DEBIAN-CVE-2021-44855

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. There is Blind Stored XSS via a URL to the Upload Image feature...

WordPress Plugin Eventify 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2022-20746 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.6 and earlier Description: The issue allows for XSS via a deep link, as demonstrated by class="deep-link-app" for a "/!!&app=%2e./" URI. This can be exploited to execute malicious scripts. Recommendations: For OX Ap...

CVE-2021-35954

CVE-2021-35954 affects fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker. Affected component: Serial Wire Debug (SWD) feature enables physically proximate attackers to dump firmware, flash custom malicious firmware, and brick the device. Base CVSS v3.1 score 8.1 (HIGH) with ADJACENT attack...

fastrack Reflex 安全漏洞

fastrack Reflex is a smart wearable device from fastrack, Inc. A security vulnerability exists in fastrack Reflex version 2.0 W307SREFLEXv90.89, which stems from an activity tracker that allows a remote attacker to cause a denial of service device outage by carefully selecting the last three byte...

CVE-2021-35954

fastrack Reflex 2.0 W307SREFLEXv90.89 Activity Tracker allows physically proximate attackers to dump the firmware, flash custom malicious firmware, and brick the device via the Serial Wire Debug SWD feature...

CVE-2021-44855

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. There is Blind Stored XSS via a URL to the Upload Image feature...

Fedora 36 : wordpress (2022-4e099582c7)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-4e099582c7 advisory. WordPress 6.0.3 Security Release Security updates included in this release Stored XSS via wp-mail.php post by email Toshitsugu Yoneyama of Mitsui Bussan Secu...

PT-2022-28094

Name of the Vulnerable Software and Affected Versions ThinkPHP Framework versions prior to 6.0.14 Description The issue allows local file inclusion via the lang parameter when the language pack feature is enabled lang switch on=true. An unauthenticated and remote attacker can exploit this to...

The vulnerability of the virus removal function of AVG Anti-Virus and Avast Antivirus allows attackers to enhance their privileges.

The vulnerability of the virus removal function in antivirus software like AVG Anti-Virus and Avast Antivirus is related to insecure management of privileges. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

DEBIAN-CVE-2022-40959

During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...

Ghost CMS访问控制错误漏洞

Ghost CMS is an open source headless content management system CMS written in JavaScript from the Ghost Foundation in Singapore. An access control error vulnerability exists in Ghost CMS version 5.9.4, which stems from an authentication bypass vulnerability in the newsletter subscription feature,...

CVE-2022-4287

Authentication bypass in local application lock feature in Devolutions Remote Desktop Manager 2022.3.26 and earlier on Windows allows malicious user to access the application...

Devolutions Remote Desktop Manager 授权问题漏洞

Devolutions Remote Desktop Manager is an application from Devolutions Canada. It provides remote desktop management functionality. An authorization issue vulnerability exists in Devolutions Remote Desktop Manager version 2022.3.26 and prior versions, which stems from its local application locking...

Security feature bypass

A thread security vulnerability exists in the authentication process. Successful exploitation of this vulnerability may affect data integrity, confidentiality, and availability...

No notification triggered on sensitive actions like adding SSH key

Description Adding SSH key is a sensitive action . As the application triggers a notification on all sensitive actions like email change/password reset , SSH key is also an important security feature to be notified about Proof of Concept 1 Go to https://rdiffweb-dev.ikus-soft.com/prefs/sshkeys 2 ...

PT-2022-27039 · Ibm · Ibm Financial Transaction Manager For Swift Services For Multiplatforms

Name of the Vulnerable Software and Affected Versions: IBM Financial Transaction Manager for SWIFT Services for Multiplatforms version 3.2.4 Description: The issue allows an authenticated user to lock additional RM authorizations, resulting in a denial of service on displaying or managing these...

CVE-2022-42351 AEM Incorrect Authorization Security feature bypass

Adobe Experience Manager version 6.5.14 and earlier is affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to disclose low level confidentiality information. Exploitation of this issue doe...

CVE-2022-4607

A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to address this issue. The name of the patch...

CVE-2022-4607

A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to address this issue. The name of the patch...