Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to remote authenticated attacker to execute arbitrary code on the system due to PostgreSQL (CVE-2022-2625)

Summary IBM Sterling Connect:Direct Web Services has addressed an applicable issue from PostgreSQL. Vulnerability Details CVEID:CVE-2022-2625 DESCRIPTION: PostgreSQL could allow a remote authenticated attacker to execute arbitrary code on the system, caused by improper control of the modification...

CVE-2022-38377

An improper access control vulnerability CWE-284 in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11 and FortiAnalyzer 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.0 through 6.0.12 may allow a remote and...

Authenticated SQL Injection in OpenSIS Classic v9.0 and earlier

Description SQL injection in OpenSIS Classic v9.0 and earlier allows remote authenticated attackers to execute SQL code via the id parameter in MassScheduleModal.php leading to full database information disclosure. Version At the time of reporting, the most up-to-date version of the master branch...

CVE-2022-40266 Denial-of-Service (DoS) Vulnerability in FTP Server Function on GOT2000 Series

Improper Input Validation vulnerability in Mitsubishi Electric GOT2000 Series GT27 model FTP server versions 01.39.000 and prior, Mitsubishi Electric GOT2000 Series GT25 model FTP server versions 01.39.000 and prior and Mitsubishi Electric GOT2000 Series GT23 model FTP server versions 01.39.000 a...

CVE-2022-40266 Denial-of-Service (DoS) Vulnerability in FTP Server Function on GOT2000 Series

Improper Input Validation vulnerability in Mitsubishi Electric GOT2000 Series GT27 model FTP server versions 01.39.000 and prior, Mitsubishi Electric GOT2000 Series GT25 model FTP server versions 01.39.000 and prior and Mitsubishi Electric GOT2000 Series GT23 model FTP server versions 01.39.000 a...

CVE-2022-43709

MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input or stored search filter settings...

Sql injection

MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input or stored search filter settings...

CVE-2022-43709

MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input or stored search filter settings...

MyBB SQL注入漏洞

MyBB MyBulletinBoard is a free and web-based forum software developed by MYBB team using PHP and MySQL. The software is easy to use, supports multiple languages, scalable and so on. A SQL injection vulnerability exists in MyBB version 1.8.31, which originates from a cross-site scripting...

MariaDB 10.0.0 < 10.0.1 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 10.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.0.1 advisory. - Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows local users t...

MariaDB 10.0.0 < 10.0.7 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 10.0.7. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.0.7 advisory. - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and...

MariaDB 5.5.0 < 5.5.24 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 5.5.24. It is, therefore, affected by multiple vulnerabilities as referenced in the 5.5.24 advisory. - Unspecified vulnerability in Oracle MySQL Server 5.5.23 and earlier allows remote authenticated users to affect availability via...

MariaDB 10.0.0 < 10.0.11 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 10.0.11. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.0.11 advisory. - Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Optimizer. Supported versions that are affecte...

MariaDB 5.5.0 < 5.5.41 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 5.5.41. It is, therefore, affected by multiple vulnerabilities as referenced in the 5.5.41 advisory. - Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote attackers to affect...

Cisco Firepower Management Center Cross-Site Scripting Vulnerability (CNVD-2023-28093)

Cisco Firepower Management Center FMC is a new generation of firewall management center software from the United States Cisco Cisco. A cross-site scripting vulnerability exists in Cisco Firepower Management Center, which can be exploited by remote authenticated attackers to conduct stored...

Cisco Firepower Management Center Cross-Site Scripting Vulnerability (CNVD-2023-28094)

Cisco Firepower Management Center FMC is a new generation of firewall management center software from the United States Cisco Cisco. A cross-site scripting vulnerability exists in Cisco Firepower Management Center, which can be exploited by remote authenticated attackers to conduct stored...

Cisco Firepower Management Center Cross-Site Scripting Vulnerability (CNVD-2023-28098)

Cisco Firepower Management Center FMC is a new generation of firewall management center software from the United States Cisco Cisco. A cross-site scripting vulnerability exists in Cisco Firepower Management Center, which can be exploited by remote authenticated attackers to conduct stored...

PT-2022-6255 · Hitachi · Hitachi Storage Plug-In For Vmware Vcenter

Name of the Vulnerable Software and Affected Versions: Hitachi Storage Plug-in for VMware vCenter versions 04.8.0 through 04.9.0 Description: The issue is related to an Incorrect Privilege Assignment vulnerability, which allows remote authenticated users to cause privilege escalation. This can be...

Multiple vulnerabilities in Movable Type

Overview Movable Type provided by Six Apart Ltd. contains multiple vulnerabilities listed below. Improper Validation of Syntactic Correctness of Input CWE-1286 - CVE-2022-45113 Cross-site Scripting CWE-79 - CVE-2022-45122 Improper Neutralization of Server-Side Includes SSI Within a Web Page CWE-9...

Authorization Bypass in Liferay Portal

An Insecure direct object reference IDOR vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the formInstanceRecordId parameter...