Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2022-62757)

Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite 7.10.4 and prior...

Out-Of-Bounds Read

When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's...

Bribe Rewards Struck In Contract If Deposited During First Epoch

Lines of code Vulnerability details Vulnerability Details Bribe rewards added to the Bribe contract in the first epoch will not be claimable by any voters, and the rewards will struck in the Bribe contract. Proof-of-Concept Assume that the current epoch is epoch 0, and start date of epoch 0 is Da...

Gauge: Attacker can call notifyRewardAmount function to insert malicious token to prevent reward distribution

Lines of code Vulnerability details Impact The notifyRewardAmount function of the Gauge contract can be called by anyone, and can insert any token when rewards.length MAXREWARDTOKENS. And the notifyRewardAmount function of the Gauge contract will call the addRewardToken of the Bribe contract to a...

Malicious Package Via Repository Hijacking

hautelook/phpass was taken over as malicious package. The package repository was hijacked to tampered and used as a malware distribution vector after original account owner has deleted the account...

[SECURITY] [DSA 5145-1] lrzip security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5145-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 24, 2022 https://www.debian.org/security/faq -...

org.eclipse.jetty.tests:test-integration (>=9.1.6.v20160112, <=9.4.5.v20180619), org.eclipse.jetty:jetty-distribution (>=9.1.6.v20160112, <=9.4.8.v20180619) +39 more potentially affected by CVE-2019-10174 via org.infinispan:infinispan-core (7.1.1.final)

org.infinispan:infinispan-core MAVEN version 7.1.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - org.eclipse.jetty.tests:test-integration =9.1.6.v20160112, =9.1.6.v20160112, =9.4.0.m1,...

Jenkins Kubernetes CI/CD Plugin vulnerable to Credential Enumeration

A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. Note: Jenkins has suspended distribution of this plugin...

Jenkins Kubernetes CI/CD Plugin vulnerable to Improper Authorization

A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Note: Jenkins h...

com.hazelcast:hazelcast-all (1.8.5), com.hazelcast:hazelcast-client (1.8.5) +10 more potentially affected by CVE-2016-10750 via com.hazelcast:hazelcast (1.8.5)

com.hazelcast:hazelcast MAVEN version 1.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-all 1.8.5 - com.hazelcast:hazelcast-client 1.8.5 - com.hazelcast:hazelcast-hibernate 1.8....

CVE-2022-29237

Opencast exposes a cross-tenant access flaw: before versions 10.14 and 11.7, an attacker with full access to the ingest REST interface and knowledge of internal links could import files from another organization within the same multi-tenant cluster, bypassing organizational barriers. The issue is...

Users can grief reward distribution

Lines of code Vulnerability details Impact Users can grief reward distributions by spending dust Proof of Concept If a reward is targeted for an epoch in the past, a user can front-run the txn in the mempool and call addRewardToEpoch with a dust amount at an epoch after the one in question. This...

Hackers Trick Users with Fake Windows 11 Downloads to Distribute Vidar Malware

Fraudulent domains masquerading as Microsoft's Windows 11 download portal are attempting to trick users into deploying trojanized installation files to infect systems with the Vidar information stealer malware. "The spoofed sites were created to distribute malicious ISO files which lead to a Vida...

CVE-2022-22775

The Workspace client component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains difficult to exploit Reflected Cross Site Scripting XSS vulnerabilities that allow low privileged attackers with network access to execute scripts...

org.drools.planner:drools-planner-core (5.2.0.m2), org.drools.planner:drools-planner-distribution (5.2.0.m2) +25 more potentially affected by CVE-2014-8125 via org.drools:drools-core (5.2.0.m2)

org.drools:drools-core MAVEN version 5.2.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.2.0.m2 - org.drools.planner:drools-planner-distribution 5.2.0.m2 -...

org.drools.planner:drools-planner-core (5.3.4.final), org.drools.planner:drools-planner-distribution (5.3.4.final) +32 more potentially affected by CVE-2014-8125 via org.drools:drools-core (5.3.4.final)

org.drools:drools-core MAVEN version 5.3.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.3.4.final - org.drools.planner:drools-planner-distribution 5.3.4.fin...

org.drools.planner:drools-planner-core (5.4.0.cr1), org.drools.planner:drools-planner-distribution (5.4.0.cr1) +35 more potentially affected by CVE-2014-8125 via org.drools:drools-core (5.4.0.cr1)

org.drools:drools-core MAVEN version 5.4.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.4.0.cr1 - org.drools.planner:drools-planner-distribution 5.4.0.cr1 -...

org.drools.planner:drools-planner-core (5.3.0.beta1), org.drools.planner:drools-planner-distribution (5.3.0.beta1) +20 more potentially affected by CVE-2014-8125 via org.drools:drools-core (5.3.0.beta1)

org.drools:drools-core MAVEN version 5.3.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.3.0.beta1 - org.drools.planner:drools-planner-distribution 5.3.0.bet...

org.drools.planner:drools-planner-core (5.3.5.final), org.drools.planner:drools-planner-distribution (5.3.5.final) +32 more potentially affected by CVE-2014-8125 via org.drools:drools-core (5.3.5.final)

org.drools:drools-core MAVEN version 5.3.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - org.drools.planner:drools-planner-core 5.3.5.final - org.drools.planner:drools-planner-distribution 5.3.5.fin...

org.drools:drools-camel-server (>=5.3.1.final, <=5.4.0.beta2), org.drools:drools-simulator (5.4.0.beta2) +3 more potentially affected by CVE-2014-8125 via org.jbpm:jbpm-bpmn2 (5.2.0.final)

org.jbpm:jbpm-bpmn2 MAVEN version 5.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jbpm:jbpm-bpmn2 and may be impacted: - org.drools:drools-camel-server =5.3.1.final, =5.3.1.final, =5.4.0.beta2 Source cves: CVE-2014-8125 Source advisory:...