CVE-2022-29942

Talend Administration Center {CVE-2022-29942} is a SSRF vulnerability: an authenticated user can use the Service Registry 'Add' function to perform HTTP GETs to internal-network URLs. The issue is fixed in 8.0.x (TPS-5189), 7.3.x (TPS-5175), and 7.2.x (TPS-5201); earlier versions may be affected....

Improper access control

An improper access control in Fortinet FortiSOAR before 7.2.0 allows unauthenticated attackers to access gateway API data via crafted HTTP GET requests...

CVE-2022-23443

An improper access control in Fortinet FortiSOAR before 7.2.0 allows unauthenticated attackers to access gateway API data via crafted HTTP GET requests...

PT-2022-19925

Name of the Vulnerable Software and Affected Versions Talend Administration Center versions prior to 7.2.x Talend Administration Center versions 7.2.x through 7.2.x before TPS-5201 Talend Administration Center versions 7.3.x through 7.3.x before TPS-5175 Talend Administration Center versions 8.0....

CVE-2022-23443: Undefined Security Weakness

An improper access control in Fortinet FortiSOAR before 7.2.0 allows unauthenticated attackers to access gateway API data via crafted HTTP GET requests...

Protect

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiProxy and FortiOS web filter override form may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests...

PT-2022-11773

Name of the Vulnerable Software and Affected Versions FortiOS versions prior to 7.0.3 FortiOS versions prior to 6.4.8 FortiOS versions prior to 6.2.10 FortiOS versions 6.0.0 through 6.0.14 FortiProxy versions prior to 7.0.1 FortiProxy versions 2.0.0 through 2.0.7 Description An improper...

FortiSOAR - Improper access control on gateway API

An improper access control vulnerability CWE-284 in FortiSOAR may allow an unauthenticated attacker to access gateway API data via crafted HTTP GET requests...

Roundup Directory traversal vulnerability

Directory traversal vulnerability in Roundup 0.6.4 and earlier allows remote attackers to view arbitrary files via .. dot dot sequences in an @@ command in an HTTP GET request...

Code injection

A vulnerability has been identified in SCALANCE X302-7 EEC 230V, SCALANCE X302-7 EEC 230V, coated, SCALANCE X302-7 EEC 24V, SCALANCE X302-7 EEC 24V, coated, SCALANCE X302-7 EEC 2x 230V, SCALANCE X302-7 EEC 2x 230V, coated, SCALANCE X302-7 EEC 2x 24V, SCALANCE X302-7 EEC 2x 24V, coated, SCALANCE...

CVE-2022-26335

A vulnerability has been identified in SCALANCE X302-7 EEC 230V, SCALANCE X302-7 EEC 230V, coated, SCALANCE X302-7 EEC 24V, SCALANCE X302-7 EEC 24V, coated, SCALANCE X302-7 EEC 2x 230V, SCALANCE X302-7 EEC 2x 230V, coated, SCALANCE X302-7 EEC 2x 24V, SCALANCE X302-7 EEC 2x 24V, coated, SCALANCE...

PT-2022-3573

Name of the Vulnerable Software and Affected Versions SCALANCE X302-7 SCALANCE X304-2FE SCALANCE X306-1LD FE SCALANCE X307-2 SCALANCE X307-3 SCALANCE X307-3LD SCALANCE X308-2 SCALANCE X310 SCALANCE X320-1 SCALANCE X408-2 SCALANCE XR324-4M SCALANCE XR324-12M SIPLUS NET SCALANCE X308-2 Description...

CVE-2022-25216

An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player recently renamed PlayerFab has read-access, by means of an HTTP GET request to http://:32080/download/...

CVE-2022-25216

DVDFab 12 Player/PlayerFab is affected by a local file inclusion (absolute path traversal) via HTTP GET to /download/. The issue allows remote attackers to download any file on the Windows filesystem readable by the running user. Root cause: traversal of local paths in the download endpoint. Affe...

CVE-2022-25216: Improper Limitation of a Pathname to a Restricted Directory

An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player recently renamed PlayerFab has read-access, by means of an HTTP GET request to http:// :32080/download/...

CVE-2022-26483

An issue was discovered in Veritas InfoScale Operations Manager VIOM before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. A reflected cross-site scripting XSS vulnerability in admin/cgi-bin/listdir.pl allows authenticated remote administrators to inject arbitrary web script or HTML into an HTTP...

Cross site scripting

An issue was discovered in Veritas InfoScale Operations Manager VIOM before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. A reflected cross-site scripting XSS vulnerability in admin/cgi-bin/listdir.pl allows authenticated remote administrators to inject arbitrary web script or HTML into an HTTP...

PT-2022-17895

Name of the Vulnerable Software and Affected Versions Veritas InfoScale Operations Manager versions prior to 7.4.2 Patch 600 Veritas InfoScale Operations Manager versions 8.x prior to 8.0.0 Patch 100 Description A reflected cross-site scripting XSS issue allows authenticated remote administrators...

CVE-2022-26483: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Veritas InfoScale Operations Manager VIOM before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. A reflected cross-site scripting XSS vulnerability in admin/cgi-bin/listdir.pl allows authenticated remote administrators to inject arbitrary web script or HTML into an HTTP...

Backdoor.Win32.BluanWeb Information Disclosure

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/30903ccbc6747c0da5a2775884b78defB.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.BluanWeb Vulnerability: Information Disclosure Description: The malware "BlueAngel F...