CVE-2022-1551 SP Project & Document Manager < 4.58 - Sensitive File Disclosure

The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files...

CVE-2022-1551

CVE-2022-1551 affects the SP Project & Document Manager WordPress plugin prior to version 4.58. The issue stems from an easily guessable path used to store user files, enabling a user to access other users’ sensitive files. Exploitation details in connected documents include a PoC demonstrating a...

CVE-2022-1551: Direct Request

The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files...

Malicious code in sp-test-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0747fa45a6337d47013511fb9ca8dc324f8023f4b8a0c8ccd0b5a9a7801bed6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6225 Malicious code in sp-test-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0747fa45a6337d47013511fb9ca8dc324f8023f4b8a0c8ccd0b5a9a7801bed6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sp-messaging-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f04c7112192b8f05201e25876a21a254bf15d23cc05565b041a89956b5839a66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6224 Malicious code in sp-messaging-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f04c7112192b8f05201e25876a21a254bf15d23cc05565b041a89956b5839a66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sp-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12ea0ed6eb9e952555479abaffce89b9ec1fabf26dab71f7e5fff8cf1b0ed57a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6223 Malicious code in sp-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12ea0ed6eb9e952555479abaffce89b9ec1fabf26dab71f7e5fff8cf1b0ed57a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-26493

Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker with access to a HTTP-request intercepting method is able to bypass authentication and authorization by removing the SAML Assertion Signatur...

CVE-2022-26493 miniOrange SAML Authentication Bypass

Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker with access to a HTTP-request intercepting method is able to bypass authentication and authorization by removing the SAML Assertion Signatur...

CVE-2022-26493

CVE-2022-26493 affects Xecurify’s miniOrange Drupal SAML SP modules (Premium, Standard, Enterprise) for Drupal 7, 8, and 9. The root cause is an authentication/authorization bypass via removing the SAML Assertion Signature, allowing an attacker who can intercept HTTP requests to impersonate exist...

CVE-2022-26493

Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker with access to a HTTP-request intercepting method is able to bypass authentication and authorization by removing the SAML Assertion Signatur...

CVE-2022-26493: Improper Certificate Validation

Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker with access to a HTTP-request intercepting method is able to bypass authentication and authorization by removing the SAML Assertion Signatur...

PT-2022-17899

Name of the Vulnerable Software and Affected Versions miniOrange Drupal SAML SP modules versions prior to the most recent versions Drupal SAML SP 2.0 Single Sign On SSO - SAML Service Provider 8.x versions 8.x-2.24 and prior Drupal SAML SP 2.0 Single Sign On SSO - SAML Service Provider 7.x versio...

GHSA-PMJ6-9F8C-8G2M Saltstack Salt Unauthenticated Arbitrary Code Execution

A Incorrect Implementation of Authentication Algorithm vulnerability in of SUSE SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE SUSE Linux Enterprise Server ...

taciba.sp.gov.br Cross Site Scripting vulnerability OBB-2624753

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

sistemas.procon.sp.gov.br Cross Site Scripting vulnerability OBB-2621288

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PicketLink does not properly check role based authorization

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.7.1.Final does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a 1 direct request or 2...

GHSA-9QHQ-J4XM-CW48 PicketLink does not properly check role based authorization

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.7.1.Final does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a 1 direct request or 2...