CVE-2022-4369

The WP-Lister Lite for Amazon WordPress plugin before 2.4.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high-privilege users such as admin...

SUSE-SU-2023:0002-1 Security update for sbd

This update for sbd fixes the following issues: Update to version 1.5.1+20221128.8ec8e01: - sbd-inquisitor: fail startup if pacemaker integration is disabled while SBDSYNCRESOURCESTARTUP is conflicting bsc1204319 - sbd-inquisitor: do not warn about startup syncing if pacemaker integration is even...

PT-2023-36103 · Sbd · Sbd

Name of the Vulnerable Software and Affected Versions: sbd versions prior to 1.5.1+20221128.8ec8e01 Description: The issue is related to the sbd-inquisitor component of the sbd software. It involves the handling of pacemaker integration and the SBD SYNC RESOURCE STARTUP setting. Specifically, the...

Twake 跨站脚本漏洞

Twake is a secure open source collaboration platform open sourced by LINAGORA that improves organizational productivity. Twake suffers from a cross-site scripting vulnerability that originates from the presence of XSS in the integration URL in linagora/twake, which allows javascript to be execute...

K10015187: BIG-IP APM client for Windows vulnerability CVE-2018-5547

Security Advisory Description Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy logon mode which uses a SYSTEM account to establish network access. This feature displays a certificate user interface dialog box which contains the...

CVE-2021-4284

OpenMRS HTML Form Entry UI Framework Integration Module (up to 1.x) contains a cross-site scripting vulnerability. The affected component is tied to the Single-Input UI Framework Integration Module, with remote initiation possible and no specific affected version beyond 1.x identified in the prov...

This Week in Spring - Happy New Year 2023 edition - December 27th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Its 27 December as I write this and - being honest - I couldnt be happier. Its raining outside. Im in a warm cozy office. Good music is playing. People are asleep in my home. I can hear the raindrops and wind outside the...

PT-2022-11701 · Openmrs · Openmrs Html Form Entry Ui Framework Integration Module

Name of the Vulnerable Software and Affected Versions: OpenMRS HTML Form Entry UI Framework Integration Module versions up to 1.x Description: A vulnerability has been found in the OpenMRS HTML Form Entry UI Framework Integration Module, which affects an unknown part and leads to cross-site...

OFRAK - Unpack, Modify, And Repack Binaries

OFRAK Open Firmware Reverse Analysis Konsole is a binary analysis and modification platform. OFRAK combines the ability to: Identify and Unpack many binary formats Analyze unpacked binaries with field-tested reverse engineering tools Modify and Repack binaries with powerful patching strategies...

IBM Security Verify Governance Identity Manager Information Disclosure Vulnerability

IBM Security Verify Governance Identity Manager is an IBM network appliance-based integration that focuses on business-centric rules, activities, and processes.IBM Security Verify Governance Identity Manager version 10.0.1 is vulnerable to An information disclosure vulnerability exists in IBM...

IBM Security Verify Governance Identity Manager Cross-Site Scripting Vulnerability

IBM Security Verify Governance Identity Manager is an IBM network appliance-based integration that focuses on business-centric rules, activities, and processes. version 10.0.1 of IBM Security Verify Governance Identity Manager is vulnerable to A cross-site scripting vulnerability exists. An...

Security Bulletin: IBM Integration Designer is vulnerable to denial of service ( CVE-2022-21626)

Summary The fix includes a new version of the IBM Runtime Environment Java Version 8 that resolves the specified vulnerability. Vulnerability Details CVEID:CVE-2022-21626 DESCRIPTION: An unspecified vulnerability in Java SE related to the Security component could allow an unauthenticated attacker...

Ghost unauthorized newsletter modification vulnerability

Talos Vulnerability Report TALOS-2022-1624 Ghost unauthorized newsletter modification vulnerability December 21, 2022 CVE Number CVE-2022-41654 SUMMARY An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to denial of service due to the package org.yaml:snakeyaml and jackson-databind

Summary IBM App Connect Enterprise and IBM Integration Bus are vulnerable to denial of service due to the package org.yaml:snakeyaml CVE-2022-38751, CVE-2022-38752, CVE-2022-38750, CVE-2022-25857, CVE-2022-38749, CVE-2022-41854 and jackson-databind CVE-2022-42003, CVE-2022-42004. The resolving fi...

Forrester names Microsoft a Leader in Q4 2022 Security Analytics Platforms Wave report

We’re excited to announce that Microsoft is named a Leader in The Forrester Wave: Security Analytics Platforms, Q4 2022. Microsoft achieved the highest possible score in 17 different criteria, including partner ecosystem, innovation roadmap, product security, case management, and architecture. Wi...

Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to multiple vulnerabilities

Summary There are multiple vulnerabilities in components of IBM i Modernization Engine for Lifecycle Integration as described in the Vulnerability Details section. FasterXML jackson-databind, Keycloak, and SnakeYAML are vulnerable to a denial of service CVE-2022-25857, CVE-2022-38751,...

Shennina - Automating Host Exploitation With AI

Shennina is an automated host exploitation framework. The mission of the project is to fully automate the scanning, vulnerability scanning/analysis, and exploitation using Artificial Intelligence. Shennina is integrated with Metasploit and Nmap for performing the attacks, as well as being...

Mautic Integration For WooCommerce < 1.0.3 - Arbitrary Options Update via CSRF

The plugin does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary blog options via a CSRF attack. The attack could also be performed via a LFI if one is present ...

Mautic Integration For WooCommerce < 1.0.3 - Arbitrary Options Update via CSRF

The plugin does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary blog options via a CSRF attack. The attack could also be performed via a LFI if one is present ...

Stored XSS in Week View Plugin

Description Stored cross-site scripting vulnerabilities arise when user input is stored and later embedded into the application's responses in an unsafe way. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of an...