CVE-2022-29907

The Nimbus skin for MediaWiki through 1.37.2 before 6f9c8fb868345701d9544a54d9752515aace39df allows XSS in Advertise link messages...

Design/Logic Flaw

The Nimbus skin for MediaWiki through 1.37.2 before 6f9c8fb868345701d9544a54d9752515aace39df allows XSS in Advertise link messages...

CVE-2022-29907

CVE-2022-29907 affects the Nimbus skin for MediaWiki up to 1.37.2, where the Advertise link messages are vulnerable to cross-site scripting. The issue arises before the patch referenced by commit 6f9c8fb868345701d9544a54d9752515aace39df, allowing XSS without specified exploitation details. Connec...

CVE-2022-29907

The Nimbus skin for MediaWiki through 1.37.2 before 6f9c8fb868345701d9544a54d9752515aace39df allows XSS in Advertise link messages...

CVE-2022-29907

The Nimbus skin for MediaWiki through 1.37.2 before 6f9c8fb868345701d9544a54d9752515aace39df allows XSS in Advertise link messages...

PT-2022-19906 · Mediawiki +1 · Mediawiki Nimbus Skin +1

Name of the Vulnerable Software and Affected Versions: MediaWiki Nimbus skin versions through 1.37.2 Description: The issue allows XSS in Advertise link messages. Recommendations: For MediaWiki Nimbus skin versions through 1.37.2, update to a version after 6f9c8fb868345701d9544a54d9752515aace39df...

MediaWiki 跨站脚本漏洞

MediaWiki is a set of web-based wiki engines from the U.S. Wikimedia MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. A security vulnerability exists in MediaWiki version 1.37.2 and prior versions, which stems from a cross-site...

The vulnerability of the getTopologyHistory service in the real-time distributed computing system Apache Storm allows a hacker to execute arbitrary code.

The vulnerability of the getTopologyHistory service in the real-time distributed computing system Apache Storm is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by creating a specially...

Metasploit Wrap-Up

Self-Service Remote Code Execution This week, our own @wvu-r7 added an exploit module that achieves unauthenticated remote code execution in ManageEngine ADSelfService Plus, a self-service password management and single sign-on solution for Active Directory. This new module leverages a REST API...

Apache Storm Nimbus 2.2.0 Command Execution Exploit

This Metasploit module exploits an unauthenticated command injection vulnerability within the Nimbus service component of Apache Storm. The getTopologyHistory RPC method method takes a single argument which is the name of a user which is concatenated into a string that is executed by bash. In ord...

Apache Storm Nimbus 2.2.0 Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/proto/thrift' require 'rex/stopwatch' class MetasploitModule 'Apache Storm Nimbus getTopologyHistory Unauthenticated Command Execution', 'Description' = %q...

OESA-2021-1415 storm security update

Apache Storm realtime computation system Security Fixes: An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution RCE. Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x...

GHSA-6768-MCJC-8223 Command injection leading to Remote Code Execution in Apache Storm

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution RCE prior to authentication...

Command injection leading to Remote Code Execution in Apache Storm

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution RCE prior to authentication...

CVE-2021-35499

The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting XSS vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the...

CVE-2021-35499

The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting XSS vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the...

Cross site scripting

The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting XSS vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the...

CVE-2021-35499

The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting XSS vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the...

CVE-2021-35499

CVE-2021-35499 affects TIBCO Nimbus, specifically the Web Reporting component in Nimbus 10.4.0 and earlier. The vulnerability is stored Cross-Site Scripting (XSS) that can be exploited by a low-privileged attacker to socially engineer a user with network access; the attack requires user interacti...

CVE-2021-35499 TIBCO Nimbus Stored Cross-site Scripting (XSS) vulnerabilities

The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting XSS vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the...