May 19, 2022—KB5015020 (OS Builds 19042.1708, 19043.1708, and 19044.1708) Out-of-band

None None...

CVE-2022-29518

Screen Creator Advance2, HMI GC-A2 series, and Real time remote monitoring and control tool Screen Creator Advance2 versions prior to Ver.0.1.1.3 Build01, HMI GC-A2 seriesGC-A22W-CW, GC-A24W-CW, GC-A26W-CW, GC-A24, GC-A24-M, GC-A25, GC-A26, and GC-A26-J2, and Real time remote monitoring and contr...

Gmail-linked Facebook accounts vulnerable to attack using a chain of bugs—now fixed

A security researcher has disclosed how he chained together multiple bugs in order to take over Facebook accounts that were linked to a Gmail account. Youssef Sammouda states it was possible to target all Facebook users but that it was more complicated to develop an exploit, and using Gmail was...

new packages: gnome-online-accounts

An update is available for gnome-online-accounts. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the...

GHSA-F68M-Q26R-64F6 Chef Improper Access Control vulnerability

chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI...

Chef Improper Access Control vulnerability

chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI...

Cloudera HUE Account Enumeration

Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete...

admidio CSRF Vulnerability

admidio 3.2.8 has CSRF in admprogram/modules/members/membersfunction.php with an impact of deleting arbitrary user accounts...

GHSA-C4V8-2HG8-JV77 admidio CSRF Vulnerability

admidio 3.2.8 has CSRF in admprogram/modules/members/membersfunction.php with an impact of deleting arbitrary user accounts...

Cross-Site Request Forgery (CSRF)

admidio 3.2.8 has CSRF in admprogram/modules/members/membersfunction.php with an impact of deleting arbitrary user accounts...

GHSA-3857-XM38-JMQ2 Incorrect Authorization in Jenkins Core

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service unable to login by editing the "full name."...

Shopware XSS Vulnerability

Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the...

GHSA-MVRX-CMQW-2JGJ Shopware XSS Vulnerability

Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the...

Gleez CMS CSRF Allows Adding of Administrator Accounts

There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add...

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

Jenkins 2.73.1 and earlier, 2.83 and earlier provides information about Jenkins user accounts which is generally available to anyone with Overall/Read permissions via the /user/username/api remote API. This included e.g. Jenkins users' email addresses if the Mailer Plugin is installed. The remote...

Improper Input Validation in Jenkins

Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional...

Security Bulletin: Information Disclosure in IBM Spectrum Protect Operations Center Browser's History (CVE-2022-22484)

Summary IBM Spectrum Protect Operations Center may disclose sensitive information in plain text in the brower's application command history. Vulnerability Details CVEID:CVE-2022-22484 DESCRIPTION: IBM Spectrum Protect Operations Center could allow a local attacker to obtain sensitive information,...

Improper Input Validation in libpam4j

It was found that libpam4j prior to 1.10 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information...

Emails were sent to addresses not associated with actual users of Jenkins by Email Extension Plugin

jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dynamically created list of users based on the changelogs, like authors of SCM changes since the last successful build. This could in some cases result in emai...

GHSA-C8QR-VFJF-62Q3 Emails were sent to addresses not associated with actual users of Jenkins by Email Extension Plugin

jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dynamically created list of users based on the changelogs, like authors of SCM changes since the last successful build. This could in some cases result in emai...