Security Bulletin: CVE-2021-23337

Summary Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. Vulnerability Details CVEID: CVE-2021-23337 DESCRIPTION: Node.js lodash module could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a command...

USN-5479-3 php7.2 regression

USN-5479-1 fixed vulnerabilities in PHP. Unfortunately that update for CVE-2022-31625 was incomplete for Ubuntu 18.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Charles Fol discovered that PHP incorrectly handled initializing certain arrays...

Security Bulletin: IBM WebSphere Application Server Liberty for IBM i is vulnerable to identity spoofing and port status query (CVE-2022-22475 CVE-2022-22393)

Summary IBM WebSphere Application Server Liberty for IBM i is vulnerable to identity spoofing by an authenticated user and the ability to obtain the status of application server ports as described in the vulnerability details section. IBM i has addressed the CVEs by providing fixes to IBM WebSphe...

AIX 7.2 TL 5 : lpd (IJ39876)

https://vulners.com/cve/CVE-2022-22444 https://vulners.com/cve/CVE-2022-22444 IBM AIX could allow a local user to exploit a vulnerability in the lpd daemon to cause a denial of service. C Tenable Network Security, Inc. The text in the description was extracted from AIX Security Advisory...

AIX 7.2 TL 5 : lpd (IJ39878)

https://vulners.com/cve/CVE-2022-22444 https://vulners.com/cve/CVE-2022-22444 IBM AIX could allow a local user to exploit a vulnerability in the lpd daemon to cause a denial of service. C Tenable Network Security, Inc. The text in the description was extracted from AIX Security Advisory...

Cross site scripting

Talend Administration Center is vulnerable to a reflected Cross-Site Scripting XSS issue in the SSO login endpoint. The issue is fixed for versions 8.0.x in TPS-5233, for versions 7.3.x in TPS-5324, and for versions 7.2.x in TPS-5235. Earlier versions of Talend Administration Center may also be...

CVE-2022-31648

Talend Administration Center is vulnerable to a reflected Cross-Site Scripting XSS issue in the SSO login endpoint. The issue is fixed for versions 8.0.x in TPS-5233, for versions 7.3.x in TPS-5324, and for versions 7.2.x in TPS-5235. Earlier versions of Talend Administration Center may also be...

GHSA-6XXC-4JC4-7JV3 Exposure of Resource to Wrong Sphere in Liferay Portal

Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing CORS protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the...

Security Bulletin: Vulnerability in mount affects AIX (CVE-2021-38990)

Summary There is a vulnerability in the mount command that affects AIX. Vulnerability Details CVEID:CVE-2021-38990 DESCRIPTION: IBM AIX could allow a non-privileged local user to exploit a vulnerability in the mount command which could lead to code execution. CVSS Base score: 8.4 CVSS Temporal...

Cross site scripting

xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘edate’ of the resource xhisalarm.htm, which may allow an unauthorized attacker to execute arbitrary code...

CVE-2021-33001

The CVE-2021-33001 entry affects xArrow SCADA, version 7.2 and prior, where cross-site scripting can occur via the bdate parameter in xhisvalue.htm. The incident is documented in multiple sources (NVD entry for CVE-2021-33001 and CISA ICS advisory ICSA-21-229-03) confirming affected product, vuln...

Security Bulletin: AIX is vulnerable to a denial of service due to OpenSSL (CVE-2022-0778)

Summary A vulnerability in OpenSSL could allow a remote attacker to cause a denial of service CVE-2022-0778. OpenSSL is used by AIX as part of AIX's secure network communications. Vulnerability Details CVEID:CVE-2022-0778 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw...

2020.2 IPU – Intel® CSME, SPS, TXE, and AMT Advisory

Summary: Potential security vulnerabilities in Intel® Converged Security and Manageability Engine CSME, Server Platform Services SPS, Intel® Trusted Execution Engine TXE, Intel® Dynamic Application Loader DAL, Intel® Active Management Technology AMT, Intel® Standard Manageability ISM and Intel®...

CVE-2022-22481

The CVE-2022-22481 issue affects IBM Navigator for i (heritage version) on IBM i 7.2, 7.3 and 7.4. A vulnerability in access control allows a remote attacker to access the web interface without valid credentials by modifying the sign-on request, providing visibility into the system’s fully qualif...

IBM Navigator for i 安全漏洞

IBM Navigator for i is an IBM console interface used in IBMi to perform and manage critical tasks in IBMi. IBM Navigator for i versions 7.2, 7.3 and 7.4 are vulnerable to an access control error that stems from a network system or product that does not properly restrict access to resources from...

PT-2022-15461 · Ibm · Ibm Navigator For I

Name of the Vulnerable Software and Affected Versions: IBM Navigator for i versions 7.2 through 7.4 Description: The issue allows a remote attacker to obtain access to the web interface without valid credentials by modifying the sign on request. This grants the attacker visibility to the fully...

CVE-2022-26596

Cross-site scripting XSS vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via we...

CVE-2022-26596

Cross-site scripting XSS vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via we...

Liferay Portal和Liferay DXP 跨站脚本漏洞

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...

CVE-2022-21410

Vulnerability in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any Procedure privilege with network access via Oracle Net to...