CVE-2022-27634: Improper Input Validation

On 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, BIG-IP APM does not properly validate configurations, allowing an authenticated attacker with high privileges to manipulate the APM policy leading to privilege escalation/remote code execution. Note: Software versions whi...

PHP Object Injection Vulnerability in Booking Calendar Plugin

On April 18, 2022, the Wordfence Threat Intelligence team initiated the responsible disclosure process for an Object Injection vulnerability in the Booking Calendar plugin for WordPress, which has over 60,000 installations. We received a response the same day and sent over our full disclosure ear...

PT-2022-9186

Name of the Vulnerable Software and Affected Versions IBM Cognos Analytics PowerPlay versions 11.1.7 through 11.2.0 Description The issue allows a malicious authenticated user to potentially launch an XML Bomb attack. Recommendations For versions 11.1.7 through 11.2.0, update to a version that is...

CVE-2022-24851: Improper Neutralization of Input During Web Page Generation

LDAP Account Manager LAM is an open source web frontend for managing entries stored in an LDAP directory. The profile editor tool has an edit profile functionality, the parameters on this page are not properly sanitized and hence leads to stored XSS attacks. An authenticated user can store XSS...

CVE-2022-22565: Improper Authorization of Index Containing Sensitive Information

Dell PowerScale OneFS, versions 9.0.0-9.3.0, contain an improper authorization of index containing sensitive information. An authenticated and privileged user could potentially exploit this vulnerability, leading to disclosure or modification of sensitive data...

CVE-2022-26413: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30ABFX.5C0 could allow a local authenticated attacker to execute arbitrary OS commands on a vulnerable device via a LAN interface...

CVE-2021-41026

CVE-2021-41026 affects Fortinet FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15. A relative path traversal in the FortiWeb API controller could allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests. The connected doc...

CVE-2022-26251: Improper Privilege Management

The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges...

CVE-2022-26250: Incorrect Permission Assignment for Critical Resource

Synaman v5.1 and below was discovered to contain weak file permissions which allows authenticated attackers to escalate privileges...

CVE-2022-22410: Undefined Security Weakness

IBM Watson Query with Cloud Pak for Data as a Service could allow an authenticated user to obtain sensitive information that would allow them to examine or alter system configurations or data sources connected to the service. IBM X-Force ID: 222763...

CVE-2020-29013: Improper Input Validation

An improper input validation vulnerability in the sniffer interface of FortiSandbox before 3.2.2 may allow an authenticated attacker to silently halt the sniffer via specifically crafted requests...

CVE-2021-25048: Improper Neutralization of Input During Web Page Generation

The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creating profile, allowing any authenticated users to create arbitrary ones, with Cross-Site Scripting payloads in them...

WordPress Uleak Security Dashboard 1.2.3 Cross Site Scripting

Exploit Title: WordPress Plugin uleak-security-dashboard 1.2.3 - Stored Cross-Site Scripting Authenticated Date: 31-03-2022 Exploit Author: Hassan Khan Yusufzai - Splint3r7 Vendor Homepage: https://wordpress.org/plugins/uleak-security-dashboard/ Version: 1.2.3 Tested on: Firefox Contact me: h at...

CVE-2021-25064: Improper Neutralization of Special Elements used in an SQL Command

The Wow Countdowns WordPress plugin through 3.1.2 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection...

CVE-2021-43970

An arbitrary file upload vulnerability exists in albumimages.jsp in Quicklert for Digium 10.0.0 1043 via a .mp3;.jsp filename for a file that begins with audio data bytes. It allows an authenticated low privileged attacker to execute remote code on the target server within the context of...

VulnCheck KEV: CVE-2017-6740

The Simple Network Management Protocol SNMP subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload...

Fortinet FortiWLM 路径遍历漏洞

Fortinet FortiWLC is a wireless LAN controller from Fortinet, Inc. A path traversal vulnerability exists in Fortinet FortiWLC, which can be exploited by an authenticated attacker to retrieve arbitrary files from the underlying file system via a specially crafted Web request...

MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16207.

...

CVE-2021-40841: Improper Limitation of a Pathname to a Restricted Directory

A Path Traversal vulnerability for a log file in LiveConfig 2.12.2 allows authenticated attackers to read files on the underlying server...

PT-2022-11315

Name of the Vulnerable Software and Affected Versions LiveConfig version 2.12.2 Description A Path Traversal issue in the log file of LiveConfig allows authenticated attackers to read files on the underlying server. Recommendations For LiveConfig version 2.12.2, consider restricting access to the...