Lottiefiles Field - Moderately critical - Cross Site Scripting - SA-CONTRIB-2022-046

The Lottiefiles Field module enables you to integrate the lottiefiles features into your page. The module does not sufficiently filter user-provided text on output, resulting in a Cross-Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role...

Security Bulletin: Vulnerabilities in Node.js affect IBM App Connect Enterprise and IBM Integration Bus (CVE-2020-7774)

Summary IBM App Connect Enterprise and IBM Integration Bus ship with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2020-7774 DESCRIPTION: Node.js y18n module could allow a remote attacker to execut...

CVE-2022-30707

Violation of secure design principles exists in the communication of CAMS for HIS. Affected products and versions are CENTUM series where LHS4800 is installed CENTUM CS 3000 and CENTUM CS 3000 Small R3.08.10 to R3.09.00, CENTUM series where CAMS function is used CENTUM VP, CENTUM VP Small, and...

NetworkManager bug fix and enhancement update

An update is available for NetworkManager. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list NetworkManager is a system network service that manages network device...

GitLab 13.11 < 14.9.5 / 14.10 < 14.10.4 / 15.0 < 15.0.1 (CVE-2022-1940)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE affecting all versions from 13.11 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows an attacker to...

Security Bulletin: Vulnerabilities in Node.js affect IBM App Connect Enterprise v11, v12 & IBM Integration Bus (CVE-2020-7608)

Summary IBM App Connect Enterprise ships with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2020-7608 DESCRIPTION: Node.js yargs-parser module could allow a remote attacker to execute arbitrary cod...

Cross-site Scripting in Jenkins NS-ND Integration Performance Publisher Plugin

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. Exploitation of th...

GHSA-PV38-MQPP-V72H Cross-site Scripting in Jenkins NS-ND Integration Performance Publisher Plugin

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. Exploitation of th...

Basket NFT have no name and symbol

Lines of code Vulnerability details Impact The Basket contract is intended to be used behind a proxy. But the ERC721 implementation used is not upgradeable, and its constructor is called at deployment time on the implementation. So all proxies will have a void name and symbol, breaking all...

Malicious Package

Overview integration-framework is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

The vulnerability of the Integration and Interfaces components of the Oracle PeopleSoft Enterprise CS Campus Community application allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Integration and Interfaces components of the Oracle PeopleSoft Enterprise CS Campus Community application exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected...

CVE-2022-34191

CVE-2022-34191 refers to a stored XSS vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin, affecting version 4.8.0.77 and earlier. The issue arises because the plugin does not escape the name of NetStorm Test parameters on views that display parameters, enabling an attacker wi...

PT-2022-22060 · Jenkins · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins NS-ND Integration Performance Publisher Plugin versions 4.8.0.77 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the plugin does not escape the name of NetStorm Test...

Jenkins Plugin NS-ND Integration Performance Publisher 跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins NS-ND Integration Performance...

CVE-2022-23342

The Hyland Onbase Application Server releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.1000 are vulnerable to a username enumeration vulnerability. An attacker can obtain valid users based on the response returned for invalid and valid users by sending a POST login...

MAL-2022-515 Malicious code in @porting-assistant/integration-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 757fb325921aaf211808046101e53811f0ac571b5b1f25882a8ea84b4e2ab05c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in socless_integration_packager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f8a00449ce9f5cfa113613780b17aa8f8f97ef62e54fc652d2e49eaf0988072 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sb-legacy-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ff01ef0957242defaf96e0855a5d73a8f8941ad7e6463db1eb2a2584512f472 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5939 Malicious code in sb-legacy-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ff01ef0957242defaf96e0855a5d73a8f8941ad7e6463db1eb2a2584512f472 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1947 Malicious code in cm-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8443ff4c1d4c5c95b7dc9d77e392b50e10171fba355445f2770d97f52f7d02a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...