WP Maintenance Mode & Coming Soon < 2.4.5 - Subscribed Users Deletion via CSRF

The plugin is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack document.getElementById"test".submit;...

PT-2022-14206

Name of the Vulnerable Software and Affected Versions The Coming Soon & Maintenance Mode by Colorlib WordPress plugin versions prior to 1.0.99 Description The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting when unfiltered html is disallowed, for example ...

WordPress plugin Coming Soon and Maintenance by Colorlib 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Coming Soon...

Cross site scripting

Nokia "G-2425G-A" Bharti Airtel Routers Hardware version "3FE48299DEAA" Software Version "3FE49362IJHK42" is vulnerable to Cross-Site Scripting XSS via the admin-MaintenanceDevice Management...

CVE-2022-30903

Nokia "G-2425G-A" Bharti Airtel Routers Hardware version "3FE48299DEAA" Software Version "3FE49362IJHK42" is vulnerable to Cross-Site Scripting XSS via the admin-MaintenanceDevice Management...

CVE-2022-30903

CVE-2022-30903 affects Nokia G-2425G-A Bharti Airtel routers (hardware 3FE48299DEAA, software 3FE49362IJHK42). The vulnerability is a Cross-Site Scripting (XSS) flaw accessible via the admin UI path admin → Maintenance → Device Management. The provided sources describe the issue but do not supply...

CVE-2022-30903: Improper Neutralization of Input During Web Page Generation

Nokia "G-2425G-A" Bharti Airtel Routers Hardware version "3FE48299DEAA" Software Version "3FE49362IJHK42" is vulnerable to Cross-Site Scripting XSS via the admin-MaintenanceDevice Management...

postgresql: Autovacuum, REINDEX, and others omit "security restricted operation" sandbox

A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pgamcheck commands activated relevant protections too late or no...

postgresql: Autovacuum, REINDEX, and others omit "security restricted operation" sandbox

A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pgamcheck commands activated relevant protections too late or no...

postgresql: Autovacuum, REINDEX, and others omit "security restricted operation" sandbox

A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pgamcheck commands activated relevant protections too late or no...

Red Alerts subscription service for zSeries

This service provides technical information for IT professionals who maintain zSeries servers. As these support bulletins are released, subscribers receive email containing links to the bulletins. Sign up for free notification of Red Alerts from My Notifications! You can also use the Enhanced...

MELSEC iQ-F CPU FX5U(C) and FX5UJ Buffer Overflow

The vulnerability of the CPU FX5UC and FX5UJ modules of the MELSEC iQ-F series is related to insufficient checking of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending specially crafted files...

MELSEC iQ-F CPU FX5U(C) and FX5UJ Buffer Overflow

The vulnerability of the CPU FX5UC and FX5UJ modules of the MELSEC iQ-F series is related to insufficient checking of input data. Exploiting this vulnerability can allow an attacker to cause malfunctions in the system...

CVE-2022-24701

An issue was discovered in WinAPRS 2.9.0. A buffer overflow in national.txt processing allows a local attacker to cause a denial of service or possibly achieve code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

postgresql: Autovacuum, REINDEX, and others omit "security restricted operation" sandbox

A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pgamcheck commands activated relevant protections too late or no...

ROS-20220530-02

Vulnerabilities in the Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pgamcheck components of the PostgreSQL database management system are related to a maintenance error in one component. pgamcheck components of PostgreSQL database management system are related to...

Privilege Escalation

thunderbird is vulnerable to privilege escalation.The maintenance service grants SERVICESTART access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service...

Automotive Shop Management System Cross-Site Scripting Vulnerability (CNVD-2022-77486)

Automotive Shop Management System is a system with customer management, vehicle sales, parts sales, repair and maintenance, agency services, auto credit, auto leasing, used car trading, and performance management functions. xss vulnerability exists in Automotive Shop Management System v1.0. An...

org.jenkins-ci.lib:xtrigger-lib (>=0.34, <=0.35), org.jenkins-ci.main:jenkins-test-harness (1.590) +4 more potentially affected by CVE-2021-21691 via org.jenkins-ci.main:jenkins-core (1.590)

org.jenkins-ci.main:jenkins-core MAVEN version 1.590 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.lib:xtrigger-lib =0.34, =3.0, =4.4 -...

GHSA-MR8Q-7F5J-WC79 Magento information disclosure vulnerability

When in maintenance mode, Magento version 2.4.0 and 2.3.4 and earlier are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This information could be helpful to attackers if they are able to identify other exploitable...