CVE-2023-50380 Apache Ambari: authenticated users could perform XXE to read arbitrary files on the server

XML External Entity injection in apache ambari versions = 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details: Oozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege escalation from low-privilege users. The...

CVE-2023-50379 Apache Ambari: authenticated users could perform command injection to perform RCE

Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue. Impact: A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster main host...

PT-2024-4520 · Apache · Apache Ambari

Name of the Vulnerable Software and Affected Versions: Apache Ambari versions = 2.7.7 Description: The issue is related to an XML External Entity XXE injection attack in the Oozie Workflow Scheduler component of Apache Ambari. This vulnerability is caused by a lack of proper user input validation...

WordPress Schema Pro Plugin <= 2.7.8 is vulnerable to Broken Access Control

Software Schema Pro Type Plugin Vulnerable versions = 2.7.8 Fixed in 2.7.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-36683 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 77fd92d9030a Credits Rafie Muhammad Patchstack Required...

WordPress Schema Pro Plugin <= 2.7.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Schema Pro Type Plugin Vulnerable versions = 2.7.7 Fixed in 2.7.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-36682 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 68a7467abf6d Credits Rafie Muhammad Patchstac...

ruby:2.7 security, bug fix, and enhancement update

ruby 2.7.8-139 - Upgrade to Ruby 2.7.8. Resolves: rhbz2149262 - Fix HTTP response splitting in CGI. Resolves: CVE-2021-33621 - Fix ReDoS vulnerability in URI. Resolves: CVE-2023-28755 - Fix ReDoS vulnerability in Time. Resolves: CVE-2023-28756 rubygem-abrt 0.4.0-1 - Update to abrt 0.4.0. Resolves...

WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.7 is vulnerable to Insecure Direct Object References (IDOR)

Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.7.7 Fixed in 2.7.8 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-23679 Patch priority Low CVSS severity Low 4.6 Developer Claim ownership PSID...

K000134945: Spring Boot vulnerability CVE-2022-46166

Security Advisory Description Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers e.g. Teams-Notifier and write access to environment variables via UI are affected. User...

CVE-2022-39214 Authenticated users of Combodo iTop can take over any account

Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, a user who can log in on iTop is able to take over any account just by knowing the account's username. This issue is fixed in versions 2.7.8 and 3.0.2-1...

Combodo iTop 安全特征问题漏洞

Combodo iTop is a French company Combodo ITIL-based development and for the daily operation of the IT environment of open source Web applications. The program provides incident management, configuration management and problem management. A security signature issue vulnerability exists in Combodo...

PT-2023-13713 · Comodo +1 · Combodo Itop +1

Name of the Vulnerable Software and Affected Versions: Combodo iTop versions prior to 2.7.8 Combodo iTop versions prior to 3.0.2-1 Description: Combodo iTop is an open source, web-based IT service management platform. The reset password token is generated without any randomness parameter, which m...

WordPress Plugin BuddyForms 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress BuddyForms Plugin <= 2.7.7 is vulnerable to PHP Object Injection

Software BuddyForms Type Plugin Vulnerable versions = 2.7.7 Fixed in 2.7.8 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE N/A Patch priority High CVSS severity High 5.4 Developer Claim ownership PSID 2e9e362a10ab Credits WordFence Required privilege Subscriber Published 21...

WordPress Affiliates Manager Plugin < 2.7.8 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpaffiliatemanager:affiliatesmanager"; ifdescription...

This Week in Spring - SpringOne Essentials 2023 edition - January 24th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! Today is a very day for you see, today we kick off SpringOne Essentials, the online incarnation of SpringOne, online. Well see you live, on stream, in just a few hours!. SpringOne Essentials is going to be amazing, but before...

This Week in Spring - SpringOne Essentials 2023 edition - January 24th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! Today is a very day for you see, today we kick off SpringOne Essentials, the online incarnation of SpringOne, online. We'll see you live, on stream, in just a few hours!. SpringOne Essentials is going to be amazing, but befor...

CVE-2022-46166

The CVE affects Spring Boot Admins with Spring Boot Admin Server where Notifiers (e.g., Teams-Notifier) are enabled and users have write access to environment variables via the UI. The root cause involves potential code execution via the /env actuator endpoint, enabling an attacker to inject or e...

spring-boot-admin 代码注入漏洞

spring-boot-admin is an open source based on Spring boot Mybatis backend management system , with user management , menu management and role management 3 functions , permission control to the button level . A code injection vulnerability exists in spring-boot-admin versions prior to 2.6.10 and...

WordPress Welcart eCommerce plugin <= 2.7.7 - Unauth. Directory Traversal vulnerability

Unauth. Directory Traversal vulnerability discovered by Tien Nguyen Anh Patchstack Alliance in the WordPress Welcart e-Commerce plugin versions = 2.7.6. Solution Update the WordPress Welcart e-Commerce plugin to the latest available version at least 2.7.8...

CVE-2022-24693

Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote attackers to authenticate via ssh. The credentials are stored in the firmware, encrypted by the crypt function...