PT-2022-14209 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 15.0 through 15.0.1 Description: An issue has been discovered in GitLab where missing validation of input used in quick actions allowed an attacker to exploit XSS by injecting HTML in contact details. Recommendations: For GitL...

Dominion Voting Systems ImageCast X Authentication Bypass Vulnerability

Dominion Voting Systems ImageCast X is an intuitive and configurable face-to-face voting solution from Dominion Voting Systems.An authentication bypass vulnerability exists in Dominion Voting Systems ImageCast X, which could be exploited by an attacker to gain access to the device's management...

Introducing EDR for Linux: Remediating and isolating threats on Linux servers

We’re excited to announce our new EDR for Linux offering, which extends our advanced protection and response capabilities to Linux devices via Nebula and OneView. In this post, we show you what remediating and isolating threats on Linux servers looks like with Malwarebytes EDR for Linux. Let’s ge...

GitLab Enterprise Edition和GitLab Community Edition 跨站脚本漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A cross-site scripting vulnerability exists in GitLab Community Edition and...

MAL-2022-3918 Malicious code in inv-cyber-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e992b95056bfc349eb310e76c92712b6661c990d01d29e4e18f334d16f02a2e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Social Share Buttons by Supsystic < 2.2.4 - Multiple CSRF

The plugin does not perform CSRF checks in it's ajax endpoints and admin pages, allowing an attacker to trick any logged in user to manipulate or change the plugin settings, as well as create, delete and rename projects and networks. document.getElementById"test".submit;...

ROS-20220131-01

Vulnerability in the ptp4l service of the LinuxPTP precision time protocol PTP implementation software is caused by an operation exceeding buffer boundaries in memory. Exploitation of the vulnerability could allow an attacker, acting remotely, cause the application to crash as a result of creatin...

CVE-2022-22361

IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation Workflow containers V21.0.1 - V21.0.3 20.0.0.1 through 20.0.0.2, IBM Business Process Manager 8.6.0.0 through 8.6.0.201803,...

CVE-2022-22361

IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation Workflow containers V21.0.1 - V21.0.3 20.0.0.1 through 20.0.0.2, IBM Business Process Manager 8.6.0.0 through 8.6.0.201803,...

CVE-2022-1203

The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscriber could modify arbitrary blog optio...

Cross site request forgery (csrf)

The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscriber could modify arbitrary blog optio...

Admin Management Xtended < 2.4.5 - Multiple CSRF

The plugin does not have CSRF in various places and actions, allowing attackers to make a logged in users perform unauthorised actions on their behalf via CSRF attacks...

CVE-2022-22361

IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation Workflow containers V21.0.1 - V21.0.3 20.0.0.1 through 20.0.0.2, IBM Business Process Manager 8.6.0.0 through 8.6.0.201803,...

CVE-2022-22663

CVE-2022-22663: A vulnerability where a malicious application may bypass Gatekeeper checks is addressed in certain Apple updates. The description notes that improved checks prevent unauthorized actions and that fixes are included in iOS 15.4, iPadOS 15.4, Security Update 2022-004 for Catalina, ma...

CVE-2022-26857

Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to bypass blocked functionalities and perform unauthorized actions...

Authorization

Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to bypass blocked functionalities and perform unauthorized actions...

CVE-2022-26857

Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to bypass blocked functionalities and perform unauthorized actions...

CVE-2022-26857

CVE-2022-26857 affects Dell OpenManage Enterprise, exposing an improper authorization vulnerability in versions 3.8.3 and earlier. A remote attacker with low, authenticated privileges could bypass blocked functionalities and perform unauthorized actions. Connected sources document the issue consi...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource due to the modification of contents in the intermediate build folder by default obj. An attacker can alter the contents of this folder by authenticating and exploiting the...

Complete lack of CSRF protection in Jenkins Selenium Plugin can lead to OS command injection

Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints. This allows attackers to perform the following actions: - Restart the Selenium Grid hub. - Delete or replace the plugin configuration. - Start, stop, or restart Selenium configurations on specific nodes. Through...