CVE-2022-29236

BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker can circumvent access restrictions for drawing on the whiteboard. The permission check is inadvertently skipped on the server, due to a previously introduced gra...

RHEL 6 / 7 / 8 : Satellite Tools 6.10.5 Async Bug Fix Update (Important) (RHSA-2022:4866)

The remote Redhat Enterprise Linux 6 / 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:4866 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the...

CVE-2022-29236 Improper access control for pencil annotations in BigBlueButton

BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker can circumvent access restrictions for drawing on the whiteboard. The permission check is inadvertently skipped on the server, due to a previously introduced gra...

SUSE: Security Advisory (SUSE-SU-2022:1832-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Shopware database password is leaked to an unauthenticated users

In Shopware 6 before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled. This vulnerability does not affect the shopware 5 release branch shopware/shopware on packagist...

GHSA-65P8-5423-FW3X Pimcore XSS Vulnerability

Pimcore 6prior to 6.3.0 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles certain HTML elements...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2022-9422)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9422 advisory. 4.1.12-124.62.3.1 - debug: Lock down kgdb Stephen Brennan Orabug: 34152701 CVE-2022-21499 Tenable has extracted the preceding description block directly fro...

SUSE: Security Advisory (SUSE-SU-2022:1818-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 6 : log4j (ELSA-2022-9419)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9419 advisory. - Fix CVE-2022-23302, CVE-2022-23305, CVE-2022-23307, CVE-2017-5645 Tenable has extracted the preceding description block directly from the Oracle Linu...

CVE-2017-16114

The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds...

SUSE: Security Advisory (SUSE-SU-2022:1750-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Tenda AX12 Buffer Overflow Vulnerability (CNVD-2022-42152)

Tenda AX12 is a dual-band Gigabit Wifi 6 wireless router from Tenda China.The Tenda AX12 is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to cause a stack overflow...

Tenda TX9 Pro Buffer Overflow Vulnerability

Tenda TX9 Pro is a dual-band Wi-Fi 6 router from Tenda China.Tenda TX9 Pro is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to cause a buffer overflow...

SUSE: Security Advisory (SUSE-SU-2022:1728-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-PJMX-4GC6-HWV8 Drupal cross-site scripting vulnerability via actions feature and trigger module

Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.18 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via 1 an action description, 2 an action message, 3 a node, or 4 a taxonomy term, related to the actions feature and the...

GHSA-H7JC-PG2R-MQJ4 Tiki Wiki CMS Groupware Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Tiki Wiki CMS Groupware Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Drupal Open Redirect

Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging 1 custom code or 2 a form shown on a 404 error page, related to path manipulation...

GHSA-GXWX-C7M8-F95H Drupal Open redirect vulnerability in the drupal_goto function

Open redirect vulnerability in the drupalgoto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a double-encoded URL in the "destination" parameter...

Drupal arbitrary code execution

Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation...