ColumnPack:ColumnPack-plugin (=1.0.3), CustomHistory:CustomHistory (>=1.1 <=1.3) +771 more potentially affected by CVE-2013-2033 via org.jenkins-ci.main:jenkins-core (>=1.396 <=1.509)

org.jenkins-ci.main:jenkins-core MAVEN version =1.396, =1.1, =0.9, =1.0, =1.0.0, =1.0, =1.0-beta-1, =2.1, =1.0, =1.0, =1.0, =1.0, =1.2 - com.cloudbees.jenkins.plugins:cloudbees-credentials =3.3 and more Source cves: CVE-2013-2033 Source advisory: OSV:GHSA-826F-32QM-VM3J...

GHSA-MM9Q-3847-M48X Moodle allows attackers to enter additional answer attempts

The lesson module in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to bypass intended access restrictions and enter additional answer attempts by leveraging the student role...

Design/Logic Flaw

Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before 11.33.0, when the “additional signup fields� feature is configured, a malicious actor can inject invalidated HTML co...

CVE-2022-29172 HTML injection with additional signup fields

Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before 11.33.0, when the “additional signup fields” feature is configured, a malicious actor can inject invalidated HTML code...

CVE-2022-29172

Auth0 Lock (auth0-lock) vulnerability CVE-2022-29172 affects versions before 11.33.0 where the “additional signup fields” feature allows HTML injection into the fields, storing invalid HTML in the user metadata payload (name property). This can cause a crafted link to render HTML in the recipient...

Cross site request forgery (csrf)

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with physical access to create an API request modified to create additional objects. IBM X-Force ID: 224159...

CVE-2022-22434

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with physical access to create an API request modified to create additional objects. IBM X-Force ID: 224159...

com.cloudbees.jenkins.plugins:additional-identities-plugin (=1.1), com.exxeta.jenkins.plugins:sidebar-update-notification (>=1.0.1 <=1.1.0) +60 more potentially affected by CVE-2013-0330 via org.jenkins-ci.main:jenkins-core (>=1.481 <=1.501)

org.jenkins-ci.main:jenkins-core MAVEN version =1.481, =1.0.1, =1.15, =1.1, =1.0, =1.0.3, =0.2.0, =0.1.0, =1.0.0, =1.0.5, =1.481, =1.501 and more Source cves: CVE-2013-0330 Source advisory: OSV:GHSA-25C5-58XW-HW5Q...

ColumnPack:ColumnPack-plugin (=1.0.3), CustomHistory:CustomHistory (>=1.1 <=1.3) +745 more potentially affected by CVE-2013-0328 via org.jenkins-ci.main:jenkins-core (>=1.396 <=1.501)

org.jenkins-ci.main:jenkins-core MAVEN version =1.396, =1.1, =0.9, =1.0, =1.0, =1.0-beta-1, =2.1, =1.0, =1.0, =1.0, =0.1, =0.1, =0.17 and more Source cves: CVE-2013-0328 Source advisory: OSV:GHSA-Q5F8-FXRX-PW6F...

Security Bulletin: IBM Robotic Process Automation could allow a user with physical access to create an API request modified to create additional objects (CVE-2022-22434)

Summary IBM Robotic Process Automation could allow a user with physical access to create an API request modified to create additional objects Vulnerability Details CVEID: CVE-2022-22434 DESCRIPTION: IBM Robotic Process Automation could allow a user with physical access to create an API request...

GHSA-75P6-52G3-RQC8 Keycloak vulnerable to privilege escalation on Token Exchange feature

A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the clientid of the target. This could allow a client to gain unauthorized access to...

Command Injection

czproject/git-php is vulnerable to command injection. A remote attacker is able to use additional flags to perform command injections via the isRemoteUrlReadable function since the url and refs parameter passing process to the git ls-remote subcommand, allows additional flags to be set...

CVE-2022-25648

A flaw was found in ruby-git, where the package is vulnerable to command injection via the git argument. This flaw allows an attacker to set additional flags, which leads to performing command injections...

CVE-2022-25648

The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetchremote = 'origin', opts = function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform...

CVE-2022-21223 Command Injection

The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function when using hg, the url and/or revision, tag, branch is passed to the hg clone command in a way that additional flags can be set. The additional flags can...

The vulnerability of the AES GCM encryption function of the authentication and authorization module for the Apache 2.x HTTP server Mod_auth_openidc allows a perpetrator to access confidential data.

The vulnerability of the AES GCM module’s authentication and authorization function for the Apache 2.x HTTP server Modauthopenidc is related to the use of static IVs and AADs. Exploiting this vulnerability allows a malicious actor to gain access to confidential data...

Microweber 输入验证错误漏洞

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. An integer overflow vulnerability exists in versions of Microweber prior to 1.3. The vulnerability stems from the fact tha...

CVE-2022-24953

The CryptGPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions...

CVE-2022-24953

The CryptGPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions...

AWS-Loot - Pull Secrets From An AWS Environment

Searches an AWS environment looking for secrets, by enumerating environment variables and source code. This tool allows quick enumeration over large sets of AWS instances and services. Install pip install -r requirements.txt An AWS credential file .aws/credentials is required for authentication t...