CVE-2024-22308

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.4.1...

CVE-2024-22308 WordPress Simple Membership Plugin <= 4.4.1 is vulnerable to Open Redirection

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.4.1...

Joomla! 1.6.x < 4.4.1 Information Disclosure

According to its self-reported version, the instance of Joomla! running on the remote web server is 1.6.x prior to 4.4.1 or 5.x prior to 5.0.1. It is, therefore, affected by an information disclosure vulnerability. The language file parsing process could be manipulated to expose environment...

Joomla 5.0.0 < 5.0.1 / 1.6.x < 4.4.1 Joomla 5.0.1 and 4.4.1 Security and Bug Fix Release (5901-joomla-5-0-1-and-4-4-1-security-and-bug-fix-release)

According to its self-reported version, the instance of Joomla! running on the remote web server is 5.0.0 prior to 5.0.1 or 1.6.x prior to 4.4.1. It is, therefore, affected by a vulnerability. - The language file parsing process could be manipulated to expose environment variables. Environment...

Remote code execution

NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679...

NextGen Mirth Connect Security Breach

NextGen Mirth Connect is a healthcare integration engine from NextGen USA. A security vulnerability exists in versions of NextGen Mirth Connect prior to 4.4.1 that stems from vulnerability to unauthenticated remote code execution attacks...

Security feature bypass

Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator key used by the Dashboard using the browser development tools. This allows a logged user to the dashboard to become administrator of the AP...

CVE-2023-42455 Wazuh vulnerable to user privilege escalation

Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator key used by the Dashboard using the browser development tools. This allows a logged user to the dashboard to become administrator of the AP...

CVE-2023-42455 Wazuh vulnerable to user privilege escalation

Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator key used by the Dashboard using the browser development tools. This allows a logged user to the dashboard to become administrator of the AP...

Wazuh Security Breach

Wazuh is a Wazuh open source application. It is used to collect, aggregate, index and analyze security data to help organizations detect intrusions, threats and behavioral anomalies. A security vulnerability exists in Wazuh versions 4.4.0 and 4.4.1 that stems from the ability to obtain a Wazuh AP...

HikaShop Joomla Component SQL Injection Vulnerability

HikaShop Joomla Component is an e-commerce component from the Hikari team for use in the Joomla content management system. A security vulnerability exists in HikaShop Joomla Component versions 4.4.1 through 4.7.2, which stems from improper neutralization of a special element, resulting in SQL...

WordPress APIExperts Square for WooCommerce Plugin <= 4.4.1 is vulnerable to Broken Access Control

Software APIExperts Square for WooCommerce Type Plugin Vulnerable versions = 4.4.1 Fixed in 4.4.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-47182 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID ee1431b9383c Credits Cat Require...

HikaShop Joomla Plugin, , SQL Injection

anyone with access to the order management in the backend of HikaShop to be able to use a MySQL injection to extract data from the database. "payment methods" restriction setting to custom fields of the "order" table in HikaShop 4.4.1, so prior versions of HikaShop are not impacted...

WordPress WP BrowserUpdate Plugin <= 4.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP BrowserUpdate Type Plugin Vulnerable versions = 4.4.1 Fixed in 4.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-31078 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ca8233546f51 Credits qilin99 Required...

IBM Aspera Faspex Cross-Site Scripting Vulnerability

IBM Aspera is an IBM FASP protocol-based fast file transfer and streaming solution from International Business Machines IBM. IBM Aspera Faspex version 4.4.1 contains a cross-site scripting vulnerability, which stems from a cross-site scripting vulnerability that could be exploited by an attacker ...

CVE-2023-22868

CVE-2023-22868 affects IBM Aspera Faspex 4.4.1 with a cross-site scripting (XSS) vulnerability in the Web UI that could allow embedding arbitrary JavaScript and potentially disclose credentials in a trusted session. The issue is addressed in IBM Faspex 4.4.2 PL2; remediation is to upgrade to 4.4....

IBM Aspera Faspex 跨站脚本漏洞

IBM Aspera is an IBM FASP protocol-based fast file transfer and streaming solution from International Business Machines IBM. IBM Aspera Faspex version 4.4.1 contains a cross-site scripting vulnerability, which stems from a cross-site scripting vulnerability that could be exploited by an attacker ...

CVE-2022-47986

IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. T...

SUSE CVE-2022-27418

Tcpreplay v4.4.1 has a heap-based buffer overflow in dochecksummath at /tcpedit/checksum.c...

Apache Karaf vulnerable to potential code injection

This vulnerability is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtilsdoCreateDatasource uses InitialContext.lookupjndiName without filtering. A...