Amazon CloudWatch Agent for Windows has Privilege Escalation Vector

Impact A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows in versions up to and including v1.247354. When users trigger a repair of the Agent, a pop-up window opens with SYSTEM permissions. Users with administrative access to affected hosts may use this to create a...

CVE-2022-43515 X-Forwarded-For header is active by default causes access to Zabbix sites in maintenance mode

Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitive data will be prevented from being...

DEBIAN-CVE-2022-4396

A vulnerability was found in RDFlib pyrdfa3 and classified as problematic. This issue affects the function getoption of the file pyRdfa/init.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is ffd1d62dd50d5f4190013b39cedcdfbd81f3ce3e...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect z/Transaction Processing Facility

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 that is used by the z/TPF system. z/TPF has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-21628 DESCRIPTION: Java SE is vulnerable to a denial of service, caused by a flaw in the Lightweig...

GSD-2022-1008101 net, neigh: Fix null-ptr-deref in neigh_table_clear()

net, neigh: Fix null-ptr-deref in neightableclear This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.154 by commit...

CVE-2022-45008

Online Leave Management System v1.0 was discovered to contain a stored cross-site scripting XSS vulnerability in the component /leavesystem/admin/?page=maintenance/department. This vulnerability allows attackers to execute arbitrary web scripts or HTML via crafted payload injected into the Name...

PT-2022-27363 · Unknown · Online Leave Management System

Name of the Vulnerable Software and Affected Versions: Online Leave Management System version 1.0 Description: The issue is related to a stored cross-site scripting XSS vulnerability. This vulnerability is located in the /leave system/admin/?page=maintenance/department component and allows...

Online Leave Management System 跨站脚本漏洞

Sourcecodester Online Leave Management System is an online leave management system. A security vulnerability exists in Online Leave Management System v1.0, which originates from a stored cross-site scripting XSS vulnerability in the component /leavesystem/admin/?page=maintenance/department. The...

DEBIAN-CVE-2022-43515

Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitive data will be prevented from being...

VulnCheck KEV: CVE-2020-6168

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable and disable maintenance-mode settings impacting the availability and confidentiality of a vulnerable site, along with the integrity of the setting...

CVE-2022-44928

D-Link DVG-G5402SP GE1.03 was discovered to contain a command injection vulnerability via the Maintenance function...

Command injection

D-Link DVG-G5402SP GE1.03 was discovered to contain a command injection vulnerability via the Maintenance function...

D-Link DVG-G5402SP 操作系统命令注入漏洞

The D-Link DVG-G5402SP is a wireless router from China-based AUO D-Link. An operating system command injection vulnerability exists in the D-Link DVG-G5402SP firmware version GE1.03, which stems from its Maintenance function that allows an attacker to implement command injection...

PT-2022-27332 · D Link · D-Link Dvg-G5402Sp

Name of the Vulnerable Software and Affected Versions: D-Link DVG-G5402SP version GE 1.03 Description: A command injection issue was found in the Maintenance function, allowing for potential exploitation. Recommendations: For D-Link DVG-G5402SP version GE 1.03, as a temporary workaround, consider...

CVE-2022-44928

D-Link DVG-G5402SP GE1.03 was discovered to contain a command injection vulnerability via the Maintenance function...

CVE-2022-44928

D-Link DVG-G5402SP GE1.03 was discovered to contain a command injection vulnerability via the Maintenance function...

Package discontinued because Bitly lowered the free quota

On November 17, 2022, an email was received from Bitly advising that the new link quota per free token is lowered to 50 per month from its previous value of 1000 per month. As per the email, this change is effective on December 8, 2022. The new quota is so low as to not be useful. For this reason...

SUSE-SU-2022:4253-1 Security update for busybox

This update for busybox fixes the following issues: - CVE-2014-9645: Fixed loading of unwanted modules with / bsc914660. - CVE-2017-16544: Fixed insufficient sanitization of filenames when autocompleting bsc1069412. - CVE-2015-9261: Fixed huftbuild misuses a pointer, causing segfaults bsc1102912....

PT-2022-28246 · Bitly · Bitly

Name of the Vulnerable Software and Affected Versions: Bitly affected versions not specified Description: A change in the link quota policy for free tokens has been implemented, reducing the quota to 50 per month, effective December 8, 2022. This change renders the service less useful, leading to...

USN-5686-2 git vulnerability

USN-5686-1 fixed several vulnerabilities in Git. This update provides the corresponding fix for CVE-2022-39260 on Ubuntu 16.04 ESM. Original advisory details: Kevin Backhouse discovered that Git incorrectly handled certain command strings. An attacker could possibly use this issue to cause a cras...