Sassy Social Share 3.3.23 - Missing Access Controls to PHP Object Injection

Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wpajaxheateorsssimportconfig AJAX action due to a missing capability check in the importconfig function found in the /admin/class-sassy-social-share-admin.php file along with the implementation...

Simplifying the complex: Introducing Privacy Management for Microsoft 365

The data privacy regulation landscape is more complex than ever. With new laws emerging in countries like China and India, shifts in Europe and the United Kingdom, and currently 26 different laws across the United States, staying ahead of regulations can feel impossible. But this work is...

Simplifying the complex: Introducing Privacy Management for Microsoft 365

The data privacy regulation landscape is more complex than ever. With new laws emerging in countries like China and India, shifts in Europe and the United Kingdom, and currently 26 different laws across the United States, staying ahead of regulations can feel impossible. But this work is...

Node.js Multiple Vulnerabilities (October 12th 2021 Security Releases)

The version of Node.js installed on the remote host is prior to 12.22.7, 14.18.1 or 16.11.1. It is, therefore, affected by multiple HTTP smuggling vulnerabilities. An unauthenticated, remote attack could exploit these to bypass security controls, gain unauthorized access to sensitive data and...

Node.js Core environmental issue vulnerabilities

Nodejs Core is a core module compiled into Nodejs from the OpenJS Openjs Foundation. The module provides underlying TCP, HTTP, DNS, filesystem, subprocessing, and other functionality support for Nodejs. An environmental issue vulnerability exists in Nodejs Core that stems from an attacker being...

GitOops - All Paths Lead To Clouds

GitOops is a tool to help attackers and defenders identify lateral movement and privilege escalation paths in GitHub organizations by abusing CI/CD pipelines and GitHub access controls. It works by mapping relationships between a GitHub organization and its CI/CD jobs and environment variables...

CVE-2021-20584

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote attacker to upload arbitrary files, caused by improper access controls. IBM X-Force ID: 199397...

CVE-2021-20375

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to intercept and replace a message sent by another user due to improper access controls. IBM X-Force ID: 195567...

CVE-2021-20375

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to intercept and replace a message sent by another user due to improper access controls. IBM X-Force ID: 195567...

Improper access control

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to intercept and replace a message sent by another user due to improper access controls. IBM X-Force ID: 195567...

CVE-2021-20584

CVE-2021-20584 affects IBM Sterling File Gateway. Affected versions range from 2.2.0.0–6.1.1.0 and are vulnerable to arbitrary file upload due to improper access controls. Remote attackers could upload arbitrary files via the web/UI. Remediation: upgrade to 6.1.1.0 or apply the designated fixes (...

CVE-2021-20584

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote attacker to upload arbitrary files, caused by improper access controls. IBM X-Force ID: 199397...

CVE-2021-20375

CVE-2021-20375 affects IBM Sterling File Gateway versions 2.2.0.0 through 6.1.1.0. The issue is improper access controls allowing an authenticated user to intercept and replace a message sent by another user. IBM’s remediation/patch guidance (per IBM Security Bulletin) provides fixes by product v...

CVE-2021-20375: Undefined Security Weakness

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to intercept and replace a message sent by another user due to improper access controls. IBM X-Force ID: 195567...

PT-2021-13924

Name of the Vulnerable Software and Affected Versions: IBM Sterling File Gateway versions 2.2.0.0 through 6.1.1.0 Description: The issue allows an authenticated user to intercept and replace a message sent by another user due to improper access controls. Recommendations: For versions 2.2.0.0...

PT-2021-14057

Name of the Vulnerable Software and Affected Versions: IBM Sterling File Gateway versions 2.2.0.0 through 6.1.1.0 Description: The issue allows a remote attacker to upload arbitrary files due to improper access controls. Recommendations: For versions 2.2.0.0 through 6.1.1.0, update to a version...

CVE-2021-20584: Undefined Security Weakness

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote attacker to upload arbitrary files, caused by improper access controls. IBM X-Force ID: 199397...

Teddy cross-site scripting vulnerabilities

Teddy is an easy-to-read, easy-to-learn template language. A security vulnerability exists in teddy that stems from the lack of effective permission and access control measures on a networked system or product...

Sophos HitmanPro security vulnerability

Sophos HitmanPro is an excellent multi-engine cloud anti-virus scanner from Sophos UK.Sophos HitmanPro suffers from a security vulnerability that stems from a lack of authentication, access control, permission management and other security measures in the network system or product, which could be...

Johnson Controls ExacqVision Server has a vulnerability related to input validation errors.

Johnson Controls exacqVision Server is a suite of surveillance video management software from Johnson Controls, Inc. An input validation error vulnerability exists in exacqVision Server 32-bit, which stems from the susceptibility of the affected product to an integer overflow vulnerability. An...