HackerOne: Server Side Request Forgery (SSRF) in webhook functionality

Server Side Request Forgery SSRF vulnerability found in webhook functionality. Attacker able to bypass anti-SSRF protections by using IPv6 address mapped to IPv4. This allowed unauthorized access to internal AWS EC2 metadata instance...

PT-2024-40975 · Polkit · Polkit

Name of the Vulnerable Software and Affected Versions: polkit affected versions not specified Description: The issue with polkit involves changing permissions for rules folders. There is no information provided about the estimated number of potentially affected devices worldwide or details about...

GHSA-FGWC-3J6W-CH22 easy-rules-mvel vulnerable to remote code execution

easy-rules-mvel v4.1.0 was discovered to contain a remote code execution RCE vulnerability via the component mVELRule...

cn.sparrowmini:sparrow-bpm (0.0.1), cn.sparrowmini:sparrow-form (0.0.1) +13 more potentially affected by CVE-2023-50571 via org.jeasy:easy-rules-mvel (4.1.0)

org.jeasy:easy-rules-mvel MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jeasy:easy-rules-mvel and may be impacted: - cn.sparrowmini:sparrow-bpm 0.0.1 - cn.sparrowmini:sparrow-form 0.0.1 - cn.sparrowmini:sparrow-keycloak-adapte...

easy-rules-mvel vulnerable to remote code execution

easy-rules-mvel v4.1.0 was discovered to contain a remote code execution RCE vulnerability via the component mVELRule...

cn.sparrowmini:sparrow-bpm (0.0.1), cn.sparrowmini:sparrow-form (0.0.1) +13 more potentially affected by CVE-2023-50571 via org.jeasy:easy-rules-mvel (4.1.0)

org.jeasy:easy-rules-mvel MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jeasy:easy-rules-mvel and may be impacted: - cn.sparrowmini:sparrow-bpm 0.0.1 - cn.sparrowmini:sparrow-form 0.0.1 - cn.sparrowmini:sparrow-keycloak-adapte...

CVE-2023-50571

easy-rules-mvel v4.1.0 was discovered to contain a remote code execution RCE vulnerability via the component MVELRule...

CVE-2023-50571

easy-rules-mvel v4.1.0 was discovered to contain a remote code execution RCE vulnerability via the component MVELRule...

Remote code execution

easy-rules-mvel v4.1.0 was discovered to contain a remote code execution RCE vulnerability via the component MVELRule...

CVE-2023-50571

easy-rules-mvel v4.1.0 was discovered to contain a remote code execution RCE vulnerability via the component MVELRule...

CVE-2023-50571

easy-rules-mvel v4.1.0 was discovered to contain a remote code execution RCE vulnerability via the component MVELRule...

PT-2023-31594 · Unknown · Easy-Rules-Mvel

Name of the Vulnerable Software and Affected Versions: easy-rules-mvel version 4.1.0 Description: The issue is related to a remote code execution RCE vulnerability via the component MVELRule. This allows for potential exploitation, but specific details about the estimated number of affected devic...

Easy Rules Security Vulnerability

Easy Rules is a Java rules engine from Jeasy open source. A security vulnerability exists in Easy Rules version v4.1.0, which originates from the ability to execute remote code via the component MVELRule...

CVE-2023-50571

easy-rules-mvel v4.1.0 was discovered to contain a remote code execution RCE vulnerability via the component MVELRule...

CVE-2023-50571: Undefined Security Weakness

easy-rules-mvel v4.1.0 was discovered to contain a remote code execution RCE vulnerability via the component MVELRule...

CVE-2023-50571

CVE-2023-50571 affects easy-rules-mvel v4.1.0, with a remote code execution (RCE) vulnerability exploitable via the MVELRule component. The available sources in the provided documents identify the affected software and the existence of RCE, but do not include concrete patch versions or remediatio...

Wordfence Intelligence Weekly WordPress Vulnerability Report (December 11, 2023 to December 17, 2023)

Wordfence just launched its bug bounty program. For the first 6 months, all awarded bounties receive a 10% bonus. View the announcement to learn more now! Last week, there were 16 vulnerabilities disclosed in 16 WordPress Plugins and no WordPress themes that have been added to the Wordfence...

How to construct "Deployment Rules' for the REST API request to add and update the Public APP Store

This document is to record an easier method to construct the field 'Deployment Rules' in the RESTAPI request to add and update the APP in the Public APP Store...

Wordfence Intelligence Weekly WordPress Vulnerability Report (December 4, 2023 to December 10, 2023)

Wordfence just launched its bug bounty program. Through December 20th 2023, all researchers will earn 6.25x our normal bounty rates when Wordfence handles responsible disclosure for our Holiday Bug Extravaganza! Register as a researcher and submit your vulnerabilities today! Last week, there were...

SUSE-SU-2023:4868-1 Security update for tracker-miners

This update for tracker-miners fixes the following issues: - CVE-2023-5557: Fixed a sandbox escape by adding seccomp rules and applying it to the whole process bsc1216199 - rebuild against current ICU 73...