Rockwell Automation Studio 5000 Logix Designer Access Control Error Vulnerability

Rockwell Automation Studio 5000 Logix Designer is a Windows-based application from Rockwell Automation, Inc. It is used to build programs for PLCs. An access control error vulnerability exists in Rockwell Automation Studio 5000 Logix Designer version v.20-33, which arises from a user being grante...

Security Bulletin: IBM Integration Designer is vulnerable to denial of service ( CVE-2022-21626)

Summary The fix includes a new version of the IBM Runtime Environment Java Version 8 that resolves the specified vulnerability. Vulnerability Details CVEID:CVE-2022-21626 DESCRIPTION: An unspecified vulnerability in Java SE related to the Security component could allow an unauthenticated attacker...

Rockwell Automation Studio 5000 Logix Designer 授权问题漏洞

Rockwell Automation Studio 5000 Logix Designer is a Windows-based application from Rockwell Automation, Inc. It is used to build programs for PLCs. An access control error vulnerability exists in Rockwell Automation Studio 5000 Logix Designer version v.20-33, which arises from a user being grante...

Arbitrary Code Execution

typo3/cms and typo3/cms-core are vulnerable to arbitrary code execution. An attacker is able to inject and execute malicious TypoScript as PHP code due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module...

CVE-2022-23503

TYPO3 is an open source PHP based web content management system. Versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are vulnerable to Code Injection. Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it is possible t...

Code injection

TYPO3 is an open source PHP based web content management system. Versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are vulnerable to Code Injection. Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it is possible t...

CVE-2022-23503

TYPO3 is an open source PHP based web content management system. Versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are vulnerable to Code Injection. Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it is possible t...

CVE-2022-23503 TYPO3 vulnerable to Arbitrary Code Execution via Form Framework

TYPO3 is an open source PHP based web content management system. Versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are vulnerable to Code Injection. Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it is possible t...

PT-2022-16036 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 Description: The issue concerns a Code Injection vulnerability in the Form Designer backend module of TYPO3, an open source PHP based web content management system. Due to t...

TYPO3 8.0.0 < 8.7.49 ELTS / 9.0.0 < 9.5.38 ELTS / 10.0.0 < 10.4.33 / 11.0.0 < 11.5.20 / 12.0.0 < 12.1.1 (TYPO3-CORE-SA-2022-015)

The version of TYPO3 installed on the remote host is prior to 8.0.0 8.7.49 ELTS / 9.0.0 9.5.38 ELTS / 10.0.0 10.4.33 / 11.0.0 11.5.20 / 12.0.0 12.1.1. It is, therefore, affected by a vulnerability as referenced in the TYPO3-CORE-SA-2022-015 advisory. - Due to the lack of separating user-submitted...

Visual Email Designer for WooCommerce < 1.7.2 - Multiple Author+ SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author. action=INSERT HERE NAME OF...

Visual Email Designer for WooCommerce < 1.7.2 - Multiple Author+ SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author. PoC action=INSERT HERE NAME OF...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance may be vulnerable to denial of service due to CVE-2022-25310

Summary GNU Fribidi is used by IBM App Connect Enterprise Certified Container for handling unicode. IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance may be vulnerable to denial of service. This bulletin provides patch information to address the...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring and IntegrationServer operands may be vulnerable to arbitrary code execution due to [CVE-2020-36604]

Summary Node.js module hoek is used by IBM App Connect Enterprise Certified Container Designer connectors. IBM App Connect Enterprise Certified Container DesignerAuthoring and IntegrationServer operands that execute Designer flows may be vulnerable to arbitrary code execution. This bulletin...

CVE-2022-29825

Use of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 GOT2000 versions from 1.122C to 1.290C, and MT Works2 versions from 1.100E to 1.200J allows an unauthenticated attacker to disclose sensitive information. As a result,...

IBM InfoSphere DataStage Flow Designer 命令注入漏洞

IBM InfoSphere DataStage Flow Designer is a Web-based data stage flow designer from International Business Machines IBM. A command injection vulnerability exists in IBM InfoSphere DataStage Flow Designer version 11.7 that stems from vulnerability to a command injection vulnerability...

CVE-2022-38201

An unvalidated redirect vulnerability exists in Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. A remote, unauthenticated attacker can potentially induce an unsuspecting authenticated user to access an an attacker controlled domain...

PT-2022-24278 · Esri · Esri Portal For Arcgis Quick Capture Web Designer

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 through 10.9.1 Description: An unvalidated redirect issue exists, allowing a remote, unauthenticated attacker to potentially trick an authenticated user into accessing a domain...

CVE-2022-38201

CVE-2022-38201 affects Esri Portal for ArcGIS Quick Capture Web Designer, specifically versions 10.8.1–10.9.1. The issue is an unvalidated redirect, where an attacker can lure an authenticated user to a domain controlled by the attacker, potentially enabling credential/session exposure or user in...

CVE-2022-38201 An unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1.

An unvalidated redirect vulnerability exists in Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. A remote, unauthenticated attacker can potentially induce an unsuspecting authenticated user to access an an attacker controlled domain...