Release Information for Veeam Backup for Microsoft Azure v4

Requirements Please confirm that you are running Veeam Backup for Microsoft Azure v3 build 3.0.0.666 or later before upgrading. The currently installed build number Server Version is in the About section under Configuration | Support Information. After installing Veeam Backup for Microsoft Azure...

Security fix for the ALT Linux 9 package vim version 4:8.2.5019-alt1

4:8.2.5019-alt1 built June 2, 2022 Andrey Cherepanov in task 300894 --- May 26, 2022 Alexander Danilov - Updated to 8.2.5019 fixes CVE-2022-1735, CVE-2022-1769, CVE-2022-1733, CVE-2022-1674, CVE-2022-1629, CVE-2022-1621, CVE-2022-1620, CVE-2022-1619, CVE-2022-1616 ALT42859...

GHSA-H65R-8FP8-W7CX phpMyAdmin SQL Injection

In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php. A malicious user with access to the server could create a crafted username, and then...

GHSA-GG36-9346-9QX9 phpMyAdmin Remote Code Execution

phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTT...

CVE-2022-24858

next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already...

Updated php-smarty packages fix security vulnerability

Updated php-smarty packages to version 4 for php 8 compatibility and to fix security vulnerabilities...

CVE-2022-26846

SPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary code...

GHSA-9689-RX4V-CQGC Pivotal Concourse Open Redirect in Login Flow

Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to that user's access token in Concourse...

[SECURITY] Fedora 35 Update: php-symfony4-4.4.35-1.fc35

Symfony PHP framework version 4. NOTE: Does not require PHPUnit bridge...

Fortics sz.chat has an unspecified vulnerability

Fortics sz.chat is a messaging app from the Brazilian company Fortics. version 4 of Fortics sz.chat has a security vulnerability that could be exploited by attackers to inject web script and HTML into the message box...

Code injection

sz.chat version 4 allows injection of web scripts and HTML in the message box...

CVE-2021-3279

The CVE-2021-3279 entry concerns sz.chat v4, where the message box allows injection of web scripts and HTML. Connected sources (Red Hat, CNVD, CVE listings, CNNVD, PRION) confirm the affected product and issue but do not provide a detailed root cause, exploited vectors, or a remediation. The vuln...

CVE-2021-34190

A stored cross site scripting XSS vulnerability in index.php?menu=billingrates of Issabel PBX version 4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Name" or "Prefix" fields under the "Create New Rate" module...

Cross-site Scripting (XSS) - Stored in bigprof-software/online-rental-property-manager

💥 BUG Stored xss via signup page 💥 VERSION TESTED latest version as of 4/7/21 💥 IMPACT xss allow to execute arbitary javascript in vicitm account 💥 STEP TO REPRODUCE 1. goto http://localhost/online-rental/app/admin/pageSettings.php and click on Sign Up tab . Here allow signup.\ now put bellow xss...

[SECURITY] Fedora 34 Update: php-symfony4-4.4.24-1.fc34

Symfony PHP framework version 4. NOTE: Does not require PHPUnit bridge...

[SECURITY] Fedora 33 Update: php-symfony4-4.4.24-1.fc33

Symfony PHP framework version 4. NOTE: Does not require PHPUnit bridge...

OTRS 6.0.1 - Remote Command Execution (2)

Exploit Title: OTRS 6.0.1 - Remote Command Execution 2 Date: 21-04-2021 Exploit Author: Hex26 Vendor Homepage: https://www.otrs.com/ Software Link: http://ftp.otrs.org/pub/otrs/ Version: 4.0.1 - 4.0.26, 5.0.0 - 5.0.24, 6.0.0 - 6.0.1 Tested on: OTRS 5.0.2/CentOS 7.2.1511 CVE : CVE-2017-16921...

[SECURITY] Fedora 34 Update: gtk4-4.1.2-1.fc34

GTK is a multi-platform toolkit for creating graphical user interfaces. Offering a complete set of widgets, GTK is suitable for projects ranging from small one-off tools to complete application suites. This package contains version 4 of GTK...

Rails Sprockets 2.x < 2.12.5 / 3.x < 3.7.2 / 4.x < 4.0.0.beta8 Path Traversal

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is...

RHEL 7 : kernel-alt (RHSA-2020:2854)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2854 advisory. The kernel-alt packages provide the Linux kernel version 4.x. Security Fixes: kernel: nfs: use-after-free in svcprocesscommon CVE-2018-16884...