Incapptic Connect has an unspecified vulnerability

Incapptic Connect is an application plug-in. A security vulnerability exists in Incapptic Connect, which can be exploited by an attacker with elevated access to remotely execute code on the Incapptic Connect server using unspecified attack vectors...

Pulse Connect Secure Code Injection Vulnerability

A code injection vulnerability exists in Pulse Connect Secure that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface...

CVE-2022-21828

A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vector in Incapptic Connect version 1.40.0, 1.39.1, 1.39.0, 1.38.1, 1.38.0, 1.37.1, 1.37.0, 1.36.0, 1.35.5, 1.35.4 and 1.35.3...

CVE-2022-21828

A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vector in Incapptic Connect version 1.40.0, 1.39.1, 1.39.0, 1.38.1, 1.38.0, 1.37.1, 1.37.0, 1.36.0, 1.35.5, 1.35.4 and 1.35.3...

CVE-2022-21828

A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vector in Incapptic Connect version 1.40.0, 1.39.1, 1.39.0, 1.38.1, 1.38.0, 1.37.1, 1.37.0, 1.36.0, 1.35.5, 1.35.4 and 1.35.3...

Code injection

A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vector in Incapptic Connect version 1.40.0, 1.39.1, 1.39.0, 1.38.1, 1.38.0, 1.37.1, 1.37.0, 1.36.0, 1.35.5, 1.35.4 and 1.35.3...

CVE-2022-21828

CVE-2022-21828 affects Incapptic Connect (server) with versions 1.35.3–1.40.0. A user with high-privilege access to the web console can remotely execute code on the Incapptic Connect server via an unspecified attack vector. The provided documents consistently describe remote code execution but do...

CVE-2022-21828

A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vector in Incapptic Connect version 1.40.0, 1.39.1, 1.39.0, 1.38.1, 1.38.0, 1.37.1, 1.37.0, 1.36.0, 1.35.5, 1.35.4 and 1.35.3...

Incapptic Connect 安全漏洞

Incapptic Connect is an application plug-in. A security vulnerability exists in Incapptic Connect, which can be exploited by an attacker with elevated access to remotely execute code on the Incapptic Connect server using unspecified attack vectors...

Bentley MicroStation CONNECT Remote Code Execution Vulnerability (CNVD-2022-30754)

Bentley MicroStation CONNECT is a Cad software platform for 2D and 3D design and drafting from Bentley Systems, Inc. A remote code execution vulnerability exists in Bentley MicroStation CONNECT 10.16.0.80 when parsing JT files, which stems from The program does not verify the existence of an obje...

Bentley MicroStation CONNECT Out-of-Bounds Write Vulnerability (CNVD-2022-30753)

Bentley MicroStation CONNECT, a Cad software platform for 2D and 3D design and drafting from Bentley Systems, Inc. Bentley MicroStation CONNECT 10.16.0.80 is vulnerable to an out-of-bounds write vulnerability when parsing JT files, which could be exploited by remote attackers to The vulnerability...

Bentley MicroStation CONNECT Out-of-Bounds Reading Vulnerability (CNVD-2022-30755)

Bentley MicroStation CONNECT is a Cad software platform for 2D and 3D design and drafting from Bentley Systems, Inc. Bentley MicroStation CONNECT 10.16.0.80 is vulnerable to an out-of-bounds read when parsing J2K files, which could be exploited by remote attackers to exploit this vulnerability to...

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality integrity as well as system availability.

...

MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16191.

...

MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16193.

...

MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16207.

...

MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.

...

Consul’s Connect Service Mesh Affected By Recent Envoy Security Releases

Summary Consul and Consul Enterprise “Consul” clusters using Consul Connect service mesh should be updated to adopt recent Envoy security releases. Consul’s 1.9 releases support only Envoy 1.16 and older, which are no longer supported and did not receive recent security fixes. Background Consul...

Security Bulletin: IBM App Connect Enterprise Certified Container Dashboards may be vulnerable to a denial of service vulnerability due to IBM X-Force vulnerability 220063

Summary Node.js module unset-value is used by IBM App Connect Enterprise Certified Container Dashboard when internally processing and validating an OpenAPI definition. IBM App Connect Enterprise Certified Container Dashboards may be vulnerable to a denial of service vulnerability. This bulletin...

WordPress BSD Split Pay for Stripe Connect on Woo plugin <= 3.2.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress BSD Split Pay for Stripe Connect on Woo plugin versions = 3.2.0. Solution Update the WordPress BSD Split Pay for Stripe Connect on Woo plugin to the latest available version at least 3.2.1...