Shopware 代码问题漏洞

Shopware is a German Shopware company's open source e-commerce software. A code issue vulnerability exists in Shopware that stems from the fact that in the affected version, a user session is not logged off if the password is reset via password recovery. An attacker could exploit the vulnerabilit...

GHSA-W749-P3V6-HCCQ Possible code injection vulnerability in Rails / Active Storage

The Active Storage module of Rails starting with version 5.2.0 is possibly vulnerable to code injection. This issue was patched in versions 5.2.6.3, 6.0.4.7, 6.1.4.7, and 7.0.2.3. To work around this issue, applications should implement a strict allow-list on accepted transformation methods or...

Possible code injection vulnerability in Rails / Active Storage

The Active Storage module of Rails starting with version 5.2.0 is possibly vulnerable to code injection. This issue was patched in versions 5.2.6.3, 6.0.4.7, 6.1.4.7, and 7.0.2.3. To work around this issue, applications should implement a strict allow-list on accepted transformation methods or...

CVE-2022-25828

The CVE-2022-25828 entry affects Samsung Watch Active Plugin (Watch Active Plugin) versions prior to 2.2.07.22012751. It exposes password information of a connected WiFiAp via logs due to an information disclosure vulnerability. No exploitation details are provided in the documents. Remediation: ...

CVE-2022-25828

Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access password information of connected WiFiAp in the log...

March 8, 2022—KB5011535 (Monthly Rollup)

None None...

March 8, 2022—KB5011497 (OS Build 20348.587)

None None...

March 8, 2022—KB5011560 (Security-only update)

None None...

March 8, 2022—KB5011564 (Monthly Rollup)

None None...

Duplicate of ./gem/activestorage/CVE-2022-21831.yml

The Active Storage module of Rails starting with version 5.2.0 are possibly vulnerable to code injection. This issue was patched in versions 5.2.6.2, 6.0.4.7, 6.1.4.7, and 7.0.2.3. To work around this issue, applications should implement a strict allow-list on accepted transformation methods or...

Possible code injection vulnerability in Rails / Active Storage

There is a possible code injection vulnerability in the Active Storage module of Rails. This vulnerability has been assigned the CVE identifier CVE-2022-21831. Versions Affected: = 5.2.0 Not affected: params:v % Where the transformation method or its arguments are untrusted arbitrary input. All...

PT-2022-1849 · Ruby +2 · Ruby On Rails Active Storage +2

Name of the Vulnerable Software and Affected Versions: Ruby on Rails Active Storage versions 5.2.0 through 5.2.6.2 Ruby on Rails Active Storage versions 6.0.0 through 6.0.4.6 Ruby on Rails Active Storage versions 6.1.0 through 6.1.4.6 Ruby on Rails Active Storage versions 7.0.0 through 7.0.2.2...

PT-2022-17554 · Unknown · Watch Active Plugin

Name of the Vulnerable Software and Affected Versions: Watch Active Plugin versions prior to 2.2.07.22012751 Description: The issue allows an attacker to access password information of connected WiFiAp in the log. Recommendations: For versions prior to 2.2.07.22012751, update to version...

2 New Mozilla Firefox 0-Day Bugs Under Active Attack — Patch Your Browser ASAP!

Mozilla has pushed out-of-band software updates to its Firefox web browser to contain two high-impact security vulnerabilities, both of which it says are being actively exploited in the wild. Tracked as CVE-2022-26485 and CVE-2022-26486, the zero-day flaws have been described as use-after-free...

WordPress plugin WP Cerber Security, Anti-spam & Malware Scan 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress WP Cerber Security, Anti-spam & Malware Scan Plugin...

CVE-2022-23232

StorageGRID formerly StorageGRID Webscale versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited could allow disabled, expired, or locked external user accounts to access S3 data to which they previously had access. StorageGRID 11.6.0 obtains the user accoun...

CVE-2022-23232

StorageGRID formerly StorageGRID Webscale versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited could allow disabled, expired, or locked external user accounts to access S3 data to which they previously had access. StorageGRID 11.6.0 obtains the user accoun...

CVE-2022-23232

StorageGRID formerly StorageGRID Webscale versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited could allow disabled, expired, or locked external user accounts to access S3 data to which they previously had access. StorageGRID 11.6.0 obtains the user accoun...

CVE-2022-23232

Summary of CVE-2022-23232 (StorageGRID): StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are vulnerable to an access-control issue where disabled, expired, or locked external user accounts could access S3 data they previously could view. In 11.6.0, the product changes behavio...

CVE-2022-23232

StorageGRID formerly StorageGRID Webscale versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited could allow disabled, expired, or locked external user accounts to access S3 data to which they previously had access. StorageGRID 11.6.0 obtains the user accoun...