PT-2022-2844 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to incorrect code generation management in the Win32 Stream Enumeration component of Windows operating systems. This allows a remote attacker to execute arbitrary code...

PT-2022-2872 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to incorrect code generation management in the Win32 Stream Enumeration component of Windows operating systems. This allows remote attackers to execute arbitrary code a...

CVE-2022-24837

HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable filename after the upload, resulting in potential information leakage of uploaded documents. This is especially relevant for private notes an...

CVE-2022-24837 Enumerable upload file names in hedgedoc

HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable filename after the upload, resulting in potential information leakage of uploaded documents. This is especially relevant for private notes an...

CVE-2022-24819 Unauthenticated user can retrieve the list of users through uorgsuggest.vm

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1...

Metasploit Wrap-Up

Windows Local Privilege Escalation for standard users In this week’s release, we have an exciting new module that has been added by our very own Grant Willcox which exploits CVE-2022-26904, and allows for normal users to execute code as NT AUTHORITY/SYSTEM on Windows machines from Windows 7 up to...

CVE-2022-22339

IBM Planning Analytics 2.0 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 219736...

Server side request forgery (ssrf)

IBM Planning Analytics 2.0 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 219736...

IBM Planning Analytics 代码问题漏洞

IBM Planning Analytics is a business planning and analysis solution from IBM USA. IBM Planning Analytics is vulnerable to server-side request forgery, which can be exploited by attackers to cause network enumeration or facilitate other attacks...

Access Control Bypass

IBM MQ is vulnerable to access control bypass. The vulnerability exists due to a lack of sanitization between a valid and an invalid login attempts allowing an attacker to enumerate account credentials...

CVE-2022-22339

IBM Planning Analytics 2.0 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 219736...

CVE-2022-22356

IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an attacker to enumerate account credentials due to an observable discrepancy in valid and invalid login attempts. IBM X-Force ID: 220487...

Design/Logic Flaw

IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an attacker to enumerate account credentials due to an observable discrepancy in valid and invalid login attempts. IBM X-Force ID: 220487...

IBM MQ Appliance 安全漏洞

IBM MQ Appliance is an all-in-one appliance for rapid deployment of enterprise-class messaging middleware from IBM U.S.A. An information disclosure vulnerability exists in IBM MQ Appliance, which stems from an apparent discrepancy between valid and invalid login attempts, and can be exploited by...

Security Bulletin: IBM MQ Appliance affected by account enumeration and denial of service vulnerabilities (CVE-2022-22356 and CVE-2022-22355)

Summary IBM MQ Appliance has resolved account enumeration and denial of service vulnerabilities. Vulnerability Details CVEID: CVE-2022-22356 DESCRIPTION: IBM DataPower Gateway could allow an attacker to enumerate account credentials due to an observable discrepancy in valid and invalid login...

CVE-2022-22356

IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an attacker to enumerate account credentials due to an observable discrepancy in valid and invalid login attempts. IBM X-Force ID: 220487...

Windows Gather Installed Application Within Chocolatey Enumeration

This module will enumerate all installed applications on a Windows system with chocolatey installed Module Options msf use post/windows/gather/enumchocolateyapplications msf postenumchocolateyapplications show actions ...actions... msf postenumchocolateyapplications set ACTION msf...

openSUSE 15 Security Update : nextcloud (openSUSE-SU-2022:0098-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0098-1 advisory. - Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not...

OPENSUSE-SU-2022:0098-1 Security update for nextcloud

This update for nextcloud fixes the following issues: nextcloud was updated to 21.0.9: - CVE-2021-41239 CWE-200: user enumeration setting not obeyed in User Status API boo1196905 - CVE-2021-41241 CWE-863: groupfolders advanced permissions is not obeyed for subfolders boo1196908 - CVE-2021-41741...

Missing permission Jenkins Pipeline Phoenix AutoTest Plugin

A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...