Catalyst Connect Zoho CRM Client Portal < 2.1.0 - Reflected XSS

The plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin. Make a logged-in admin a page with the code below: Note: Make sure in Client Portal the company...

Vulnerabilities fixed in IBM Aspera Connect and Aspera Cargo

IBM has fixed vulnerabilities in Aspera Connect and Aspera Cargo. A malicious party could exploit the vulnerabilities to access gain access to login credentials, or to be able to execute arbitrary code execute with application privileges. IBM has released updates to fix the vulnerabilities in...

Catalyst Connect Zoho CRM Client Portal < 2.1.0 - Reflected XSS

The plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin. PoC Make a logged-in admin a page with the code below: Note: Make sure in Client Portal the compan...

WordPress Catalyst Connect Zoho CRM Client Portal Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Catalyst Connect Zoho CRM Client Portal Type Plugin Vulnerable versions = 2.0.0 Fixed in 2.1.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0588 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 2843a5139fb1 Credit...

CVE-2023-27285

CVE-2023-27285 affects IBM Aspera Connect and IBM Aspera Cargo at versions up to 4.2.5, with a buffer overflow caused by improper bounds checking. The impact is potential arbitrary code execution on the target system. The vulnerability is addressed by IBM’s remediation: upgrading to version 4.2.6...

CVE-2023-22862

CVE-2023-22862 affects IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5, where authentication credentials are transmitted using an insecure method that can lead to unauthorized interception and retrieval. The IBM Security Bulletin (B3AE4522A366582F82BAA72D23E6FD29726FC63DA16335263B492D5C25D88B...

IBM Aspera 缓冲区错误漏洞

IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM. A buffer overflow vulnerability exists in IBM Aspera Connect and IBM Aspera Cargo, which originates from a boundary check error and can be exploited by an...

PT-2023-18736 · Ibm · Ibm Aspera Connect +1

Name of the Vulnerable Software and Affected Versions: IBM Aspera Connect version 4.2.5 IBM Aspera Cargo version 4.2.5 Description: The issue concerns the transmission of authentication credentials using an insecure method, making them susceptible to unauthorized interception and/or retrieval...

PT-2023-21051 · Ibm · Ibm Aspera Connect +1

Name of the Vulnerable Software and Affected Versions: IBM Aspera Connect version 4.2.5 IBM Aspera Cargo version 4.2.5 Description: The issue is caused by improper bounds checking, leading to a buffer overflow. An attacker could overflow a buffer and execute arbitrary code on the system...

IBM Aspera 安全漏洞

IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM. An information disclosure vulnerability exists in IBM Aspera Cargo and IBM Aspera Connect, which can be exploited by attackers to cause unauthorized...

connectjournals.com Cross Site Scripting vulnerability OBB-3374432

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that run designer flows containing Box nodes are vulnerable to security restriction bypass due to [CVE-2023-32313]

Summary Node.js module vm2 is used by IBM App Connect Enterprise Certified Container by the Box connector in designer flows. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that run designer flows containing Box nodes are vulnerable to security...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that use MQ Client nodes are vulnerable to disclosure of sensitive information due to [CVE-2023-28950]

Summary IBM MQ is used by IBM App Connect Enterprise Certified Container by the MQ Client nodes. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that run toolkit flows containing MQ Client nodes are vulnerable to disclosure of sensitive information...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that use the MQ Client nodes are vulnerable to denial of service due to [CVE-2023-22874]

Summary IBM MQ is used by IBM App Connect Enterprise Certified Container by the MQ Client nodes. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that run toolkit flows containing MQ Client nodes are vulnerable to denial of service. This bulletin...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to denial of service due to [CVE-2023-31125]

Summary npm module Engine.IO is used by IBM App Connect Enterprise Certified Container for updating the webconsole in a DesignerAuthoring instance. IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to denial of service. This bulletin provides patch informati...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable to arbitrary code execution due to [CVE-2022-1471]

Summary SnakeYAML is used by IBM App Connect Enterprise Certified Container for processing yaml configuration files. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable to arbitrary code execution. This bulletin provides patch informatio...

[SECURITY] Fedora 38 Update: mod_auth_openidc-2.4.13.2-1.fc38

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands is vulnerable to arbitrary code execution due to [CVE-2023-32314]

Summary Node.js module vm2 is used by IBM App Connect Enterprise Certified Container in Designer flows by the Box connector. IBM App Connect Enterprise Certified Container DesignerAuthoring operands may be vulnerable to arbitrary code execution. This bulletin provides patch information to address...

Fedora 38 : mod_auth_openidc (2023-b534ca7056)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-b534ca7056 advisory. Rebase to 2.4.13.2 version, fix CVE-2023-28625 Tenable has extracted the preceding description block directly from the Fedora security advisory. Not...

Security Bulletin: IBM API Connect is vulnerable to OpenSSL vulnerabilities (CVE-2022-4304, CVE-2023-0215, CVE-2023-0286)

Summary IBM API Connect has addressed the following information disclosure and denial of service vulnerabilities in OpenSSL CVE-2022-4304, CVE-2023-0215, and CVE-2023-0286. Vulnerability Details CVEID:CVE-2022-4304 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information...