oscap-anaconda-addon bug fix and enhancement update

An update is available for oscap-anaconda-addon. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Roc...

webappfind (=0.1.1) potentially affected by unknown CVE via addon-kit (=0.0.1-security)

addon-kit NPM version =0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on addon-kit and may be impacted: - webappfind =0.1.1 Source cves: unknown CVE Source advisory: OSV:MAL-2022-852...

Malicious code in addon-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2cb769bc829ad73185d9dec43b063a45ed4dab7a85aed2152ea5dc9a75328b58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-852 Malicious code in addon-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2cb769bc829ad73185d9dec43b063a45ed4dab7a85aed2152ea5dc9a75328b58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Contact Form 7 Database Addon < 1.2.6.5 - CSV Injection

The plugin does not validate data when output it back in a CSV file, which could lead to CSV injection Use a Contact Form 7 form and submit an Excel formula in the message field, such as "=5+5" without quotes. Export the entry as CSV using the plugin and import it into Excel...

WordPress Contact Form 7 Database Addon plugin <= 1.2.6.3 - CSV Injection vulnerability

CSV Injection vulnerability discovered by Adel Bouaricha in WordPress Contact Form 7 Database Addon plugin versions = 1.2.6.3. Solution Update the WordPress to the latest available version at least 1.2.6.5...

Contact Form 7 Database Addon < 1.2.6.5 - CSV Injection

The plugin does not validate data when output it back in a CSV file, which could lead to CSV injection PoC Use a Contact Form 7 form and submit an Excel formula in the message field, such as "=5+5" without quotes. Export the entry as CSV using the plugin and import it into Excel...

Academy Learning Management System 5.7 Shell Upload

Exploit Title: Academy Learning Management System 5.7 Shell Upload Exploit Author: th3d1gger Vendor Homepage: https://codecanyon.net Software Link: https://codecanyon.net/item/academy-course-based-learning-management-system/22703468 Version: 5.7 Tested on Ubuntu 18.04 Totally wrong architecture f...

CVE-2022-38367

The Netic User Export add-on before 2.0.6 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user to export all users from Jira by making an HTTP request to the affected endpoint...

de.the-library-code.dspace:addon-duplication-detection-service-jspui (>=6.2.0 <=6.3.1), de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (=6.3.0) +1 more potentially affected by CVE-2022-31194 via org.dspace:dspace-jspui (>=6.0 <=6.3)

org.dspace:dspace-jspui MAVEN version =6.0, =6.2.0, =6.0, =6.3 Source cves: CVE-2022-31194 Source advisory: OSV:GHSA-QP5M-C3M9-8Q2P...

de.the-library-code.dspace:addon-duplication-detection-service-jspui (>=6.2.0 <=6.3.1), de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (=6.3.0) +1 more potentially affected by CVE-2022-31193 via org.dspace:dspace-jspui (>=6.0 <=6.3)

org.dspace:dspace-jspui MAVEN version =6.0, =6.2.0, =6.0, =6.3 Source cves: CVE-2022-31193 Source advisory: OSV:GHSA-763J-Q7WV-VF3M...

de.the-library-code.dspace:addon-duplication-detection-service-jspui (>=6.2.0 <=6.3.1), de.the-library-code.dspace:addon-identifiers-enduring-submission-jspui (>=5.8.0 <=6.3.0) +1 more potentially affected by CVE-2022-31189 via org.dspace:dspace-jspui (>=4.0 <=6.3)

org.dspace:dspace-jspui MAVEN version =4.0, =6.2.0, =5.8.0, =4.0, =6.3 Source cves: CVE-2022-31189 Source advisory: OSV:GHSA-C2J7-66M3-R4FF...

Exploit for SQL Injection in Prestashop

LabelGrup Networks, official PrestaShop Partner !LabelGrup L...

CVE-2022-36131

The Better PDF Exporter add-on 10.0.0 for Atlassian Jira is prone to stored XSS via a crafted description to the PDF Templates overview page...

ol8addon security update

...

USN-5504-1 firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the browser UI, bypass CSP restrictions, bypass sandboxed iframe restrictions, obtain sensitive...

Ubuntu 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-5504-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5504-1 advisory. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could...

UBUNTU-CVE-2022-34471

When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifest had been tampered with on the server, an attacker could trick the browser into downgrading the addon to a prior version. This...

Improper Access Control

firefox is vulnerable to improper access control. The vulnerability exists when downloading an update for an addon because the downloaded addon update's version was not verified to match the version selected from the manifest which allows an attacker to trick the browser into downgrading the addo...

Mozilla Firefox < 102.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 102.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-24 advisory. - Mozilla developers Bryce Seager van Dyk and the Mozilla Fuzzing Team reported potential vulnerabilities...