Advanced Custom Fields < 5.12.1 - Contributor+ Database Information Access

The plugin does not have proper authorisation which could allow users with a role as low as contributor to view information on the database without the access permission...

Advanced Page Visit Counter < 6.1.6 - Subscriber+ Blind SQL injection

The plugin does not escape the artID parameter before using it in a SQL statement in the apvcresetcountart AJAX action, available to any authenticated user, leading to a SQL injection v = 5.0.8 - https://example.com/wp-admin/admin-ajax.php?action=apvcresetcountart&artID=sleep10 v 6.1.6 -...

WordPress Advanced Page Visit Counter <= 6.1.5 - Blind SQL Injection (SQLi) vulnerability

Blind SQL Injection SQLi vulnerability discovered by Krzysztof Zając in WordPress Advanced Page Visit Counter versions = 6.1.5. Solution Update the WordPress Advanced Page Visit Counter – Most Advanced WordPress Visit Counter Plugin to the latest available version at least 6.1.6...

Moderate: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.3.8 security and container updates

Red Hat Advanced Cluster Management for Kubernetes 2.3.8 General Availability release images, which provide security and container updates. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a...

CVE-2022-24426

Dell Command | Update, Dell Update, and Alienware Update version 4.4.0 contains a Local Privilege Escalation Vulnerability in the Advanced Driver Restore component. A local malicious user could potentially exploit this vulnerability, leading to privilege escalation...

CVE-2022-1030

Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a valid target host where the user has access, can execute...

CVE-2022-1030

Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a valid target host where the user has access, can execute...

Command injection

Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a valid target host where the user has access, can execute...

CVE-2022-1030

The CVE-2022-1030 entry concerns Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0, which is vulnerable to command injection via a specially crafted URL. The root cause is a URL-based command injection that lets an attacker, who knows a valid team name for the victim ...

Okta Advanced Server Access Client 操作系统命令注入漏洞

Okta Advanced Server Access Client is a zero-trust identity and access management for cloud and local infrastructures from Okta USA. An operating system command injection vulnerability exists in Okta Advanced Server Access Client versions prior to 1.58.0 on Linux and macOS, which could allow an...

Facebook users wary of security mail find themselves locked out of accounts

It’s not unusual for sites and services to offer additional forms of protection on top of regular security features. Some of the bigger ones even go the extra mile, protecting from attacks up to a potential nation state level. The most famous example of this recently is likely Google. Its Advance...

Security Bulletin: IBM Transformation Extender Advanced is vulnerable to LDAP injection due to WebSphere Application Server Liberty (CVE-2021-39031)

Summary IBM Transformation Extender Advanced, previously known as IBM Standards Processing Engine, uses IBM WebSphere Application Server Liberty. An LDAP injection vulnerability in IBM WebSphere Application Server Liberty has been addressed. Vulnerability Details CVEID: CVE-2021-39031 DESCRIPTION...

Security Bulletin: IBM Transformation Extender Advanced is vulnerable to information exposure due to IBM WebSphere Application Server Liberty (CVE-2022-22310)

Summary IBM Transformation Extender Advanced, previously known as IBM Standards Processing Engine, uses IBM WebSphere Application Server Liberty. An information exposure in IBM WebSphere Application Server Liberty has been addressed. Vulnerability Details CVEID: CVE-2022-22310 DESCRIPTION: IBM...

Security Bulletin: IBM Transformation Extender Advanced is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-4104)

Summary IBM Transformation Extender Advanced, previously known as IBM Standards Processing Engine, uses Apache Log4j as part of its logging infrastructure. An arbitrary remote code execution vulnerability has been addressed. The fix incudes Apache Log4j 2.17.1. Vulnerability Details CVEID:...

Security Bulletin: IBM Transformation Extender Advanced is vulnerable to information exposure due to IBM WebSphere Application Server Liberty (CVE-2021-29842)

Summary IBM Transformation Extender Advanced, previously known as IBM Standards Processing Engine, uses IBM WebSphere Application Server Liberty. An information exposure in IBM WebSphere Application Server Liberty has been addressed. Vulnerability Details CVEID: CVE-2021-29842 DESCRIPTION: IBM...

CVE-2022-0694

The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abcbookinggetSingleCalendar AJAX action available to both unauthenticated and authenticated users, leading to an unauthenticated SQL injection...

CVE-2022-0694

The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abcbookinggetSingleCalendar AJAX action available to both unauthenticated and authenticated users, leading to an unauthenticated SQL injection...

Sql injection

The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abcbookinggetSingleCalendar AJAX action available to both unauthenticated and authenticated users, leading to an unauthenticated SQL injection...

CVE-2022-0694

The CVE-2022-0694 entry concerns the WordPress plugin Advanced Booking Calendar before v1.7.0. The vulnerability is an unauthenticated SQL injection arising because abc_booking_getSingleCalendar does not validate or escape the calendar parameter before using it in a SQL statement, and the AJAX ac...

CVE-2022-0694 Advanced Booking Calendar < 1.7.0 - Unauthenticated SQL Injection

The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abcbookinggetSingleCalendar AJAX action available to both unauthenticated and authenticated users, leading to an unauthenticated SQL injection...