YOP Poll < 6.3.5 - Author+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of the settings available to users with a role as low as author before outputting them, leading to a Stored Cross-Site Scripting issue As author, put the following payload in the Settings Integration Use Google reCaptcha Yes Site Key: v v 6.3.5 - "...

YOP Poll < 6.3.5 - Author+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of the settings available to users with a role as low as author before outputting them, leading to a Stored Cross-Site Scripting issue PoC As author, put the following payload in the Settings Integration Use Google reCaptcha Yes Site Key: v v 6.3.5 - "...

GHSA-FFM7-7R8G-77XM Apache CXF JMX Integration is vulnerable to a MITM attack

Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the createMBServerConnectorFactory property of the default InstrumentationManagerImpl is not disabled, then it is vulnerable to a man-in-the-middle MITM style attack. An attack...

Moderate: Red Hat Security Advisory: Red Hat Integration - Service Registry release and security update [2.0.3.GA]

An update to the images for Red Hat Integration Service Registry is now available from the Red Hat Container Catalog. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact o...

What is Shift-Left Testing and What are the Benefits?

Back in the infancy of software creation, certainly up until the mid-90s when we still used more traditional software development practices, most testing was conducted at the end of the production cycle on a graph, this would be to the right on the development timeline. Shift-left takes this...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to Go (CVE CVE-2021-41771 & CVE-2021-41772)

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to Go CVE CVE-2021-41771 & CVE-2021-41772 with details below Vulnerability Details CVEID: CVE-2021-41772 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by...

RUSTSEC-2022-0104 `structopt` is in maintenance mode

structopt has been in maintenance mode, with no new development planned, since at least February of 2022. The status of structopt is discussed in a pinned issue. Recommended alternative The structopt derive wrapper was incorporated into clap v3. There is a migration guideclap-migration for...

JetBrains Hub 访问控制错误漏洞

JetBrains Hub is a web-based application from the Czech company JetBrains. The program is capable of integrating multiple JetBrains team tools together. An Access Control Error vulnerability exists in JetBrains Hub that stems from improper access restrictions in the JetBrains Account Integration...

WordPress Plugin International Sms For Contact Form 7 Integration V1.2 - Cross Site Scripting (XSS)

Exploit Title: WordPress Plugin International Sms For Contact Form 7 Integration V1.2 - Cross Site Scripting XSS Date: 2022-02-04 Author: Milad karimi Software Link: https://wordpress.org/plugins/cf7-international-sms-integration/ Version: 1.2 Tested on: Windows 11 CVE: N/A 1. Description: This...

Input validation

Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through validators/ folder are subject to a input validation vulnerability. Validators do not work properly for request...

CVE-2022-23623 Validation bypass in frourio

Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through validators/ folder are subject to a input validation vulnerability. Validators do not work properly for request bodies and queries in specific...

CVE-2022-23624 Validation bypass in frourio-express

Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through validators/ folder are subject to a input validation vulnerability. Validators do not work properly for request...

Rockwell (CVE-2015-1010) (deprecated)

Plugin deprecated because rsview is not detectable in this way This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2023/03/10. Deprecated because rsview...

Mitsubishi (CVE-2021-20607) (deprecated)

Plugin deprecated because mitsubishielectric software is not detectable in this way This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2023/03/10...

Rockwell (CVE-2020-5802) (deprecated)

Plugin deprecated because factorytalk is not detectable in this way This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2023/03/10. Deprecated because...

Rockwell (CVE-2011-2530) (deprecated)

Plugin deprecated because trslinx and edshardwareinstallationtool is not detectable in this way This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on...

PT-2022-16138 · Unknown · Class-Transformer +3

Name of the Vulnerable Software and Affected Versions: Frourio-express versions prior to v0.26.0 Description: Frourio-express is a minimal full stack framework for TypeScript. Users who use Frourio-express version prior to v0.26.0 and integrate with class-validator through the validators/ folder...

WordPress International SMS For Contact Form 7 Integration 1.2 XSS

Exploit Title: WordPress Plugin International Sms For Contact Form 7 Integration V1.2 - Cross Site Scripting XSS Date: 2022-02-04 Author: Milad karimi Software Link: https://wordpress.org/plugins/cf7-international-sms-integration/ Version: 1.2 Tested on: Windows 11 CVE: N/A 1. Description: This...

PT-2022-16137 · Unknown +1 · Class-Transformer +3

Name of the Vulnerable Software and Affected Versions: Frourio versions prior to v0.26.0 Description: Frourio is a full stack framework for TypeScript. Users who use Frourio version prior to v0.26.0 and integrate with class-validator through the validators/ folder are subject to an input validati...

Mitsubishi (CVE-2021-20588) (deprecated)

Plugin deprecated because mitsubishielectric software is not detectable in this way This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2023/03/10...