CVE-2022-21639

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Elastic Search Integration. Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

CVE-2022-21639

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Elastic Search Integration. Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

Code injection

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Elastic Search Integration. Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

OroCommerce Cross site scripting vulnerability during shipping rule editing for UPS integration

Impact Shipping rule edit page is vulnerable to cross site scripting XSS payload added to UPS Surcharge field. The attacker should have permission to create or edit a shipping rule...

GHSA-4VF4-955G-VXP2 OroCommerce Cross site scripting vulnerability during shipping rule editing for UPS integration

Impact Shipping rule edit page is vulnerable to cross site scripting XSS payload added to UPS Surcharge field. The attacker should have permission to create or edit a shipping rule...

How Microsoft Purview and Priva help simplify data protection

At Microsoft Security, we understand how challenging it is to protect your most important asset, your data, in today’s threat landscape. You’re faced with evolving challenges—from empowering employees for greater productivity to eliminating gaps in your infrastructure—all while trying to protect...

How Microsoft Purview and Priva help simplify data protection

At Microsoft Security, we understand how challenging it is to protect your most important asset, your data, in today’s threat landscape. You’re faced with evolving challenges—from empowering employees for greater productivity to eliminating gaps in your infrastructure—all while trying to protect...

Emerging best practices for securing cloud-native environments

Globally, IT experts recognise security as the most significant barrier to cloud adoption, in part because many of the ways of securing traditional IT environments are not always applicable to cloud-native infrastructure. As a result, security teams may find themselves behind the curve and...

CVE-2022-21639

CVE-2022-21639 affects Oracle PeopleSoft Enterprise PeopleTools with Elastic Search Integration (versions 8.59–8.60). An unauthenticated attacker can exploit over HTTP; Human interaction is required. Impact includes unauthorized data updates/inserts/deletes and reads. CVSS v3.1 base score 6.1 (Co...

CVE-2022-21639

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Elastic Search Integration. Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

CVE-2022-3331

An issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab's Zentao integration has an insecure direct object reference vulnerability that may be exploited ...

Design/Logic Flaw

An issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab's Zentao integration has an insecure direct object reference vulnerability that may be exploited ...

CVE-2022-3331

An issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab's Zentao integration has an insecure direct object reference vulnerability that may be exploited ...

CVE-2022-3082

The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example...

Cross site request forgery (csrf)

The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example...

CVE-2022-3082 miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling

The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example...

CVE-2022-3331

CVE-2022-3331 : GitLab EE Zentao integration insecure direct object reference allows leaking Zentao project issues. Affected versions include GitLab EE 14.5–15.1.5, 15.2–15.2.3, and 15.3–15.3.1. Remediation provided by vendors: upgrade to GitLab EE 15.1.6, 15.2.4, or 15.3.2 respectively. No explo...

CVE-2022-3082

CVE-2022-3082 affects the miniOrange Discord Integration WordPress plugin, versions prior to 2.1.6. The issue is insufficient authorization and CSRF protection in certain AJAX actions, allowing any logged-in user (e.g., subscribers) to invoke these actions and potentially disable the app. The doc...

CVE-2022-3331

An issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab's Zentao integration has an insecure direct object reference vulnerability that may be exploited ...

CVE-2022-3082 miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling

The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example...