WordPress WP Shamsi plugin <= 4.1.1 - Authenticated Plugin Setting change vulnerability

Authenticated Plugin Setting change vulnerability was discovered by Muhammad Daffa Patchstack Alliance in the WordPress WP Shamsi plugin versions = 4.1.1. Solution Update the WordPress WP Shamsi plugin to the latest available version at least 4.2.0...

Mapper SQL注入漏洞

Mapper is a Java persistence framework developed by Liuzh in China. Mapper is a Java persistence framework that maps objects to corresponding records in a database by associating them with stored procedures or SQL statements via XML descriptors or annotations. A SQL injection vulnerability exists...

CVE-2022-27911

An issue was discovered in Joomla! 4.2.0. Multiple Full Path Disclosures because of missing 'JEXEC or die check' caused by the PSR12 changes...

Joomla 4.2.0 < 4.2.1 Joomla 4.2.1 Security and Bug Fix Release (5866-joomla-4-2-1-release)

According to its self-reported version, the instance of Joomla! running on the remote web server is 4.2.0 prior to 4.2.1. It is, therefore, affected by a vulnerability. - An issue was discovered in Joomla! 4.2.0. Multiple Full Path Disclosures because of missing 'JEXEC or die check' caused by the...

PT-2022-23465 · Seiko · Seiko Skybridge Mb-A100/A110

Name of the Vulnerable Software and Affected Versions: Seiko SkyBridge MB-A100/A110 versions 4.2.0 and below Description: A command injection issue was discovered via the ipAddress parameter at the "/07system08execute ping 01" endpoint. This allows for potential command injection attacks...

Seiko Solutions SkyBridge MB-A100/A110 命令注入漏洞

The Seiko Solutions SkyBridge MB-A100/A110 is an LTE-compatible IoT router from Seiko Solutions, Japan. A security vulnerability exists in the Seiko Solutions SkyBridge MB-A100/A110 v4.2.0 and earlier, which stems from the ipAddress parameter being found to contain command injection...

CVE-2022-36414

There is an elevation of privilege breakout vulnerability in the Windows EXE installer in Scooter Beyond Compare 4.2.0 through 4.4.2 before 4.4.3. Affected versions allow a logged-in user to run applications with elevated privileges via the Clipboard Compare tray app after installation...

CVE-2021-3750 affecting package qemu-kvm 4.2.0-39

CVE-2021-3750 affecting package qemu-kvm 4.2.0-39. A patched version of the package is available...

Security Bulletin: IBM Tivoli Network Manager is vulnerable to XML external entity (XEE) attacks due to FasterXML (CVE-2020-25649)

Summary FasterXML Jackson Databind, used by IBM Tioli Network Manager,contains a flaw where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity XXE attacks. The highest threat from this vulnerability is data integrity. The library has been...

Security Bulletin: Due to use of zLib IBM Tivoli Network Manager is vulnerable to denial of service (CVE-2018-25032)

Summary Zlib is vulnerable to a denial of service, caused by a memory corruption in the deflate operation. By persuading a victim to open a specially-crafted file using many distant matches, a remote attacker could exploit this vulnerability to cause the application to crash. Vulnerability Detail...

Security Bulletin:Due to use of Dojo Toolkit before 1.14 in IBM Tivoli Network Manager is vulnerable to unescaped string injection in dojox/Grid/DataGrid(CVE-2018-15494)

Summary In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid. dojox/grid/Builder.js and dojox/grid/cells/base.js, providing the class dojox/Grid/DataGrid, are affected by CVE-2018-15494, an unescaped string injection vulnerability. Vulnerability Details CVEID:...

CVE-2022-29467

Address information disclosure vulnerability in Cybozu Garoon 4.2.0 to 5.5.1 allows a remote authenticated attacker to obtain some data of Address...

Rundeck's Key Storage converter plugin mechanism's encryption layer not working in 4.2.0, 4.2.1, 4.3.0

Impact The Key Storage converter plugin mechanism was not enabled correctly in Rundeck 4.2.0 and 4.2.1, resulting in use of the encryption layer for Key Storage possibly not working. Any credentials created or overwritten using Rundeck 4.2.0 or 4.2.1 might result in them being written in plaintex...

Rundeck plaintext storage vulnerability

Rundeck is an open source automation service with a Web console, command line tools and WebAPI from Rundeck, Inc. that is primarily used to run automation tasks. versions 4.2.0 and 4.2.1 of Rundeck contain a plaintext storage vulnerability that stems from not properly enabling the Key Storage...

CVE-2022-31044

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled correctly in Rundeck 4.2.0 and 4.2.1, resulting in use of the encryption layer for Key Storage possibly not working. Any credentials created...

CVE-2022-31044

The CVE-2022-31044 issue affects Rundeck where the Key Storage converter plugin mechanism was not enabled correctly in versions 4.2.0 and 4.2.1, causing the encryption layer for Key Storage to potentially not work and allowing credentials created or overwritten in these releases to be written in ...

Rundeck 安全漏洞

Rundeck is an open source automation service with a Web console, command line tools and WebAPI from Rundeck, Inc. that is primarily used to run automation tasks. versions 4.2.0 and 4.2.1 of Rundeck contain a plaintext storage vulnerability that stems from not properly enabling the Key Storage...

GHSA-GG42-MWR6-P82C Mattermost Server has intermittent Authorization bypass for resource-owners

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. Resource-owner authorization can be intermittently bypassed, allowing account takeover...

GHSA-WJ5W-QGHH-GVQP Mattermost Server does not neutralize HTML content in an Email template field

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized...

Mattermost Server does not safeguard against phishing via error page links

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows Phishing because an error page can have a link...