PT-2022-2434

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 7u331, 8u321, 11.0.14, 17.0.2, 18 Oracle GraalVM Enterprise Edition versions 20.3.5, 21.3.1, 22.0.0.2 Description The issue is related to insufficient input validation in the Libraries component of Oracle Java SE and...

Oracle Fusion Middleware 缓冲区错误漏洞

Oracle Fusion Middleware and Oracle Business Intelligence Enterprise Edition are both products of Oracle Corporation.Oracle Fusion Middleware is a suite of business innovation platforms for enterprise and cloud environments. Oracle Fusion Middleware is a business innovation platform for enterpris...

IBM Sterling B2B Integrator 安全漏洞

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. An information disclosure vulnerability exists in IBM Sterlin...

Oracle Java SE 输入验证错误漏洞

Oracle Java SE, an Oracle company, is used to develop and deploy Java applications on desktops, servers, and embedded devices and live environments.Oracle Java SE is vulnerable to an input validation error that could be exploited by an attacker to cause unauthorized creation, deletion, or...

Security Bulletin: Security vulnerabilities have been identified in IBM SDK, Java Technology Edition shipped with IBM Tivoli Federated Identity Manager

Summary IBM SDK, Java Technology Edition is shipped with IBM Tivoli Federated Identity Manager. Information about security vulnerabilities affecting IBM SDK, Java Technology Edition have been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in the...

Citrix SD-WAN Security Bulletin for CVE-2022-27505 and CVE-2022-27506

Vulnerabilities have been discovered in multiple Citrix SD-WAN products. These vulnerabilities, if exploited, could result in the following security issues: CVE-ID| Description| CWE| Affected Products| Pre-conditions ---|---|---|---|--- CVE-2022-27505| Reflected cross site scriptingXSS| CWE-79:...

Security Updates for Microsoft SharePoint Server Subscription Edition (April 2022)

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A session spoofing vulnerability exists. An attacker can exploit this to perform actions with the privileges of another user...

PT-2022-13706 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 10.7 through 14.7.7 GitLab CE/EE versions 10.8 through 14.8.5 GitLab CE/EE versions 10.9 through 14.9.2 Description: Improper access control in GitLab CE/EE allows a malicious actor to obtain details of the latest commit...

Yoo Slider < 2.1.0 - Arbitrary Slider Creation/Edition via CSRF

The plugin does not have CSRF check in place when creating and editing sliders, which could allow attackers to make a logged in admin create and edit arbitrary slider via a CSRF attack...

CVE-2020-4668

IBM Sterling B2B Integrator is vulnerable to cross-site request forgery (CSRF). Affected: Standard Edition versions 6.0.0.0–6.0.3.5, 6.1.0.0–6.1.0.3, and 6.1.1.0. Root cause: lack of CSRF token authentication in the EBICS client allows attacker to perform actions on behalf of a trusted user. Impa...

The vulnerability of the Serialization component of the Oracle Java SE software platform and the Oracle GraalVM Enterprise Edition virtual machine allows attackers to compromise data integrity.

The vulnerability of the Serialization component in the Oracle Java SE software platform and the Oracle GraalVM Enterprise Edition virtual machine is related to the restoration of unreliable data in memory. Exploiting this vulnerability can allow an attacker to compromise the integrity of data...

The vulnerability of the Libraries component of the Oracle Java SE software platform and the Oracle GraalVM Enterprise Edition virtual machine allows a perpetrator to cause partial service disruption.

The vulnerability of the Libraries component of the Oracle Java SE software platform and the Oracle GraalVM Enterprise Edition virtual machine is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause partial service interruptions...

The vulnerability of the Libraries component of the Oracle Java SE software platform, the Oracle GraalVM Enterprise Edition virtual machine, and the Oracle Solaris operating system allows a perpetrator to cause partial service interruptions.

The vulnerability of the Libraries component of the Oracle Java SE software platform, the Oracle GraalVM Enterprise Edition virtual machine, and the Oracle Solaris operating system is related to resource release errors. Exploiting this vulnerability can allow an attacker to cause a partial servic...

The vulnerability of the ImageIO component in the Oracle GraalVM Enterprise Edition virtual machine allows a hacker to trigger a service failure.

The vulnerability of the ImageIO component in the Oracle GraalVM Enterprise Edition virtual machine exists due to insufficient testing of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty, which are bundled as part of IBM Websphere Hybrid Edition, are vulnerable to Clickjacking (CVE-2021-39038)

Summary IBM WebSphere Application Server and IBM WebSphere Application Server Liberty, which are bundled as part of IBM Websphere Hybrid Edition, are vulnerable to Clickjacking CVE-2021-39038 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to remote code execution due to Dojo (CVE-2021-23450)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to remote code execution due to Dojo CVE-2021-23450 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

April 5, 2022, update for Office 2016 (KB5002141)

None None...

CVE-2022-1162

A hardcoded password was set for accounts registered using an OmniAuth provider e.g. OAuth, LDAP, SAML in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts...

CVE-2022-1105

An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an unauthorized user to access pipeline analytics even when public pipelines are disabled...

CVE-2022-1099

Adding a very large number of tags to a runner in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to impact the performance of GitLab...