CVE-2022-30459: Improper Neutralization of Special Elements used in an SQL Command

ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to SQL Injection via /simplechatbot/classes/Master.php?f=deleteresponse, id...

PT-2022-2676

Name of the Vulnerable Software and Affected Versions GOST engine versions prior to 3.0.1 Description The issue is related to a buffer overflow vulnerability in the GOST engine, a reference implementation of the Russian GOST crypto algorithms for OpenSSL. This occurs when the ciphersuite TLS...

PT-2022-20155

Name of the Vulnerable Software and Affected Versions ChatBot Application with a Suggestion Feature version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/simple chat bot/admin/responses/view response.php" A...

GHSA-5PMP-7WC9-V7VW Cross-site Scripting in Jenkins JDK Parameter Plugin

Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters. This results in stored cross-site scripting XSS vulnerabilities exploitable by attackers with Item/Configure permission. Exploitation of this vulnerability...

Cross-site Scripting in Jenkins JDK Parameter Plugin

Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters. This results in stored cross-site scripting XSS vulnerabilities exploitable by attackers with Item/Configure permission. Exploitation of this vulnerability...

Oracle Linux 8 : libreoffice (ELSA-2022-1766)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1766 advisory. - Resolves: rhbz2013858 CVE-2021-25633 - Resolves: rhbz2014215 CVE-2021-25634 - Resolves: rhbz2014209 CVE-2021-25635 Tenable has extracted the precedin...

PT-2022-20424 · Jenkins · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins vboxwrapper Plugin versions 1.3 and earlier Description: The Jenkins vboxwrapper Plugin does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripting XSS...

[SECURITY] Fedora 35 Update: clamav-0.103.6-1.fc35

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

NodeSecurityShield - A Developer And Security Engineer Friendly Package For Securing NodeJS Applications

A Developer and Security Engineer friendly package for Securing NodeJS Applications. Inspired by the log4J vulnerability CVE-2021-44228 which can be exploited because an application can make arbitrary network calls. We felt there is an need for an application to declare what privileges it can hav...

Cross-site Scripting (XSS)

Overview katello is a package that adds Content and Subscription Management to Foreman Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Subscriptions component, due to insufficient organization name sanitization in SelectOrg/SetOrganization.js and...

com.nirima:docker-plugin (>=0.3.4, <=0.7), org.jenkins-ci.main:jenkins-test-harness (1.557) +9 more potentially affected by CVE-2018-1999047 via org.jenkins-ci.main:jenkins-core (1.557)

org.jenkins-ci.main:jenkins-core MAVEN version 1.557 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.nirima:docker-plugin =0.3.4, =1.8.3, =1.2, =1.0, =0.4.5, =0.4.6 Source cves: CVE-2018-19990...

PT-2022-20116

Name of the Vulnerable Software and Affected Versions Hospital Management System in PHP with Source Code HMS version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the editid parameter in the "room.php" file. Recommendations For...

CVE-2022-30448: Unrestricted Upload of File with Dangerous Type

Hospital Management System in PHP with Source Code HMS 1.0 was discovered to contain a File upload vulnerability in treatmentrecord.php...

PT-2022-20115

Name of the Vulnerable Software and Affected Versions Hospital Management System in PHP with Source Code HMS version 1.0 Description The issue is related to a File upload vulnerability found in the treatmentrecord.php file. This vulnerability could potentially allow unauthorized file uploads...

CVE-2022-30449: Improper Neutralization of Special Elements used in an SQL Command

Hospital Management System in PHP with Source Code HMS 1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in room.php...

CVE-2022-29161

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate signatures, due to the risk of collision...

PT-2022-36978

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. The crash state...

This Week in Spring - May 3rd, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! How are you doin? Im excited! This week Im speaking at the ArabJUG, and Ill be speaking at Microsofts huuuge JDConf event. Both of these are virtual. Then, next Monday, Im on a plane bound for London, UK, where Ill be speakin...

CVE-2022-24897

APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem...

CVE-2022-24897: Improper Limitation of a Pathname to a Restricted Directory

APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem...