAuth middleware, either directly or through the default authRequired option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route. If all routes under example.com are protected with the requiresAuth middleware, a visit to...

PT-2022-1721 · Mozilla · Vpn

Name of the Vulnerable Software and Affected Versions: Mozilla VPN versions prior to 2.7.1 Description: The issue is related to Mozilla VPN's ability to load an OpenSSL configuration file from an unsecured directory. This could allow a user or attacker with limited privileges to launch arbitrary...

Null-dereference in Tensorflow

Impact The implementation of GetInitOp is vulnerable to a crash caused by dereferencing a null pointer: cc const auto& initopsigit = metagraphdef.signaturedef.findkSavedModelInitOpSignatureKey; if initopsigit != sigdefmap.end initopname = initopsigit-second.outputs...