A malicious zone operator can piggyback other transactions, when a caller tries to fulfill the restricted order

Lines of code Vulnerability details If an order has a restricted order type and, if the caller is other than the offerer or zone, then a staticcall to isValidOrder on the zone is made. This call outside the Seaport contract opens up a possible misuse by the zone contract implementation. The zone...

WhatsApp accounts hijacked by call forwarding

In a short post on LinkedIn Rahul Sasi, founder and CEO of CloudSEK, explains how WhatsApp account takeovers are possible. The methods consists of several steps and it takes some social engineering skills, but it’s good to be aware of the possibility and how it works. It starts with the threat...

PYSEC-2022-205

Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select. This will lead to the main thread raising an exception that is not handled and then causing t...

CVE-2022-1644

The Call&Book Mobile Bar WordPress plugin through 1.2.2 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-1644

The Call&Book Mobile Bar WordPress plugin through 1.2.2 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-1644

CVE-2022-1644 affects the Call&Book Mobile Bar WordPress plugin up to version 1.2.2. The vulnerability stems from inadequate sanitization/escaping of certain settings, allowing a high-privilege user (e.g., admin) to perform stored XSS even when unfiltered_html is disallowed. Exploitation details ...

CVE-2022-1644: Improper Neutralization of Input During Web Page Generation

The Call&Book Mobile Bar WordPress plugin through 1.2.2 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

WordPress Plugin Call&Book Mobile Bar has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Call...

PT-2022-14019

Name of the Vulnerable Software and Affected Versions Call&Book Mobile Bar WordPress plugin versions 1.2.2 and earlier Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks, even when unfiltered html is disallowed, due to the plugin not...

openSUSE: Security Advisory for go1.17 (SUSE-SU-2022:1862-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security Bulletin: Publicly disclosed vulnerability from Kernel affects IBM Netezza Host Management

Summary Kernel is used by IBM Netezza Host Management. This bulletin provides mitigation for the reported CVE. Vulnerability Details CVEID: CVE-2022-22942 DESCRIPTION: Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by improper file descriptor...

MGASA-2022-0204 Updated supertux packages fix security vulnerability

squirrel: threadcall in sqbaselib.cpp lacks a certain sqreservestack call CVE-2022-30292...

CVE-2022-28862

In Archibus Web Central before 26.2, multiple SQL Injection vulnerabilities occur in dwr/call/plaincall/workflow.runWorkflowRule.dwr. Through the injection of arbitrary SQL statements, a potential attacker can modify query syntax and perform unauthorized and unexpected operations against the remo...

PT-2022-19269

Name of the Vulnerable Software and Affected Versions Archibus Web Central versions prior to 26.2 Description The issue allows for SQL Injection vulnerabilities in the "dwr/call/plaincall/workflow.runWorkflowRule.dwr" endpoint. Through the injection of arbitrary SQL statements, a potential attack...

CVE-2022-28862: Improper Neutralization of Special Elements used in an SQL Command

In Archibus Web Central before 26.2, multiple SQL Injection vulnerabilities occur in dwr/call/plaincall/workflow.runWorkflowRule.dwr. Through the injection of arbitrary SQL statements, a potential attacker can modify query syntax and perform unauthorized and unexpected operations against the remo...

Jenkins Call Remote Job Plugin has Insufficiently Protected Credentials

Call Remote Job Plugin stores a password unencrypted in job config.xml files on the Jenkins controller. This password can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. As of publication of this advisory, there is no fix...

GHSA-8MPQ-FMR3-6JXV LXD vulnerable to Race Condition

LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer has an unsafe Chmod call that races against the stat in the Filepath.Walk function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice. Specific Go Packages Affected...

SUSE-SU-2022:1829-1 Security update for go1.18

This update for go1.18 fixes the following issues: - CVE-2022-29526: Fixed faccessat system call operation that checked the wrong group bsc1199413. - go1.18.2 released 2022-05-10 bsc1193742...

Halibut resource management error vulnerability

Halibut is a secure, RPC-based open source communication framework. Halibut version 1.2 contains a denial-of-service vulnerability that stems from a mix-up in the cleanupindex directive in index.c, which is responsible for freeing memory. An attacker could exploit this vulnerability to cause a...

May 24, 2022—KB5014021 (OS Build 20348.740) Preview

May 24, 2022—KB5014021 OS Build 20348.740 Preview Applies To Windows Server 2022 Note For information about Windows update terminology, see the article about the types of Windows updates and the monthly quality update types. For an overview of Windows Server 2022, see its update history page. Not...