CVE-2022-42903

Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list...

PT-2022-26654 · Zoho · Zoho Manageengine Supportcenter Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine SupportCenter Plus versions through 11024 Description: The issue allows low-privileged users to view the organization users list. Recommendations: For versions through 11024, update to a version that contains a fix for this...

Cross site scripting

Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity ManagementSCIM account management enabled, Zulip Server 5.0 through 5.6 checked the SCIM bearer token using a comparator that did not run in constant time. Therefore, it might theoretically be...

CVE-2022-41914 Non-constant-time SCIM token comparison in Zulip Server

Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity ManagementSCIM account management enabled, Zulip Server 5.0 through 5.6 checked the SCIM bearer token using a comparator that did not run in constant time. Therefore, it might theoretically be...

CVE-2021-42898

Technical details for CVE-2021-42898 are not publicly available in the provided documents. Monitor for updates as the Initial Description indicates the candidate is reserved.

FreeBSD : Grafana -- Privilege escalation (6eb6a442-629a-11ed-9ca2-6c3be5272acd)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6eb6a442-629a-11ed-9ca2-6c3be5272acd advisory. - Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5....

CVE-2022-45081

CVE-2022-45081 is associated with a Missing Access Control vulnerability in WordPress plugin "Add Multiple Marker" (versions

CVE-2022-45075

CVE-2022-45075 corresponds to a Broken Access Control vulnerability in the WordPress Activity Reactions For Buddypress plugin, affected versions

Input validation

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non...

CVE-2022-39306 Grafana contains Improper Input Validation

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non...

grafana: XSS vulnerability in data source handling

A Cross-site scripting XSS vulnerability was found in the way Grafana handles data sources. This flaw allows an attacker to serve HTML content through the Grafana data source or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site scripting...

Email addresses and usernames can not be trusted

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non...

CVE-2021-14355

CVE-2021-14355 relates to Spice Server. Public sources describe multiple vulnerabilities in Spice Server prior to 0.15.0, with the CNNVD entry noting a remote code execution risk and Gentoo GLSA detailing a DoS-related issue in older Spice versions (before 0.14.92) and recommending upgrading to n...

CVE-2022-224485

CVE-2022-224485 impacts IBM Spectrum Protect Server. Affected versions: 8.1.0.000 through 8.1.14.000. The issue originates from bypassing the authentication attempt rate limit, enabling an attacker to obtain the administrator password. No exploit details or explicit mitigation are provided in the...

CVE-2102-3325

Technical details for CVE-2102-3325 are not publicly available in the provided documents. Monitor for future updates.

CVE-2021-17571

IBM’s bulletin confirms that Apache Log4j vulnerabilities affect IBM App Connect Enterprise (ACE) v11/v12 and IBM Integration Bus v10, with CVE-2019-17571 described as enabling remote code execution via improper deserialization in SocketServer. Affected range includes ACE v12.0.1.0–v12.0.3.0, ACE...

CVE-2022-232475

Technical details for CVE-2022-232475 are not publicly available in the provided documents; monitor for updates.

CVE-2022-43471

The CVE entry CVE-2022-43471 in this context is supported by a Patchstack report for WordPress WP Bootstrap Gallery plugin (versions <= 1.1) describing a Broken Access Control vulnerability. Affected component: WP Bootstrap Gallery plugin. Root cause: Broken Access Control in versions

CVE-2022-44705

Technical details for CVE-2022-44705 are not publicly available in the provided documents. There is no information on affected products, impact, vectors, or remediation. Monitor for future updates.

CVE-2022-24476

CVE-2022-24476 affects IBM WebSphere Application Server Liberty (and Open Liberty) within IBM Watson Assistant for IBM Cloud Pak for Data, version ranges 17.0.0.3–22.0.0.7 and Open Liberty with authenticated identity spoofing via a specially crafted request. IBM Clover: vulnerable products includ...