CVE-2022-38655 HCL BigFix WebUI is affected by a missing-permission-check vulnerability

BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site...

PT-2022-24505 · Ibm · Bigfix Webui

Name of the Vulnerable Software and Affected Versions: BigFix WebUI affected versions not specified Description: The issue concerns BigFix WebUI non-master operators who are missing necessary controls. These operators can modify the relevance of fixlets or deploy fixlets from the BES Support...

TYPO3-EXT-SA-2022-018: Multiple vulnerabilities in extension "Master-Quiz" (fp_masterquiz)

An issue was discovered in the fpmasterquiz aka Master-Quiz extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. An attacker can continue the quiz of a different user. In doing so, the attacker can view that user's answers and modify those answers...

GHSA-7GPW-FRPH-FWRG TYPO3-EXT-SA-2022-018: Multiple vulnerabilities in extension "Master-Quiz" (fp_masterquiz)

An issue was discovered in the fpmasterquiz aka Master-Quiz extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. An attacker can continue the quiz of a different user. In doing so, the attacker can view that user's answers and modify those answers...

CVE-2022-47407

An issue was discovered in the fpmasterquiz aka Master-Quiz extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. An attacker can continue the quiz of a different user. In doing so, the attacker can view that user's answers and modify those answers...

CVE-2022-47407

An issue was discovered in the fpmasterquiz aka Master-Quiz extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. An attacker can continue the quiz of a different user. In doing so, the attacker can view that user's answers and modify those answers...

CVE-2022-47407

CVE-2022-47407 affects the TYPO3 extension fp_masterquiz (Master-Quiz). In versions before 2.2.1 and 3.x before 3.5.1, an attacker can continue another user’s quiz, exposing and modifying that user’s answers. Root cause: insufficient session/user isolation in the quiz flow. Impact is user data ex...

TYPO3-EXT-SA-2022-018: Multiple vulnerabilities in extension "Master-Quiz" (fp_masterquiz)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2022-018...

master-toni.ru Cross Site Scripting vulnerability OBB-3093866

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Authorization

Missing Authorization in GitHub repository lirantal/daloradius prior to master branch...

PT-2022-26994 · Unknown · Daloradius

Name of the Vulnerable Software and Affected Versions: daloradius versions prior to master branch Description: The issue concerns exposure of sensitive system information to an unauthorized control sphere. This is due to missing authorization in the GitHub repository lirantal/daloradius...

PT-2022-36234 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.78 Description: The issue concerns the use of the keyrings subsystem for fscrypt master key in fscrypt. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

Authorization

A vulnerability has been found in Facepay 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /face-recognition-php/facepay-master/camera.php. The manipulation of the argument userId leads to authorization bypass. The attack can be launched...

WordPress Quiz and Survey Master plugin iFrame Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Quiz and...

CVE-2022-4032

The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'questionid' parameter in versions up to, and including, 8.0.4 due to insufficient input sanitization and output escaping that allowed iframe tags to be injected. This makes it possible for unauthenticated...

Input validation

The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'questionid' parameter in versions up to, and including, 8.0.4 due to insufficient input validation that allows attackers to inject content other than the specified value i.e. a number, file path,...

CVE-2022-4033

The CVE concerns the WordPress plugin Quiz and Survey Master. Affected: Quiz and Survey Master plugin for WordPress, versions up to and including 8.0.4. Root cause: insufficient input validation in the handling of the question[id] parameter, enabling input validation bypass. What’s vulnerable: th...

CVE-2022-4033 Quiz and Survey Master <= 8.0.4 - Improper Input Validation

The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'questionid' parameter in versions up to, and including, 8.0.4 due to insufficient input validation that allows attackers to inject content other than the specified value i.e. a number, file path,...

CVE-2022-4033 Quiz and Survey Master <= 8.0.4 - Improper Input Validation

The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'questionid' parameter in versions up to, and including, 8.0.4 due to insufficient input validation that allows attackers to inject content other than the specified value i.e. a number, file path,...

CVE-2022-4032 Quiz and Survey Master <= 8.0.4 - Unauthenticated iFrame Injection via Paragraph and Short Answer

The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'questionid' parameter in versions up to, and including, 8.0.4 due to insufficient input sanitization and output escaping that allowed iframe tags to be injected. This makes it possible for unauthenticated...