21377 matches found
Security Bulletin: A security vulnerability has been fixed in IBM Security Verify Governance, Identity Manager virtual appliance component (CVE-2022-3676)
Summary IBM Security Verify Governance, Identity Manager virtual appliance component has addressed the following vulnerability. Vulnerability Details CVEID:CVE-2022-3676 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass security restrictions, caused by improper runtime type chec...
WordPress Easy Accordion FAQ and Knowledge Base Software for WordPress Plugin <= 2.7 is vulnerable to Cross Site Scripting (XSS)
Software Easy Accordion FAQ and Knowledge Base Software for WordPress Type Plugin Vulnerable versions = 2.7 Fixed in 2.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID d0f6976b048f...
8Base Ransomware Spikes in Activity, Threatens U.S. and Brazilian Businesses
A ransomware threat called 8Base that has been operating under the radar for over a year has been attributed to a "massive spike in activity" in May and June 2023. "The group utilizes encryption paired with 'name-and-shame' techniques to compel their victims to pay their ransoms," VMware Carbon...
Security Bulletin: Vulnerability in Apache Tomcat affects IBM Process Mining . Multiple CVEs
Summary There is a vulnerability in Apache Tomcat that could allow a remote attacker to bypass security restrictions and obtain sensitive information, The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details...
Security Bulletin: Vulnerability in Spring Security affects IBM Process Mining . Multiple CVEs
Summary There is a vulnerability in Spring Security that could allow a local authenticated attacker launch further attacks on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details...
Arbitrary File Upload
jeecg-boot-base-core is vulnerable to Arbitrary File Upload. The vulnerability exists because the library does not properly validate uploading files, allowing an attacker to upload maliciously crafted files through the /jeecg-boot/jmreport/upload endpoint...
Security Bulletin: IBM Spectrum Control is vulnerable to weakness related to Node.js
Summary Vulnerability in Node.js allow a denial of service, caused by a regular expression may affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2023-24807 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the...
PHPJabbers Knowledge Base Builder 3.0 Cross Site Scripting
┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...
cyfs-cip (>=0.5.0, <=0.6.4) potentially affected by unknown CVE via cyfs-base (>=0.5.5, <=0.6.12)
cyfs-base CARGO version =0.5.5, =0.5.0, =0.6.4 Source cves: unknown CVE Source advisory: OSV:GHSA-G753-GHR7-Q33W...
cyfs-base vulnerable to misaligned pointer dereference in `ChunkId::new`
The function ChunkId::new creates a misaligned pointer by casting mutable pointer of u8 slice which has alignment 1 to the mutable pointer of u32 which has alignment 4, and dereference the misaligned pointer leading UB, which should not be allowed in safe function...
Backstage 代码注入漏洞
Backstage is a software application. Backstage is an open platform for building developer portals. A code injection vulnerability exists in Backstage versions prior to 1.15.0 that originates from allowing an attacker to execute remote code on a backend instance of the base frame folder...
Security Bulletin: IBM Security Verify Governance, Identity Manager virtual appliance component vulnerable to spoofing attacks (CVE-2022-38712)
Summary IBM Security Verify Governance, Identity Manager virtual appliance component has addressed the following vulnerability. Vulnerability Details CVEID:CVE-2022-38712 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to...
CVE-2023-2600
The Custom Base Terms WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2023-2600
The Custom Base Terms WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Cross site scripting
The Custom Base Terms WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2023-2600 Custom Base Terms < 1.0.3 - Admin+ Stored XSS
The Custom Base Terms WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2023-2600
CVE-2023-2600 concerns the WordPress plugin Custom Base Terms prior to version 1.0.3, where certain settings aren’t sanitized or escaped. This can enable stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). The NVD entry assigns CVSS 3.1: AV...
CVE-2023-32208
Service workers could reveal script base URL due to dynamic import. This vulnerability affects Firefox 113...