CVE-2022-41913

CVE-2022-41913 affects the Discourse-calendar plugin for Discourse. When discourse_post_event_enabled is on, users can list members of private groups or private-group members in dynamic calendar posts, enabling disclosure of group membership. The issue is mitigated by upgrading to a version that ...

[SECURITY] Fedora 37 Update: dbus-1.14.4-1.fc37

D-BUS is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility...

WordPress Better Messages plugin <= 1.9.10.69 - Messaging Block Bypass vulnerability

Messaging Block Bypass vulnerability discovered by Dhakal Ananda Patchstack Alliance in WordPress Better Messages plugin versions = 1.9.10.69. Solution Update the WordPress BP Better Messages plugin to the latest available version at least 1.9.10.71...

Better Messages < 1.9.10.71 - Subscriber+ Messaging Block Bypass

The plugin does not properly block messages, which could allow subscriber and above role to bypass the block system in place...

artemis-commons: Apache ActiveMQ Artemis DoS

In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability DoS through uncontrolled resource consumption of memory...

CVE-2022-40287

The application was found to be vulnerable to an authenticated Stored Cross-Site Scripting XSS vulnerability in messaging functionality, leading to privilege escalation or a compromise of a targeted account...

Cross site scripting

The application was found to be vulnerable to an authenticated Stored Cross-Site Scripting XSS vulnerability in messaging functionality, leading to privilege escalation or a compromise of a targeted account...

CVE-2022-40287

The CVE-2022-40287 entry refers to an authenticated Stored Cross-Site Scripting (XSS) vulnerability in PHP Point of Sale, version 19.0, within the messaging functionality. The available connected documents confirm the vulnerability allows privilege escalation or compromise of a targeted account v...

CVE-2022-2508

In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging...

Code injection

In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging...

CVE-2022-2508

In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging...

CVE-2022-2508

CVE-2022-2508 affects Octopus Server. Multiple connected sources describe a vulnerability where verbose error messages may reveal the existence of resources in spaces the user should not access, constituting an information disclosure risk. The issue is tied to Octopus Server’s error handling in a...

CVE-2022-2508

In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging...

PT-2022-17069 · Unknown · Octopus Server

Name of the Vulnerable Software and Affected Versions: Octopus Server affected versions not specified Description: The issue allows an attacker to discover the existence of resources in a space that the user does not have access to, due to verbose error messaging. Recommendations: At the moment,...

CVE-2022-2508: Generation of Error Message Containing Sensitive Information

In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging...

[SECURITY] Fedora 35 Update: dbus-1.12.24-1.fc35

D-BUS is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility...

LayerZeroModule miscalculates gas, risking loss of assets

Lines of code Vulnerability details Description Holograph gets it's cross chain messaging primitives through Layer Zero. To get pricing estimate, it uses the DstConfig price struct exposed in LZ's RelayerV2 The issue is that the important baseGas and gasPerByte configuration parameters, which are...

Gas, a positive social network for teens (no, really)

A new social network is currently in the news, billed as a positive space for teens to enjoy themselves. Im all for positive spaces online, but what is it, and will teens really be happier there than say Instagram, or even just hanging out in WhatsApp groups? Pump the gas Launched in August of th...

Vulnerabilities fixed in Oracle Communications Applications

Vulnerabilities have been fixed in Oracle Communications Applications. The vulnerabilities allow a malicious party to perform attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution User rights Access to sensitive data Access to...

The vulnerability in the implementation of the Extensible Messaging and Presence Protocol (XMPP) in Cisco Jabber software platforms for Windows, macOS, Android and iOS, as well as Cisco Jabber for Android MAM and Cisco Jabber for iOS MAM, allows a attacker to send hidden HTTP requests (HTTP Request Smuggling attack).

The vulnerability of the XMPP protocol implementation in Cisco Jabber software for Windows, Cisco Jabber for MacOS, Cisco Jabber for Android and iOS, Cisco Jabber for Android MAM, and Cisco Jabber for iOS MAM lies in the exposure to information disclosure in error-prone data areas. Exploiting thi...