CVE-2022-29442

Authenticated subscriber or higher user role Stored Cross-Site Scripting XSS vulnerability in Messages For WordPress = 2.1.10 at WordPress...

PT-2022-18106 · Dell · Dell Openmanage Enterprise

Name of the Vulnerable Software and Affected Versions: Dell OpenManage Enterprise versions 3.8.3 and prior Description: The issue is related to an improper authorization vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to bypass...

GHSA-VCR8-H8QP-QJ8H Cross-Site Request Forgery in Jenkins

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user...

Chicago students lose data to ransomware attackers

Chicago Public Schools CPS disclosed on Friday that students may have had their data taken in a ransomware incident involving one of its vendors. The ransomware attack happened last December at Battelle for Kids BfK, based in Columbus Ohio, which develops services to provide innovation in schools...

New User Email Set Up <= 0.5.2 - Arbitrary Settings Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack document.getElementById"test".submit;...

ROS-20220518-02

A vulnerability in Mozilla Thunderbird email client is related to incorrect processing of user input data when processing signed and encrypted attached messages. user input when processing signed and encrypted attached messages. Exploitation exploitation of the vulnerability could allow a remote...

Huawei Emui and Magic UI third-party pop-up overlay vulnerability

Huawei Emui is a mobile operating system developed on Android. magic Ui is a mobile operating system developed on Android. Huawei Emui and Magic UI third-party pop-up override vulnerability can be exploited by attackers to cause system pop-ups to be overridden, thereby misleading users into...

GHSA-GH85-MQ87-R7V3 Jenkins GitHub Plugin server-side request forgery vulnerability exists

A server-side request forgery vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubPluginConfig.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL...

CVE-2021-46788

Third-party pop-up window coverage vulnerability in the iConnect module.Successful exploitation of this vulnerability may cause system pop-up window may be covered to mislead users to perform incorrect operations...

CVE-2021-46788

Third-party pop-up window coverage vulnerability in the iConnect module.Successful exploitation of this vulnerability may cause system pop-up window may be covered to mislead users to perform incorrect operations...

CVE-2021-46788

Third-party pop-up window coverage vulnerability in the iConnect module.Successful exploitation of this vulnerability may cause system pop-up window may be covered to mislead users to perform incorrect operations...

Privilege escalation

Third-party pop-up window coverage vulnerability in the iConnect module.Successful exploitation of this vulnerability may cause system pop-up window may be covered to mislead users to perform incorrect operations...

CVE-2021-46788

CVE-2021-46788 is documented as a Huawei EMUI/Magic UI vulnerability affecting the iConnect module where third-party pop-up overlays can be overridden, potentially misleading users into performing incorrect actions. Connected records identify Huawei EMUI and Magic UI as affected on Android platfo...

GHSA-9HG2-395J-83RM Expected Behavior Violation in Apache Tomcat

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in t...

Apache Tomcat 8.5.x < 8.5.76 Request Mix-Up

The version of Apache Tomcat installed on the remote host is 8.5.0 to 8.5.75 or 9.0.0.M1 to 9.0.20. It is, therefore, affected by a request mix-up vulnerability. If a web application sends a WebSocket message concurrently with the WebSocket connection closing, it is possible that the application...

Apache Tomcat 9.0.0.M1 < 9.0.21 Request Mix-Up

The version of Apache Tomcat installed on the remote host is 8.5.0 to 8.5.75 or 9.0.0.M1 to 9.0.20. It is, therefore, affected by a request mix-up vulnerability. If a web application sends a WebSocket message concurrently with the WebSocket connection closing, it is possible that the application...

Apache Tomcat Request Mix-up Vulnerability (May 2022) - Windows

Apache Tomcat is prone to a request mix-up vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

HUAWEI EMUI/Magic UI 安全漏洞

Huawei Emui is a mobile operating system developed on Android. magic Ui is a mobile operating system developed on Android. Huawei Emui and Magic UI third-party pop-up override vulnerability can be exploited by attackers to cause system pop-ups to be overridden, thereby misleading users into...

VulnCheck KEV: CVE-2021-31805

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %... syntax. Using forced OGNL evaluation on untrusted user input can lead...

CVE-2022-1463

The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the bookingflextimeline shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above to call arbitrary PHP objects on a vulnerable site...