RHEL 8 : thunderbird (RHSA-2023:3155)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3155 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.11.0. Security Fixes: Mozilla...

AlmaLinux 9 : emacs (ALSA-2023:2626)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2626 advisory. - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the...

PostMessage Wildcard Event Listener Detected

Web applications relying on JavaScript often need to perform cross-origin communication between Window objects such as a page and an embedded iframe or a popup window. The postMessage API allows developers to circumvent the same-origin policy restrictions in order to exchange data between scripts...

Drupal 9.5.x < 9.5.8 Access Bypass Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server 7.x prior to 7.96, 9.4.x prior to 9.4.14, 9.5.x prior to 9.5.8 or 10.0.x prior to 10.0.8. The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in...

Fedora 37 : chromium (2023-8cc9731416)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-8cc9731416 advisory. update to 112.0.5615.121. Fixes the following security issues: CVE-2023-2004 CVE-2023-2133 CVE-2023-2134 CVE-2023-2135 CVE-2023-2136 CVE-2023-2137...

Customer Reviews for WooCommerce Plugin for WordPress < 5.17.0 Cross-Site Scripting

The WordPress Customer Reviews for WooCommerce Plugin installed on the remote host is affected by a cross-site scripting vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

Stream Plugin for WordPress < 3.9.2 Broken Access Control

The WordPress Stream Plugin installed on the remote host is affected by a broken access control vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

Enable Media Replace Plugin for WordPress < 4.0.2 Arbitrary File Upload

The WordPress Enable Media Replace Plugin installed on the remote host is affected by a arbitrary file upload vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

RHEL 8 : pki-core:10.6 (RHSA-2023:1747)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1747 advisory. The Public Key Infrastructure PKI Core contains fundamental packages required by Red Hat Certificate System. Security Fixes: pki-core: access to...

Siemens SCALANCE W1750D Command Injection (CVE-2021-25150)

A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x: 8.6.0.4 and below. Aru...

Siemens SCALANCE W1750D Command Injection (CVE-2021-25146)

A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x: 8.6.0.5 and below; Aru...

Siemens SCALANCE W1750D Improper Limitation of a Pathname to a Restricted Directory (CVE-2021-37734)

A remote unauthorized read access to files vulnerability was discovered in Aruba Instant versions: 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.19 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 a...

Siemens SCALANCE W1750D Improper Neutralization of Input During Web Page Generation (CVE-2022-37892)

A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a...

Siemens SCALANCE XCM332 Allocation of Resources Without Limits or Throttling (CVE-2022-32206)

curl 7.84.0 supports chained HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable links in this decompression chain was unbounded, allowing a malicious server to insert a virtually unlimited...

Siemens SCALANCE W1750D Improper Input Validation (CVE-2021-25157)

A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba...

SPIP CMS 4.0.x < 4.0.5 Multiples Vulnerabilities

According to its self-reported version, the instance of SPIP CMS running on the remote web server is prior to 3.2.14 or 4.0.x prior to 4.0.5. It is, therefore, affected by multiples vulnerabilities : - A Remote Code Execution - Unauthenticated access to information about editorial objects. Note...

ManageEngine OpManager 12.6.x < 12.6.141 / 12.6.154 / 12.6.169 XML External Entity

The version of ManageEngine OpManager running on the remote web server is 12.6.x prior to 12.6.141 / 12.6.154 / 12.6.169. It is, there, affected by an XML external entity vulnerability. A blind XML External Entity XXE vulnerability exists in the Add UCS Device functionality. A specially crafted X...

SPIP CMS 4.0.x < 4.0.8 Remote Code Execution

According to its self-reported version, the instance of SPIP CMS running on the remote web server is prior to 3.2.16 or 4.0.x prior to 4.0.8 or 4.1.X prior to 4.1.5. It is, therefore, affected by an Remote Code Execution via the oups parameter. Note that the scanner has not tested for these issue...

Apache Tomcat 9.0.0-M1 < 9.0.72 Information Disclosure

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.86, 9.0.0-M1 prior to 9.0.72, 10.1.0-M1 prior to 10.1.6 or 11.0.0-M1 prior to 11.0.0-M3. It is, therefore, affected by an information disclosure due to the RemoteIpFilter. Note that the scanner has not attempted to...

OpenSSL 3.1.0 < 3.1.1 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.1.1 advisory. - Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary:...