CVE-2022-22958: Deserialization of Untrusted Data

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities CVE-2022-22957 & CVE-2022-22958. A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote...

CVE-2022-22959: Cross-Site Request Forgery (CSRF)

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user through a cross site request forgery to unintentionally validate a malicious JDBC URI...

CVE-2022-22957: Deserialization of Untrusted Data

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities CVE-2022-22957 & CVE-2022-22958. A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote...

Exploit for Code Injection in Vmware Identity_Manager

CVE-2022-22954 This package detects a subset of CVE-2022-229...

log4j-core: remote code execution via JDBC Appender

Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a dat...

log4j-core: remote code execution via JDBC Appender

Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a dat...

CVE-2022-26180

qdPM 9.2 allows Cross-Site Request Forgery CSRF via the index.php/myAccount/update URI...

CVE-2022-26180

qdPM 9.2 allows Cross-Site Request Forgery CSRF via the index.php/myAccount/update URI...

CVE-2022-26588

A Cross-Site Request Forgery CSRF in IceHrm 31.0.0.OS allows attackers to delete arbitrary users or achieve account takeover via the app/service.php URI...

CVE-2022-26180

The CVE-2022-26180 describes a CSRF vulnerability in qdPM 9.2 that can be exploited via the index.php/myAccount/update URI due to lack of CSRF token validation. Impact is high (C/H/I/A = High) with CVSS 3.1 base score 8.8; basic user interaction required (per the NVD entry). Exploitation details ...

CVE-2022-26180

qdPM 9.2 allows Cross-Site Request Forgery CSRF via the index.php/myAccount/update URI...

Cross-site Scripting (XSS)

uri.js is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization of \r CR, \n, LF \t TAB of the URI allowing an attacker to inject maliciously crafted script into the system...

PT-2022-2141

Name of the Vulnerable Software and Affected Versions VMware Workspace ONE Access affected versions not specified VMware Identity Manager affected versions not specified VMware vRealize Automation affected versions not specified Description The issue is related to a cross-site request forgery...

Schneider Electric SCADAPack Workbench isasln File Parsing XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Schneider Electric SCADAPack Workbench. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

CVE-2022-0901

The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUESTURI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters...

A week in security (March 28 – April 3)

Last week on Malwarebytes Labs: New UAC-0056 activity: There’s a Go Elephant in the room Globant suffers network breach due to LAPSUS$ compromise Update now! Apple patches two zero-day vulnerabilities that may have been actively exploited Hive ransomware impacts California non-profit health...

PT-2022-13514

Name of the Vulnerable Software and Affected Versions Ad Inserter Free and Pro WordPress plugins versions prior to 2.7.12 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the REQUEST URI is not properly sanitised and escaped before being outputted ba...

WordPress plugins: Ad Inserter (Free and Pro versions), cross-site scripting vulnerabilities

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress Ad Inserter Free and Pro plugin has a cross-site scripting vulnerability that stems from the fact that before the request U...

(0Day) Array Networks MotionPro Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Array Networks MotionPro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Command Injection

asciidoctor-include-ext is vulnerable to Command Injection. The library renders user-supplied input in AsciiDoc markup, which allows an attacker to execute arbitrary system commands on the host operating system when the allow-uri-read is disabled...