Movable Type XMLRPC API vulnerable to command injection

Overview Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability CWE-74. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. According...

Multiple vulnerabilities in PukiWiki

Overview PukiWiki provided by PukiWiki Development Team contains multiple vulnerabilities listed below. Path Traversal CWE-22 - CVE-2022-34486 Reflected Cross-site Scripting CWE-79 - CVE-2022-27637 Harold Kim reported these vulnerabilities to the developer and coordinated. After coordination was...

JVN#43979089: PukiWiki vulnerable to cross-site scripting

PukiWiki provided by PukiWiki Developers Team contains a stored cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who accessed the site using the product. Solution Update the Software Update the Software to the latest version...

PT-2022-19754 · Unknown · Notrinos/Notrinoserp

Name of the Vulnerable Software and Affected Versions: notrinos/notrinoserp versions prior to 0.7 Description: The issue is related to improper restriction of rendered UI layers or frames. Recommendations: For versions prior to 0.7, update to version 0.7 or later to resolve the issue...

PT-2022-23348 · Unknown · Wordplus Better Messages

Name of the Vulnerable Software and Affected Versions: WordPlus Better Messages plugin versions = 1.9.9.148 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a w...

PT-2022-4454 · Unknown · Workstation

Name of the Vulnerable Software and Affected Versions: WorkstationST versions prior to 07.09.15 Description: A reflected cross-site scripting XSS vulnerability exists in the iHistorian Data Display of WorkstationST, which could allow an attacker to compromise a victim's browser. The vulnerability...

PT-2022-23318 · Akash Soni · As – Create Pinterest Pinboard Pages

Name of the Vulnerable Software and Affected Versions: Akash soni's AS – Create Pinterest Pinboard Pages plugin version 1.0 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This occurs when a subscriber or higher can change plugin...

PT-2022-23293 · Wpchill · Wpchill Gallery Photoblocks

Name of the Vulnerable Software and Affected Versions: WPChill Gallery PhotoBlocks plugin versions 1.2.6 and earlier Description: The issue is related to Cross-Site Request Forgery CSRF vulnerabilities. This means an attacker could potentially trick a user into performing unintended actions on a...

PT-2022-4413 · Measuresoft · Measuresoft Scadapro Server

Name of the Vulnerable Software and Affected Versions: Measuresoft ScadaPro Server versions prior to 6.8.0.1 Description: The issue is related to an out-of-bounds write condition in the Measuresoft ScadaPro Server, potentially allowing an attacker to execute arbitrary code in the target system by...

PT-2022-17381 · WordPress · Simple Job Board

Name of the Vulnerable Software and Affected Versions: The Simple Job Board WordPress plugin versions prior to 2.10.0 Description: The issue allows for Directory Listing, which enables the public listing of uploaded resumes in certain configurations. Recommendations: For versions prior to 2.10.0,...

PT-2022-19634 · Wwbn · Avideo

Name of the Vulnerable Software and Affected Versions: WWBN AVideo versions 11.6 Description: A cross-site request forgery CSRF issue exists, allowing a specially-crafted HTTP request to lead to increased privileges. An attacker can exploit this by getting an authenticated user to send a crafted...

PT-2022-15978 · Intel · Intel Data Center Manager Sdk

Name of the Vulnerable Software and Affected Versions: IntelR Data Center Manager versions prior to 4.1 Description: The issue is related to improper input validation, which may allow an authenticated user to potentially enable denial of service via local access. Recommendations: For versions pri...

PT-2022-17619 · Intel · Intel Edge Insights For Industrial

Name of the Vulnerable Software and Affected Versions: IntelR Edge Insights for Industrial versions prior to 2.6.1 Description: The issue is related to improper access control, which may allow an authenticated user to potentially enable escalation of privilege via local access. Recommendations: F...

Citrix Endpoint Management (aka XenMobile Server) 10.14.0 Rolling Patch 7

Package name: xms10.14.0.10742.bin For: XenMobile Server 10.14.0 Deployment type: On-premises only Replaces: xms10.14.0.10628.bin,xms10.14.0.10521.bin, xms10.14.0.10424.bin, xms10.14.0.10303.bin, xms10.14.0.10206.bin, and xms10.14.0.10118.bin. Date: August 2022 Languages supported: English US...

Cisco Secure Web Appliance Privilege Escalation Vulnerability

A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance, formerly Cisco Web Security Appliance WSA, could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root. This vulnerability is due to insufficient...

SUSE-SU-2022:2820-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: - Update to version 2.36.5 bsc1201980: - Add support for PAC proxy in the WebDriver implementation. - Fix video playback when loaded through custom URIs, this fixes video playback in the Yelp documentation browser. - Fix...

PT-2022-23302 · Airspeed +1 · Airspeed +1

Name of the Vulnerable Software and Affected Versions: AirVelocity 1500 versions prior to 15.18.00.2511 Other AirVelocity and AirSpeed models affected versions not specified Description: The issue concerns the printing of SNMP credentials on the physically accessible serial port during boot. This...

PT-2022-16263 · WordPress · Easy Student Results

Name of the Vulnerable Software and Affected Versions: Easy Student Results WordPress plugin versions 2.2.8 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in...

PT-2022-15878 · WordPress · Vr Calendar

Name of the Vulnerable Software and Affected Versions: VR Calendar WordPress plugin versions prior to 2.3.3 Description: The issue allows any user to execute arbitrary PHP functions on the site. This can lead to unauthorized access and potential code execution. Recommendations: For versions prior...

PT-2022-8644 · Zoho · Manageengine Analytics Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Analytics Plus versions prior to 4350 Description: A Directory Traversal issue exists due to the ZDBQAREFSUBDIR parameter in the "/zropusermgmt" API endpoint. This allows remote attackers to potentially run arbitrary code...