12585 matches found
Upgrade OpenSearch to 1.3.7 to mitigate CVE-2022-42889
In BSERV-13534 commons-text usages were upgraded in the Bitbucket Webapp to mitigate against CVE-2022-42889 although Bitbucket WebApp was actually unaffected. The bundled OpenSearch should also be updated to 1.3.7 when it is released. The release date is currently scheduled for 13-Dec-2022:...
PT-2022-21878 · Fortinet · Fortiadc
Name of the Vulnerable Software and Affected Versions: Fortinet FortiADC versions 6.2.4 and below Fortinet FortiADC versions 7.0.0 through 7.0.2 Fortinet FortiADC version 7.1.0 Description: An improper neutralization of special elements used in an SQL Command 'SQL Injection' vulnerability allows ...
PT-2022-27656 · WordPress · Contest Gallery
Name of the Vulnerable Software and Affected Versions: Contest Gallery plugin versions = 13.1.0.9 Description: The issue is related to an Unauth. Stored Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be stored on the website, potentially affecting user sessions...
PT-2022-27466 · Kwoksys · Kwok Information Server
Name of the Vulnerable Software and Affected Versions: Kwoksys Kwok Information Server versions prior to 2.9.5.SP31 Description: An XML external entity XXE injection issue allows remote authenticated users to conduct server-side request forgery SSRF attacks. This enables attackers to manipulate t...
PT-2022-25284 · Xylus Themes · Xylus Themes Wp Smart Import
Name of the Vulnerable Software and Affected Versions: Xylus Themes WP Smart Import plugin versions 1.0.2 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability affects the Xylus Themes WP Smart Import plugin on WordPress,...
CVE-2022-46169 Unauthenticated Command Injection
Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data...
PT-2022-27862 · Veritas · Veritas Netbackup Access Appliance +1
Name of the Vulnerable Software and Affected Versions: Veritas NetBackup Flex Scale versions 1.0 through 3.0 Veritas NetBackup Access Appliance versions 1.0 through 8.0.100 Description: An issue was discovered that allows authenticated remote command execution via the management portal...
PT-2022-25644 · WordPress · 2Kb Amazon Affiliates Store Plugin
Name of the Vulnerable Software and Affected Versions: 2kb Amazon Affiliates Store plugin versions =2.1.5 Description: The issue is a Reflected Cross-Site Scripting XSS vulnerability. This means an attacker can inject malicious scripts into a website, potentially stealing user data or taking...
ConnectWise Quietly Patches Flaw That Helps Phishers
ConnectWise, which offers a self-hosted, remote desktop software application that is widely used by Managed Service Providers MSPs, is warning about an unusually sophisticated phishing attack that can let attackers take remote control over user systems when recipients click the included link. The...
PT-2022-19784 · Delta Industrial Automation · Dialink
Name of the Vulnerable Software and Affected Versions: Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 Description: The issue arises from the software's failure to properly neutralize special elements within a pathname constructed from external input. This pathname is intend...
PT-2022-24151 · Aruba · Aruba Edgeconnect Enterprise
Name of the Vulnerable Software and Affected Versions: Aruba EdgeConnect Enterprise versions 9.2.1.0 and below Aruba EdgeConnect Enterprise versions 9.1.3.0 and below Aruba EdgeConnect Enterprise versions 9.0.7.0 and below Aruba EdgeConnect Enterprise versions 8.3.7.1 and below Description: A...
PT-2022-26957 · Aruba · Aruba Edgeconnect Enterprise
Name of the Vulnerable Software and Affected Versions: Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.2.1.1 Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.1.3.1 Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.0.7.1 Aruba EdgeConnect Enterprise Softwa...
PT-2022-8170 · Digital Alert Systems · Dasdec
Name of the Vulnerable Software and Affected Versions: Digital Alert Systems' DASDEC software versions prior to 4.1 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the SSH username, username field of the login page, or via the HTTP host header. The inject...
Intel® AMT SDK, Intel® EMA and Intel® MC Advisory
Summary: A potential security vulnerability in the Intel® Active Management Technology AMT SDK, Intel® Endpoint Management Assistant EMA and Intel® Manageability Commander MC may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability...
PT-2022-24152 · Aruba · Aruba Edgeconnect Enterprise
Name of the Vulnerable Software and Affected Versions: Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.2.1.0 Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.1.3.0 Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.0.7.0 Aruba EdgeConnect Enterprise Softwa...
PT-2022-25943 · Line · Line Client For Ios
Name of the Vulnerable Software and Affected Versions: LINE client for iOS versions prior to 12.17.0 Description: The issue is related to the LINE client for iOS, where sharing an invalid shared key of end-to-end encryption e2ee in a group chat might cause the application to crash. Recommendation...
PT-2022-5972 · 3S Smart Software Solutions · Codesys Development System V3
Name of the Vulnerable Software and Affected Versions: CODESYS Development System V3 versions prior to V3.5.18.40 Description: The issue is related to inadequate encryption strength, allowing an unauthenticated local attacker to access and manipulate the code of the encrypted boot application. It...
CVE-2022-41965 Opencast Authenticated OpenRedirect Vulnerability
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to...