Tutor LMS < 2.0.10 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some course parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Create/Edit a Course, add a new Topic and put the following...

CVE-2022-35251

A cross-site scripting vulnerability exists in Rocket.chat v5 due to style injection in the complete chat window, an adversary is able to manipulate not only the style of it, but will also be able to block functionality as well as hijacking the content of targeted users. Hence the payloads are...

Cross site scripting

A cross-site scripting vulnerability exists in Rocket.chat v5 due to style injection in the complete chat window, an adversary is able to manipulate not only the style of it, but will also be able to block functionality as well as hijacking the content of targeted users. Hence the payloads are...

CVE-2022-35251

A cross-site scripting vulnerability exists in Rocket.chat v5 due to style injection in the complete chat window, an adversary is able to manipulate not only the style of it, but will also be able to block functionality as well as hijacking the content of targeted users. Hence the payloads are...

Exploit for Argument Injection in Atlassian Bitbucket

CVE-2022-36804-POC A critical vulnerability CVE-2022-36804 i...

PT-2022-6337 · Unknown · Mklogic-500

Name of the Vulnerable Software and Affected Versions: MKLogic-500 affected versions not specified Description: The issue is related to the presence of hidden functionality, specifically SSH access, in the MKLogic-500. This could allow a remote attacker to gain full control over the device...

PT-2022-34240 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.211 Description: The issue is related to the btrfs raid56 functionality, specifically in the raid56 parity recover function, where cached sectors are not trusted. The actual impact and potential for attack...

PT-2022-34163 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.137 Description: A potential security issue has been identified, although its actual impact and attack plausibility have not yet been proven. The issue is related to the cpuinfo functionality in the Linux...

PT-2022-33431 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.2 Description: The issue is related to the tracing functionality in the Linux Kernel, specifically with the assign vstr function. It involves using a copy of the va list to potentially mitigate a security...

PT-2022-33600 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.2 Description: A potential security issue has been identified, although its actual impact and attack plausibility have not yet been proven. The issue is related to the cpuinfo functionality in the MIPS...

PT-2022-33698 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.64 Description: A potential memory leak issue was discovered in the btrfs get dev args from path function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

PT-2022-33312 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.6 Description: The issue concerns a logic flaw in the LAG Link Aggregation functionality over the MLX5 LAG FLAG NDEVS READY flag. The actual impact and potential for attack have not been proven yet...

GHSA-WRRW-CRP8-979Q Pageflow vulnerable to sensitive user data extraction via Ransack query injection

Impact The attack allows extracting sensitive properties of database objects that are associated with users or entries belonging to an account that the attacker has access to. Pageflow uses the ActiveAdmin Ruby library to provide some management features to its users. ActiveAdmin relies on the...

Authentication flaw

A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resulting in permanent changes to device functionality. No authentication or controls are in place to prevent a threat actor from maliciously modifying firmware and performing a...

CVE-2022-36385

CVE-2022-36385 affects Contec Health CMS8000 family (CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor). The vulnerability arises from improper access controls that permit a threat actor with momentary physical access to insert a USB drive and perform a malicious firmware update, causing permane...

Service-Update-0.40-for-Microsoft-Dynamics CRM ( on-premises)-9.0

None None...

OPENSUSE-SU-2022:10118-1 Security update for opera

This update for opera fixes the following issues: Update to 90.0.4480.84 - DNA-101690 Cherry-pick fix for CVE-2022-3075 from chromium Update to 90.0.4480.80 - DNA-99188 Tab Tooltip doesn't disappear - DNA-100664 Shopping corner widget - DNA-100843 Options to install and update VPN Pro app, when...

Can not Claim the second time per Spec requirement

Lines of code Vulnerability details Impact Reading the spec, MerkleReedeemerSpec "The user can claim a configurable amount of each ctoken, or all of them if possible" means, the claim amount can be called multiple times. Meanwhile, in RariMerkleRedeemer.sol, inside the claim function, it requires...

User Enumeration via Response Timing

Description There is a significant timing difference in the login functionality for valid and invalid usernames. Proof of Concept Steps to reproduce: 1. Attempt a Login with a valid user and an invalid user and observe the difference in the response time Here is a small test script alternatively ...

Windows shellcode stage, Hidden Bind TCP Stager

Custom shellcode stage. Listen for a connection from a hidden port and spawn a command shell to the allowed host. Module Options msf use payload/windows/custom/bindhiddentcp msf payloadbindhiddentcp show actions ...actions... msf payloadbindhiddentcp set ACTION msf payloadbindhiddentcp show optio...