CVE-2022-21827

CVE-2022-21827 affects Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) prior to version 21.9.1.2. An attacker with local access to a machine running the vulnerable plug-in can corrupt or delete files as SYSTEM due to improper privilege/access control. Affected product: Citri...

PT-2022-15160

Name of the Vulnerable Software and Affected Versions Citrix Gateway Plug-in for Windows versions prior to 21.9.1.2 Description An improper privilege issue has been found that could allow an attacker with local access to a computer to corrupt or delete files as SYSTEM. Recommendations For version...

CVE-2022-21827: Improper Privilege Management

An improper privilege vulnerability has been discovered in Citrix Gateway Plug-in for Windows Citrix Secure Access for Windows 21.9.1.2 what could allow an attacker who has gained local access to a computer with Citrix Gateway Plug-in installed, to corrupt or delete files as SYSTEM...

Jenkins Maven Release Plug-in Plugin XXE vulnerability

Jenkins Maven Release Plug-in Plugin retrieves XML from Nexus repository manager APIs. Maven Release Plug-in Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity XXE attacks. While Jenkins users without Overall/Administer permission are not allowed to configu...

GHSA-7MF5-79GV-66GH Jenkins Maven Release Plug-in Plugin XXE vulnerability

Jenkins Maven Release Plug-in Plugin retrieves XML from Nexus repository manager APIs. Maven Release Plug-in Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity XXE attacks. While Jenkins users without Overall/Administer permission are not allowed to configu...

Jenkins Maven Release Plug-in Plugin stored credentials in plain text

Jenkins Maven Release Plug-in Plugin stored credentials unencrypted in its global configuration file org.jvnet.hudson.plugins.m2release.M2ReleaseBuildWrapper.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. Maven Release...

WordPress BulletProof Securitys plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plug-in. WordPress BulletProof Securitys plugin versions prior to 6.1 have a cross-site scripting vulnerability that...

WordPress VikBooking Hotel Booking Engine

WordPress is a suite of blogging platforms developed using the PHP language. WordPress plugin is an application plug-in. PHP is a scripting language that executes on the server side. WordPress VikBooking Hotel Booking Engine...

Design/Logic Flaw

Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties...

CVE-2022-1726

CVE-2022-1726 is a cross-site scripting vulnerability in the Bootstrap Table project when using the Table Export plug-in with exportOptions: htmlContent enabled, in versions prior to 1.20.2. The issue affects the Bootstrap Table code path (wenzhixin/bootstrap-table) and is disclosed as capable of...

CVE-2022-1726 Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in wenzhixin/bootstrap-table

Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties...

CVE-2022-1726

Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties...

CVE-2022-29586

Konica Minolta bizhub MFP devices before 2022-04-14 allow a Sandbox Escape. An attacker must attach a keyboard to a USB port, press F12, and then escape from the kiosk mode...

PT-2022-18009

Name of the Vulnerable Software and Affected Versions macOS versions prior to 12.4 Description This issue was addressed with improved checks. A plug-in may be able to inherit the application's permissions and access user data. Recommendations For versions prior to 12.4, update to macOS Monterey...

PT-2022-18010

Name of the Vulnerable Software and Affected Versions macOS versions prior to 12.4 Description This issue was addressed with improved checks. A plug-in may be able to inherit the application's permissions and access user data. Recommendations For versions prior to 12.4, update to macOS Monterey...

Security Bulletin: IBM Security Verify Password Synchronization Plug-in for Windows AD affected by multiple vulnerabilities (CVE-2021-20488, CVE-2021-20494, CVE-2021-20572, CVE-2021-20573, CVE-2021-20574)

Summary IBM has announced a release for IBM Security Verify Password Synchronization Plug-in for Windows AD to address several security vulnerabilities. The vulnerabilities concern denial of service and account take over. Vulnerability Details CVEID:CVE-2021-20572 DESCRIPTION: IBM Security Identi...

CVE-2021-26352

Insufficient bound checks in System Management Unit SMU PCIe Hot Plug table may result in access/updates from/to invalid address space that could result in denial of service...

Design/Logic Flaw

Insufficient bound checks in System Management Unit SMU PCIe Hot Plug table may result in access/updates from/to invalid address space that could result in denial of service...

CVE-2021-26352

Insufficient bound checks in System Management Unit SMU PCIe Hot Plug table may result in access/updates from/to invalid address space that could result in denial of service...

Moderate: Red Hat Security Advisory: dovecot security update

An update for dovecot is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...