CLSA-2022-1643637294 Fix CVE(s): CVE-2021-38198

CVE-2021-38198 - ELSCVE-686: KVM: MMU: return page fault error code from permissionfault - ELSCVE-686: kvm: x86: MMU support for EPT accessed/dirty bits - ELSCVE-686: KVM: nVMX: fix EPT permissions as reported in exit qualification - ELSCVE-686: KVM: X86: MMU: Use the correct inherited permission...

GHSA-MRQ4-7CH7-2465 Server Side Twig Template Injection

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds...

Code injection

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds...

CVE-2022-21686

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds...

PT-2022-15037

Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.7.0.0 through 1.7.8.3 Description PrestaShop is an Open Source e-commerce platform. An attacker is able to inject twig code inside the back office when using the legacy layout. Recommendations For versions 1.7.0.0 through...

CVE-2022-21686: Improper Control of Generation of Code

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds...

CVE-2022-0215: Cross-Site Request Forgery (CSRF)

The Login/Signup Popup, Waitlist Woocommerce Back in stock notifier , and Side Cart Woocommerce Ajax WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the savesettings function found in the /includes/xoo-framework/admin/class-xoo-admin-settings.php file which makes it...

PT-2022-13041

Name of the Vulnerable Software and Affected Versions Login/Signup Popup versions = 2.2 Waitlist Woocommerce Back in stock notifier versions = 2.5.1 Side Cart Woocommerce Ajax versions = 2.0 Description The issue affects WordPress plugins, allowing attackers to update arbitrary options on a site,...

What is RAT Remote Access Trojan ❓ Detection and Removal

Introduction Humans live in the 21st century where a large portion of our exchanges are taken care of on the web. Thus, people, businesses and organizations are presented with new online protection dangers. A significant number of these digital dangers will break into your framework and challenge...

Trend Micro Worry-Free Business Security 后置链接漏洞

Trend Micro Worry-Free Business Security is a suite of enterprise-class information security protection solutions from Trend Micro. The product provides anti-spam, anti-virus, network security, and email protection. Trend Micro Worry-Free Business Security suffers from a back-link vulnerability,...

Trend Micro Worry-Free Business Security 后置链接漏洞

Trend Micro Worry-Free Business Security is a suite of enterprise-class information security protection solutions from Trend Micro. The product provides anti-spam, anti-virus, network security, and email protection. Trend Micro Worry-Free Business Security suffers from a back-link vulnerability,...

Netgear RBR750和NETGEAR 命令注入漏洞

Netgear RBR750 and NETGEAR are both products of Netgear, Inc.RBR750 is a home WiFi system.NETGEAR is a router. A hardware device that connects two or more networks and acts as a gateway between networks. A security vulnerability exists in certain NETGEAR devices that stems from the fact that some...

Netgear RBR750和NETGEAR 命令注入漏洞

Netgear RBR750 and NETGEAR are both products of Netgear, Inc.RBR750 is a home WiFi system.NETGEAR is a router. A hardware device that connects two or more networks and acts as a gateway between networks. A security vulnerability exists in certain NETGEAR devices that stems from the fact that...

Netgear NETGEAR 命令注入漏洞

Netgear NETGEAR is a router from the American company Netgear. A hardware device that connects two or more networks and acts as a gateway between networks. A security vulnerability exists in certain NETGEAR devices that stems from the fact that some NETGEAR devices are subject to command back...

sssd bug fix and enhancement update

The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch NSS and the Pluggable Authentication Modules PAM interfaces toward the system, and a pluggable back-end system ...

sssd bug fix and enhancement update

An update is available for sssd. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The System Security Services Daemon SSSD service provides a set of daemons to...

ALBA-2021:5228 sssd bug fix and enhancement update

The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch NSS and the Pluggable Authentication Modules PAM interfaces toward the system, and a pluggable back-end system ...

Improper Authentication

Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngxhttpauthrequestmodule with Authelia, it allows a malicious individual who crafts a malformed HTTP request to bypass the authentication mechanism. It additionally could theoretically affect...

The vulnerability of the BFCache component in Microsoft Edge and Google Chrome browsers allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the BFCache component in Microsoft Edge and Google Chrome is related to overflow errors in dynamic memory buffers. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause service interruptions...

Improper Privilege Management in dotcms/core

Description Hello team, I found a SSTI that allow me to get Full Privilege Escalation system user 1. While editing a template we have total access to the User and UserModel classes via $user 2. One of the UserModel methods is called setUserId 3. If we call setUserId and pass "system" as parameter...