Security Bulletin: IBM MQ is affected by FasterXML jackson-databind vulnerabilities (CVE-2022-42003, CVE-2022-42004)

Summary Multiple issues were identified with the Jackson library that is used within the IBM MQ Console to provide REST API functionality. Vulnerability Details CVEID:CVE-2022-42003 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by a lack of a check in the...

Magazine Edge <= 1.13 - Subscriber+ Arbitrary Plugin Activation

The theme does not have authorisation and CSRF when activating plugins via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary plugins Run the below command in the developer console of the web browser while being on the blog as a subscriber user...

PT-2023-16425 · Dst-Admin · Dst-Admin

Name of the Vulnerable Software and Affected Versions: dst-admin version 1.5.0 Description: A critical issue was found in dst-admin, affecting an unknown part of the file /home/masterConsole. The manipulation of the command argument leads to command injection. It is possible to initiate the attac...

PT-2023-16423 · Dst-Admin · Dst-Admin

Name of the Vulnerable Software and Affected Versions: dst-admin version 1.5.0 Description: A critical vulnerability was found in dst-admin, affecting an unknown functionality of the file /home/cavesConsole. The manipulation of the command argument leads to command injection. The attack can be...

New SH1MMER Exploit for Chromebook Unenrolls Managed ChromeOS Devices

A new exploit has been devised to "unenroll" enterprise- or school-managed Chromebooks from administrative control. Enrolling ChromeOS devices makes it possible to enforce device policies as set by the organization via the Google Admin console, including the features that are available to users...

PT-2023-2993 · Faronics · Faronics Insight

Name of the Vulnerable Software and Affected Versions: Faronics Insight versions 10.0.19045 Description: The issue is related to the lack of protection of the web page structure in the Teacher Console and Student Console components of the Faronics Insight platform. This allows an attacker to...

PT-2023-2966 · Faronics · Faronics Insight

Name of the Vulnerable Software and Affected Versions: Faronics Insight version 10.0.19045 Description: The issue allows unauthenticated attackers to view constantly updated screenshots of student desktops without their consent, potentially accessing sensitive or personal data. Attackers can also...

PT-2023-2968 · Faronics · Faronics Insight

Name of the Vulnerable Software and Affected Versions: Faronics Insight version 10.0.19045 Description: The issue is related to insufficient protection of service data in the Enhanced Security mode of the Teacher Console and Student Console of the Faronics Insight platform. Exploitation of this...

PT-2023-2973 · Faronics · Faronics Insight

Name of the Vulnerable Software and Affected Versions: Faronics Insight version 10.0.19045 Description: The issue allows a suitably positioned attacker to perform a man-in-the-middle attack on either a connected student or teacher. This enables them to intercept student keystrokes or modify...

PT-2023-2969 · Faronics · Faronics Insight

Name of the Vulnerable Software and Affected Versions: Faronics Insight version 10.0.19045 Description: The issue is related to the Teacher Console component of the Faronics Insight platform, which fails to protect the web page structure when handling the loggedInUser field. This can be exploited...

PT-2023-2975 · Faronics · Faronics Insight

Name of the Vulnerable Software and Affected Versions: Faronics Insight version 10.0.19045 Description: An issue in Faronics Insight allows an unauthenticated attacker to upload any type of file to any location on the Teacher Console's computer. This enables various exploitation paths, including...

PT-2023-2970 · Faronics · Faronics Insight

Name of the Vulnerable Software and Affected Versions: Faronics Insight version 10.0.19045 Description: The issue allows an attacker to create a crafted program mimicking the Teacher Console, which can compel Student Consoles to connect automatically and write arbitrary files to any location on...

PYSEC-2023-5

Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database. This problem is fixed from version 0.13....

Authorization

Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database. This problem is fixed from version 0.13....

Mozilla: Calls to <code>console.log</code> allowed bypasing Content Security Policy via format directive

The Mozilla Foundation Security Advisory describes this flaw as: Regular expressions used to filter out forbidden properties and values from style directives in calls to console.log weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser...

Exploit for Code Injection in Paradox Ipr512_Firmware

Injection vulnerability in Paradox Security Systems IPR512 - C...

Weak Password Vulnerability in Moxa NPort Web Console

Moxa develops and manufactures information networking products, providing customers with cost-effective and stable serial communication solutions, serial device networking solutions, and industrial Ethernet solutions. A weak password vulnerability exists in the Moxa NPort Web Console, which can b...

Mozilla: Calls to <code>console.log</code> allowed bypasing Content Security Policy via format directive

The Mozilla Foundation Security Advisory describes this flaw as: Regular expressions used to filter out forbidden properties and values from style directives in calls to console.log weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser...

Mozilla: Calls to <code>console.log</code> allowed bypasing Content Security Policy via format directive

The Mozilla Foundation Security Advisory describes this flaw as: Regular expressions used to filter out forbidden properties and values from style directives in calls to console.log weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser...

Mozilla: Calls to <code>console.log</code> allowed bypasing Content Security Policy via format directive

The Mozilla Foundation Security Advisory describes this flaw as: Regular expressions used to filter out forbidden properties and values from style directives in calls to console.log weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser...