CVE-2022-31034 Insecure entropy in argo-cd

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or UI. The vulnerabilities are due to the use of insufficiently random values in...

CVE-2022-31034

CVE-2022-31034 affects Argo CD (GitOps tool for Kubernetes). All versions starting with v0.11.0 are vulnerable due to insufficiently random values in OAuth2/OIDC login parameters, using a non-cryptographically secure PRNG seeded with a predictable/time-based value, reducing entropy in login flows...

CVE-2022-1327

The Image Gallery WordPress plugin before 1.1.6 does not sanitize and escape some of its Image fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

PT-2022-13657 · WordPress · The Mihdan: No External Links

Name of the Vulnerable Software and Affected Versions: The Mihdan: No External Links WordPress plugin versions prior to 5.0.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed,...

Library Management System With QR Code 1.0 SQL Injection

Title: Library Management System with QR code Attendance 1.0 SQL Injection Author: Ashish Kumar https://www.linkedin.com/in/ashish-kumar-0b65a3184 Date: 27.06.2022 Vendor: https://www.sourcecodester.com/users/kingbhob02 Software:...

CVE-2022-20828

A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance ASA FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER module as the root user. This vulnerabilit...

CVE-2021-41635

When installed as Windows service MELAG FTP Server 2.2.0.4 is run as SYSTEM user, which grants remote attackers to abuse misconfigurations or vulnerabilities with administrative access over the entire host system...

CVE-2022-32536

The user access rights validation in the web server of the Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 was insufficient. This would allow a non-administrator user to obtain administrator user access rights...

Loading Page with Loading Screen < 1.0.83 - Admin+ Stored Cross-Site Scripting

The plugin does not escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Go to Settings - Loading Page, in the "Display loading screen in" settings, select either "specific pages" or "specif...

PT-2022-3059 · Cisco · Cisco Firepower Services Software For Asa +1

Name of the Vulnerable Software and Affected Versions: Cisco FirePOWER Services Software for ASA affected versions not specified Description: The issue is related to improper handling of undefined command parameters in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance ASA...

GHSA-2M7H-86QQ-FP4V Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params

Impact All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or UI. The vulnerabilities are due to the use of insufficiently random values in parameters in Oauth2/OIDC login flows. In each case, using a...

Security Bulletin: IBM Robotic Process Automation may allow regular users to view some admin pages.

Summary IBM Robotic Process Automation Server prior to 21.0.1.3 may allow regular users to view some admin pages Vulnerability Details CVEID:CVE-2022-22415 DESCRIPTION: A vulnerability exists where an IBM Robotic Process Automation 21.0.1 regular user is able to obtain view-only access to some...

PT-2022-4399 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.3-p2 and earlier Adobe Commerce versions 2.3.7-p3 and earlier Adobe Commerce versions 2.4.4 and earlier Description: The issue is related to the lack of protection of the web page structure, which can be exploited ...

Overprivileged admin can grant unlimited WETH

Lines of code Vulnerability details Impact Admin can grantComp to any address using any amount and drain the contract. Proof of Concept If admin key gets compromised there is no timelock, no amount boundaries and no address limitations to prevent the assets to be drained immediately to the...

CVE-2022-1939

The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to...

CVE-2022-1832

The CVE-2022-1832 entry concerns the CaPa Protect WordPress plugin (versions up to 0.5.8.2). The vulnerability arises from a missing CSRF check when updating settings, enabling a logged-in attacker to coerce an admin into changing settings and potentially disable the protection. Exploitation is v...

CVE-2019-12359

An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/ztliuyansendmail.php when the attacker has admin authority via the id parameter...

CVE-2019-12353

An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/dlsendmail.php when the attacker has admin authority via the id parameter...

CVE-2019-12354

An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/showbad.php when the attacker has admin authority via the id parameter...

PT-2022-15465 · Ibm · Ibm Spectrum Protect Operations Center +1

Name of the Vulnerable Software and Affected Versions: IBM Spectrum Protect Operations Center versions 8.1.0.000 through 8.1.14.000 Description: The issue allows an attacker to exploit it using brute force techniques to gain unauthorized administrative access to the IBM Spectrum Protect Server...