PT-2022-21902 · WordPress · Retain Live Chat

Name of the Vulnerable Software and Affected Versions: Retain Live Chat WordPress plugin version 0.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a...

CVE-2022-3302 Anti-Spam by CleanTalk < 5.185.1 - Admin+ SQLi

The Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.185.1 does not validate ids before using them in a SQL statement, which could lead to SQL injection exploitable by high privilege users such as admin...

CVE-2022-3350 Contact Bank <= 3.0.30 - Admin+ Stored Cross-Site Scripting

The Contact Bank WordPress plugin through 3.0.30 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3391 Retain Live Chat <= 0.1 - Admin+ Stored Cross-Site Scripting

The Retain Live Chat WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3391 Retain Live Chat <= 0.1 - Admin+ Stored Cross-Site Scripting

The Retain Live Chat WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3300 Form Maker by 10Web < 1.15.6 - Admin+ SQLI

The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

IP Blacklist Cloud Plugin <= 5.00 - Admin+ SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

Mantenimiento Web < 0.14 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

AZL-11210 CVE-2022-21635 affecting package mysql for versions less than 8.0.31-1

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of thi...

CVE-2022-21627

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

CVE-2022-21603

Vulnerability in the Oracle Database - Sharding component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Easily exploitable vulnerability allows high privileged attacker having Local Logon privilege with network access via Local Logon to compromise Oracle Databas...

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2022-21599

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Stored Procedure. Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

UBUNTU-CVE-2022-39423

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.38. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

CVE-2022-22229

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability, a stored XSS or persistent, in the Control Center Controller web pages of Juniper Networks Paragon Active Assurance Formerly Netrounds allows a high-privilege attacker with 'WRITE' permissions to...

CVE-2022-22229

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability, a stored XSS or persistent, in the Control Center Controller web pages of Juniper Networks Paragon Active Assurance Formerly Netrounds allows a high-privilege attacker with 'WRITE' permissions to...

CVE-2022-22229 Paragon Active Assurance (Formerly Netrounds): Stored Cross-site Scripting (XSS) vulnerability in web administration

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability, a stored XSS or persistent, in the Control Center Controller web pages of Juniper Networks Paragon Active Assurance Formerly Netrounds allows a high-privilege attacker with 'WRITE' permissions to...

CVE-2022-22229 Paragon Active Assurance (Formerly Netrounds): Stored Cross-site Scripting (XSS) vulnerability in web administration

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability, a stored XSS or persistent, in the Control Center Controller web pages of Juniper Networks Paragon Active Assurance Formerly Netrounds allows a high-privilege attacker with 'WRITE' permissions to...

CVE-2022-21599

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Stored Procedure. Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2022-21637

CVE-2022-21637 affects MySQL Server (InnoDB) with affected versions 8.0.30 and earlier. Root cause involves InnoDB vulnerability leading to a complete DOS (hang/crash) under network access with high privileges. Remediation observed in connected data shows upgrades to MySQL 8.0.32 (e.g., AlmaLinux...