Security Bulletin: QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM has released a new version which addresses the vulnerabilities. Vulnerability Details CVEID:CVE-2022-25881 DESCRIPTION: Node.js http-cache-semantics module i...

Can't Logoff Ghost Sessions “-” from Citrix Studio

Can't logoff the session in Studio, which is not even shown in VDAtask manager. Customer tried to hide the session with the below Powershell command, but this ghost session record still exists on Studio. "Get-BrokerSession -username Domain\username | Set-BrokerSession -hidden $true" Need to figur...

Path Traversal

ghost is vulnerable to Path Traversal. The vulnerability exists because the static-theme.js does not properly sanitize file paths, which allows an attacker to access files outside the expected directory and read arbitrary files within the active theme's folder via relative paths such as...

Information Disclosure

ghost is vulnerable to Information Disclosure. The vulnerability exists because the library does not properly validate the public API endpoints when filtering, which allows an attacker to reveal private fields such as the author name via a brute-force attack...

Ghost Directory Traversal Vulnerability

Ghost is an open source content management system . Ghost suffers from a directory traversal vulnerability that stems from a lack of validity checking of paths in frontend/web/middleware/static-theme.js when processing directory requests, which can be exploited by an attacker to read arbitrary...

CVE-2022-4537

The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supp...

CVE-2022-4537

The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supp...

CVE-2022-4537

The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supp...

CVE-2022-4537

CVE-2022-4537 covers Hide My WP Ghost – Security Plugin for WordPress. The issue is IP Address Spoofing via the X-Forwarded-For header, allowing logging and login checks to be bypassed. Affected versions are up to and including 5.0.18; PATCH is available in 5.0.20. Impact: potential unauthorized ...

CVE-2022-4537 Hide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass

The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supp...

WordPress plugin Hide My WP Ghost 数据伪造问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Hide My WP Ghost Plugin <= 5.0.18 is vulnerable to Bypass Vulnerability

Software Hide My WP Ghost Type Plugin Vulnerable versions = 5.0.18 Fixed in 5.0.20 OWASP Top 10 A6: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2022-4537 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1423c8425d3e Credits rezaduty Required...

CVE-2023-31133

Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute...

Design/Logic Flaw

Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute...

CVE-2023-31133

CVE-2023-31133 concerns Ghost: prior to v5.46.1, a lack of validation when filtering on public API endpoints enables a brute-force attack to disclose private fields. Ghost(Pro) has been patched; self-hosted instances below v5.46.1 are affected. A mitigation/workaround is to block requests to /gho...

CVE-2023-31133 Ghost vulnerable to disclosure of private API fields

Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute...

CVE-2023-31133 Ghost vulnerable to disclosure of private API fields

Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute...

CVE-2023-31133 Ghost vulnerable to disclosure of private API fields

Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute...

Ghost 信息泄露漏洞

Ghost CMS is an open source headless content management system CMS written in JavaScript from the Ghost Foundation in Singapore. An information disclosure vulnerability exists in Ghost versions prior to 5.46.1 that stems from a lack of validation when filtering on public API endpoints , which can...

ghost-as-middleware (=1.0.0), ghost-blade (=0.1.0) +3 more potentially affected by CVE-2023-32235 via ghost (>=0.11.14 <=1.26.2)

ghost NPM version =0.11.14, =0.1.7, =0.1.10 - persistent-ghost =0.8.2 - sign-alex =1.0.1 Source cves: CVE-2023-32235 Source advisory: OSV:GHSA-WF7X-FH6W-34R6...