IBM Security Verify Information Queue Cross-Site Request Forgery Vulnerability (CNVD-2022-54907)

IBM Security Verify Information Queue is an integration product from IBM USA. It utilizes Kafka technology and a publish/subscribe model to integrate data between IBM Security products. A cross-site request forgery vulnerability exists in IBM Security Verify Information Queue version 10.0.2, whic...

IBM Security Verify Information Queue Cross-Site Request Forgery Vulnerability (CNVD-2022-55633)

IBM Security Verify Information Queue is an integration product from IBM of America, Inc. IBM Security Verify Information Queue version 10.0.2 contains a cross-site request forgery vulnerability that originates when a WEB application does not adequately verify that a request is from a trusted use...

SonicWall urges customers to patch critical SQL injection bug ASAP

Cybersecurity hardware company, SonicWall, recently released a public security notice about a critical SQL injection flaw affecting its GMS Global Management System and Analytics On-Prem products. The flaw, which is tracked as CVE-2022-22280, is given a 9.4 critical rating. With the high capabili...

Imperva Earns Three Cyber Defense Global InfoSec Awards for 2022

The Cyber Defense Awards in conjunction with Cyber Defense Magazine recently announced the winners of their prestigious annual Global Infosec Awards for 2022. We are proud to say that Imperva earned three Global Infosec Awards; as Most Innovative for Application Security, Cutting Edge for Cloud...

WordPress Sygnoos Popup Builder Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in WordPress Sygnoos Popup Builder 4.1.11 and prior versions, which arises from a web applicatio...

Fixed in Apache Tomcat 10.0.23

Low: Apache Tomcat XSS in examples web application CVE-2022-34305 The Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability. This was fixed with commit 1a7e95d9. This issue was reported to the Apache Tomcat Securit...

CVE-2021-40335

A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This cause a Cross Site Request Forgery CSRF, which if exploited could lead an attack...

CVE-2021-40335 Cross Site Request Forgery (CSRF) in Hitachi Energy’s MSM Product

A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This cause a Cross Site Request Forgery CSRF, which if exploited could lead an attack...

Fedora: Security Advisory for python-notebook (FEDORA-2022-35b698150c)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for python-notebook (FEDORA-2022-85aa8e5706)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: python-notebook-6.4.0-4.fc35

The Jupyter Notebook is a web application that allows you to create and share documents that contain live code, equations, visualizations, and explanatory text. The Notebook has support for multiple programming languages, sharing, and interactive widgets...

[SECURITY] Fedora 36 Update: python-notebook-6.4.11-3.fc36

The Jupyter Notebook is a web application that allows you to create and share documents that contain live code, equations, visualizations, and explanatory text. The Notebook has support for multiple programming languages, sharing, and interactive widgets...

UBUNTU-CVE-2022-2255

A vulnerability was found in modwsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing...

The vulnerability of the iControl REST API interface for access control and remote authentication, the BIG-IP Access Policy Manager, the virtual server for application protection, the BIG-IP Advanced Web Application Firewall, the BIG-IP Advanced Firewall Manager, the infrastructure status analysis tool, the BIG-IP Application Acceleration Manager, the DDoS protection module, the BIG-IP Fraud Protection Service, the Internet traffic balancing system, the BIG-IP Link Controller, and the local traffic balancing system – all of these allow a perpetrator to cause service interruptions.

The vulnerabilities of the iControl REST API interface for access control and remote authentication, the BIG-IP Access Policy Manager, the virtual server for application protection, the BIG-IP Advanced Web Application Firewall, the BIG-IP Advanced Firewall Manager, the infrastructure status...

Johnson Controls Metasys ADS/ADX/OAS Servers 访问控制错误漏洞

Johnson Controls Metasys ADS/ADX/OAS Servers is an application and data server from Johnson Controls, Inc. An access control error vulnerability exists in Johnson Controls Metasys ADS/ADX/OAS versions 10 and 11, which stems from the fact that under certain circumstances, an unauthenticated user c...

IBM Sterling Partner Engagement Manager Cross-Site Request Forgery Vulnerability

IBM Sterling Partner Engagement Manager is an automation management tool from IBM U.S.A. A cross-site request forgery vulnerability exists in IBM Sterling Partner Engagement Manager, which stems from a WEB application that does not adequately validate that the request is from a trusted user. An...

Fixed in Apache Tomcat 9.0.65

Low: Apache Tomcat XSS in examples web application CVE-2022-34305 The Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability. This was fixed with commit 8b60af90. This issue was reported to the Apache Tomcat Securit...

Fixed in Apache Tomcat 10.1.0-M17

Low: Apache Tomcat XSS in examples web application CVE-2022-34305 The Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability. This was fixed with commit d6251d1c. This issue was reported to the Apache Tomcat Securit...

Multiple Imperva Products Earn 2022 Fortress Cyber Security Awards

In June, the Business Intelligence Group announced that three Imperva products have earned the 2022 Fortress Cyber Security Awards. The mission of this prestigious award program is to identify and reward leading companies and products globally that are successfully keeping data and electronic...

Oracle Fusion Middleware 输入验证错误漏洞

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle USA. The platform provides middleware, software collections, and other capabilities. An input validation error vulnerability exists in Oracle Fusion...