[ASA-202204-2] polkit: multiple issues

Arch Linux Security Advisory ASA-202204-2 ========================================= Severity: High Date : 2022-04-04 CVE-ID : CVE-2021-4034 CVE-2021-4115 Package : polkit Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-2654 Summary ======= The package polkit before...

montinorte.com.br Cross Site Scripting vulnerability OBB-2463230

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Security Bulletin: IBM QRadar Network Packet Capture is using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. The product has addressed these issues. Vulnerability Details CVEID: CVE-2021-42574 DESCRIPTION: Unicode could allow a remote attacker to execute arbitrary code ...

SUSE: Security Advisory (SUSE-SU-2022:1025-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:1027-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update Java 8.0 to Service Refresh 7 Fix Pack 5 bsc1197126. Including fixes for the following vulnerabilities: CVE-2022-21366, CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21277,...

5 Stars Rating Funnel < 1.2.53 - Unauthenticated SQLi

Description The plugin does not properly sanitise, validate and escape lead ids before using them in a SQL statement via the rrtnggdeleteleads AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue. There is an attempt to sanitise the input, using...

CVE-2021-44209

OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO...

Cross site scripting

OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO...

CVE-2021-44209

OX App Suite up to version 7.10.5 contains a Cross-Site Scripting (XSS) vulnerability that can be triggered via an HTML5 AUDIO element. The issue affects the frontend of OX App Suite (notably the 7.10.5 release and earlier) and is tied to insufficient escaping within the user-facing components (e...

CVE-2021-44209

OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO...

[SECURITY] Fedora 36 Update: enchant2-2.3.2-5.fc36

A library that wraps other spell checking backends...

[SECURITY] Fedora 36 Update: eigen3-3.4.0-5.fc36

A lightweight C++ template library for vector and matrix math...

QNAP QTS Privilege Escalation Vulnerability (QSA-22-05)

QNAP QTS is prone to a local privilege escalation vulnerability, also known as dirty pipe. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE ...

CVE-2022-24751 Race condition in Zulip

Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account deactivation, where a simultaneous access by the user being deactivated may, in rare cases, allow continued access by the deactivated user. A...

Security update for MozillaFirefox (important)

openSUSE Security Update: Security update for MozillaFirefox Announcement ID: openSUSE-SU-2022:0821-1 Rating: important References: 1196900 Cross-References: CVE-2022-26381 CVE-2022-26383 CVE-2022-26384 CVE-2022-26386 CVE-2022-26387 Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 An upda...

3 Reasons to Join Rapid7’s Cloud Security Summit

The world of the cloud never stops moving — so neither can cloud security. In the face of rapidly evolving technology and a constantly changing threat landscape, keeping up with all the latest developments, trends, and best practices in this emerging practice is more vital than ever. Enter Rapid7...

CVE-2022-26661

An XXE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform Command Line Client proteus 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user...

skylinecollege.edu Cross Site Scripting vulnerability OBB-2409569

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

blind-vej.de Improper Access Control vulnerability OBB-2409488

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

3-5-system.de Improper Access Control vulnerability OBB-2406574

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...