jenkins-2-plugins/git: stored XSS vulnerability

A stored cross-site scripting XSS vulnerability was found in the Jenkins Git plugin. Due to not escaping the Git SHA-1 checksum parameters provided to commit notifications, an attacker is able to submit crafted commit notifications to the /git/notifyCommit endpoint...

Google takes on Docs notification spammers

Cloud-based document suites have always been a hot target for scammers. When it’s easy to dip in and out for collaboration purposes, or just share things generally, then its likely that bad people will want in on the action. In 2019, Google calendar users were wading through endless spam...

UBUNTU-CVE-2022-26126

Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isisnbnotifications.c...

PaquitoSoftware Notimoo Cross-Site Scripting Vulnerability

Notimoo is a method for web developers to display notifications to users. PaquitoSoftware Notimoo suffers from a cross-site scripting vulnerability that can be exploited by attackers to execute arbitrary web script or HTML via a carefully crafted header or message in a notification...

CVE-2022-0345 Better Notifications for WP < 1.8.7 - Email Address Disclosure

The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfwsearchusers AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes finding the first letter, then the second one, then the third one...

WordPress Ultimate SMS Notifications for WooCommerce plugin <= 1.8.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Ultimate SMS Notifications for WooCommerce plugin versions = 1.8.1. Solution Update the WordPress Ultimate SMS Notifications for WooCommerce plugin to the latest available version at least 1.8.4...

WordPress Ultimate SMS Notifications for WooCommerce plugin <= 1.8.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Ultimate SMS Notifications for WooCommerce plugin versions = 1.8.1. Solution Update the WordPress Ultimate SMS Notifications for WooCommerce plugin to the latest available version at least 1.8.4...

WordPress "Notification Plus – Social Proof, Fomo, WooCommerce Recent Sales Notifications & Popups for WordPress" plugin <= 1.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress "Notification Plus – Social Proof, Fomo, WooCommerce Recent Sales Notifications & Popups for WordPress" plugin versions = 1.0.1. Solution No patched version available...

WordPress "Notification Plus – Social Proof, Fomo, WooCommerce Recent Sales Notifications & Popups for WordPress" plugin <= 1.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "Notification Plus – Social Proof, Fomo, WooCommerce Recent Sales Notifications & Popups for WordPress" plugin versions = 1.0.1. Solution No patched version available...

Cross site scripting

Checkmk =2.0.0p19 Fixed in 2.0.0p20 and Checkmk =1.6.0p27 Fixed in 1.6.0p28 are affected by a Cross Site Scripting XSS vulnerability. The Alias of a site was not properly escaped when shown as condition for notifications...

Security Bulletins for WebSphere Application Server

Abstract This security bulletin for WebSphere Application Server is a way for you to obtain security risk assessment information for APARs that are considered Security Integrity. If there is any potential risk of exposure, the APAR is marked as Security Integrity. Some APARs are marked as Securit...

CVE-2022-24565

Checkmk =2.0.0p19 Fixed in 2.0.0p20 and Checkmk =1.6.0p27 Fixed in 1.6.0p28 are affected by a Cross Site Scripting XSS vulnerability. The Alias of a site was not properly escaped when shown as condition for notifications...

The vulnerability in the implementation of Google Chrome’s push-notifications allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of Google Chrome’s browser push-notifications implementation is related to improper security checks for standard elements. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

Gitea Exposes Private Email Addresses

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email...

GHSA-F5FJ-7265-JXHJ Gitea Exposes Private Email Addresses

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email...

The vulnerability of Windows Push Notifications apps in the Windows operating system allows attackers to escalate their privileges.

The vulnerability of Windows Push Notifications apps in the operating system Windows is related to insecure management of privileges. Exploiting this vulnerability can allow attackers to enhance their privileges...

Medusa Android Banking Trojan Spreading Through Flubot's Attacks Network

Two different Android banking Trojans, FluBot and Medusa, are relying on the same delivery vehicle as part of a simultaneous attack campaign, according to new research published by ThreatFabric. The ongoing side-by-side infections, facilitated through the same smishing SMS phishing infrastructure...

CVE-2022-0474

CVE-2022-0474 affects OTRS AG OTRSCustomContactFields in OTRS 8.0.x (up to 8.0.11 and earlier). The vulnerability allows disclosure of the full recipient list from a customer contact field via notification emails, even when emails are sent to recipients individually. Impact is confidentiality lea...

Schneider Electric Modicon Improper Check for Unusual or Exceptional Conditions (CVE-2020-7543)

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium see security notifications for affected versions, that could cause denial of service when a specially crafted Read Physical Memo...

Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a Kubernetes API server security vulnerability (CVE-2021-25735)

Summary Red Hat OpenShift on IBM Cloud is affected by a security vulnerability in the Kubernetes API server that could allow node updates to bypass a validating admission webhook CVE-2021-25735 Vulnerability Details CVEID: CVE-2021-25735 Description: Kubernetes kube-apiserver could allow a remote...