Security Bulletin: IBM Aspera Cargo 4.2.5 and IBM Aspera Connect 4.2.5 have addressed multiple buffer overflow vulnerabilities (CVE-2023-27286, CVE-2023-27284)

Summary This Security Bulletin addresses security vulnerabilities that have been remediated in IBM Aspera Cargo 4.2.5 and IBM Aspera Connect 4.2.5. Vulnerability Details CVEID:CVE-2023-27286 DESCRIPTION: IBM Aspera Cargo and IBM Aspera Connect are vulnerable to a buffer overflow, caused by improp...

PT-2023-21052 · Ibm · Ibm Aspera Connect +1

Name of the Vulnerable Software and Affected Versions: IBM Aspera Cargo version 4.2.5 IBM Aspera Connect version 4.2.5 Description: The issue is caused by improper bounds checking, leading to a buffer overflow. An attacker could exploit this to execute arbitrary code on the system. Recommendation...

WordPress OAuth Server Plugin <= 4.2.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software OAuth Server Type Plugin Vulnerable versions = 4.2.5 Fixed in 4.3.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 98e63ca58462 Credits Unknown Required privilege...

GHSA-FJW4-39PG-VF4F Apache Karaf vulnerable to relative path traversal

Apache Karaf Config service provides a install method via service or MBean that could be used to travel in any directory and overwrite existing file. The vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf version before 4.2.5 is impacted. Use...

Moderate: Red Hat Security Advisory: Red Hat build of Eclipse Vert.x 4.2.5 security update

An update is now available for Red Hat build of Eclipse Vert.x. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more...

CVE-2021-44079

In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially resulting in remote code execution...

Advisory ROSA-SA-2021-1822

Software: dhcp 4.2.5 OS: Cobalt 7.9 CVE-ID: CVE-2013-2494 CVE-Crit: HIGH CVE-DESC: libdns in ISC DHCP 4.2.x through 4.2.5-P1 allows remote name servers to cause a denial of service memory consumption using vectors that include a regular expression, as demonstrated by a memory scarcity attack on a...

Cross site scripting

Cross Site Scripting XSS vulneraiblity in LimeSurvey 4.2.5 on textbox via the Notifications & data feature...

CVE-2020-23710

CVE-2020-23710 is an XSS vulnerability affecting LimeSurvey 4.2.5, exploitable via the textbox in the Notifications & data feature. Public sources in the connected documents confirm the issue but do not provide a confirmed patch version or fixed release. The PT-Security entry notes no information...

LimeSurvey 跨站脚本漏洞

LimeSurvey formerly known as PHPSurveyor is an open source online survey program from the Limesurvey team that supports survey program development, survey posting, and data collection. A cross-site scripting vulnerability exists in LimeSurvey 4.2.5 that originates in the text boxes of the...

PT-2021-10933 · Unknown · Limesurvey

Name of the Vulnerable Software and Affected Versions: LimeSurvey version 4.2.5 Description: The issue is related to a Cross Site Scripting XSS vulnerability. This vulnerability can be exploited via the Notifications & data feature, specifically on a textbox. Recommendations: For LimeSurvey versi...

Atlassian Jira Service Desk < 3.9.16 Path Traversal Vulnerability

According to its self-reported version number, the Atlassian Jira Service Desk application running on the remote host is prior to 3.9.16, 3.10.x prior to 3.16.8, 4.0.x prior to 4.1.3, 4.2.x prior to 4.2.5, 4.3.x prior to 4.3.4 or 4.4.x prior to 4.4.1. It is, therefore, affected by a path traversa...

Design/Logic Flaw

Apache Karaf Config service provides a install method via service or MBean that could be used to travel in any directory and overwrite existing file. The vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf version before 4.2.5 is impacted. Use...

Apache Karaf Arbitrary File Download Vulnerability

Apache Karaf is the United States Apache Apache Foundation for the deployment of applications and components of a lightweight OSGi Java Dynamic Modular System container. A security vulnerability exists in Apache Karaf versions prior to 4.2.5. An attacker could exploit the vulnerability to overwri...

vBulletin 4.2.5 Member Map 1.1.2 Open Redirection

Exploit Title : vBulletin 4.2.5 Member Map 1.1.2 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 04/03/2019 Vendor Homepage : vbulletin.com dragonbyte-tech.com Software Information Link : dragonbyte-tech.com/store/member-map.229/ Software Affect...

vBulletin 4.2.5 Thread Post Bookmarking 1.2.0 Open Redirection

Exploit Title : vBulletin 4.2.5 Thread Post Bookmarking 1.2.0 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 04/03/2019 Vendor Homepages : vbulletin.com dragonbyte-tech.com Software Information Link :...

CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

Doorkeeper is vulnerable to stored XSS and code execution

Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting XSS vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be...

GHSA-HWHH-2FWM-CFGW Doorkeeper is vulnerable to stored XSS and code execution

Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting XSS vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be...

Cross site scripting

IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 13139...