CVE-2022-41906 OpenSearch Notifications is vulnerable to Server-Side Request Forgery (SSRF)

OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-hook etc channels. A potential SSRF issue in OpenSearch Notifications Plugin starting in 2.0.0 and prior to 2.2.1 could allow an existing...

GHSA-398J-F7M7-795J PHPMailer vulnerable to email header injection

Impact Arbitrary additional email headers can be injected via crafted From or Sender headers. Patches Fixed in 2.2.1 Workarounds Filter user-supplied values prior to using them in From or Sender properties. References https://nvd.nist.gov/vuln/detail/CVE-2012-0796 For more information If you have...

CVE-2022-2371

The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users with a role as low as subscriber to change them, and use that to conduct Stored Cross-Site Scripting attack due to the lack of escaping in them as well...

WordPress plugin YaySMTP 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2022-24660

The debug interface of Goldshell ASIC Miners v2.2.1 and below was discovered to be exposed publicly on the web interface, allowing attackers to access passwords and other sensitive information in plaintext...

Goldshell ASIC Miners 路径遍历漏洞

Goldshell ASIC Miners is a mining host from Goldshell China. A security vulnerability exists in Goldshell ASIC Miners v2.2.1 and below, which stems from the discovery of a contained path traversal vulnerability that allows an unauthenticated attacker to retrieve arbitrary files from the device...

YaySMTP < 2.2.1 - Subscriber+ SMTP Credentials Leak

The plugin does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them PoC Install the plugin and configure any mailer other than Default. Access the wp-admin area with a Subscriber+ use...

Apache SystemDS Denial of Service Vulnerability

A denial of service vulnerability exists in Apache SystemDS version 2.2.1 and earlier, which stems from the fact that the termination condition of the for loop in the readExternal method is a controlled variable. An attacker could use this vulnerability to tamper with the traversal to cause CPU...

GHSA-M43H-HFRQ-X8WX SystemDS CPU exhaustion vulnerability

The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and write logic. We classify it as a...

CVE-2022-26477

The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and write logic. We classify it as a...

Apache SystemDS 资源管理错误漏洞

A denial of service vulnerability exists in Apache SystemDS version 2.2.1 and earlier, which stems from the fact that the termination condition of the for loop in the readExternal method is a controlled variable. An attacker could use this vulnerability to tamper with the traversal to cause CPU...

CVE-2021-35531

Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with access to an authorized user with ADMIN or ENGINEER role rights to inject an OS command that is executed by the system. This issue affects:...

CVE-2021-35531 Remote Code Execution in TXpert Hub CoreTec 4

Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with access to an authorized user with ADMIN or ENGINEER role rights to inject an OS command that is executed by the system. This issue affects:...

WordPress WP 2FA plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress WP 2FA plugin version 2.2.1 before version 2.2.1 has a cross-site scripting vulnerability...

Mysiteforme 代码问题漏洞

Mysiteforme is a privilege management system. A security vulnerability exists in Mysiteforme version v2.2.1, which can be exploited by an attacker to spoof requests to the server side...

WordPress WP 2FA plugin <= 2.2.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Utkarsh Agrawal in WordPress WP 2FA plugin versions = 2.2.0. Solution Update the WordPress WP 2FA plugin to the latest available version at least 2.2.1...

Bottelet Daybyday Crm 跨站脚本漏洞

Bottelet Daybyday Crm is a builder system for task, time, employee, and vacation management by Bottelet Individual Developers. Bottelet DayByDay CRM suffers from a cross-site scripting vulnerability that stems from an application-wide Client-Side Template Injection CSTI suffered in DayByDay CRM,...

Security Bulletin: Two security vulnerabilities have been identified in IBM HTTP Server shipped with IBM eDiscovery Manager (CVE-2015-1283, CVE-2015-3183)

Abstract Security Bulletin: Two security vulnerabilities have been identified in IBM HTTP Server shipped with IBM eDiscovery Manager CVE-2015-1283, CVE-2015-3183 Body IBM HTTP Server is shipped as a component of IBM eDiscovery Manager. Information about two security vulnerabilities that affect IB...

Hitachi Energy Relion 系列安全漏洞

Hitachi Energy Relion is a Swiss Hitachi Energy company used to protect, control, measure and monitor for power systems. A security vulnerability exists in the Hitachi Energy Relion Relion 670/650/SAM600-IO Series that allows an attacker to gain access to the front-end network port and cause a...

PT-2021-10650 · Muyucms · Muyucms

Name of the Vulnerable Software and Affected Versions: Myucms version 2.2.1 Description: The issue is related to a remote code execution RCE vulnerability in the controllerConfig.php component. This vulnerability can be exploited via the add method. Recommendations: For Myucms version 2.2.1,...