WordPress and WordPress plugins have cross-site scripting vulnerabilities

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is an open source application plugin for WordPress. WordPress Hummingbird plugin version 3.3.2 previously had a cross-site scripting vulnerability that could be exploited by attacke...

CVE-2022-20782

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to improper enforcement of administrative privilege levels for high-value...

Citrix Releases Security Updates for Hypervisor

Citrix has released security updates to address a vulnerability in Hypervisor. An attacker could exploit this vulnerability to cause a denial-of-service condition. CISA encourages users and administrators to review Citrix Security Update CTX390511 and apply the necessary updates. This product is...

Code injection

DISPUTED SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the themes can be modified by an administrator. NOTE: the vendor's position is that administrators are intended to have the ability to...

PT-2022-18161 · Unknown · Simple Machines Forum

Name of the Vulnerable Software and Affected Versions: SimpleMachinesForum versions 2.1.1 and earlier Description: The issue allows remote authenticated administrators to execute arbitrary code by inserting vulnerable PHP code because themes can be modified by an administrator. The vendor's...

CVE-2022-26982

SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the themes can be modified by an administrator. NOTE: the vendor's position is that administrators are intended to have the ability to modify theme...

CVE-2022-26982: Improper Control of Generation of Code

SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the themes can be modified by an administrator. NOTE: the vendor's position is that administrators are intended to have the ability to modify theme...

CVE-2022-27609

Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows does not provide sufficient anti-tampering protection of services by users with Administrator privileges. This could result in a user disabling Forcepoint One Endpoint and the protection offered by it...

Forcepoint One Endpoint security vulnerability

Forcepoint One Endpoint is a data leakage prevention solution from US-based Forcepoint. A security vulnerability exists in Forcepoint One Endpoint for Microsoft Windows, versions prior to 22.01, which stems from an inability to provide adequate service tamper protection for users with administrat...

GitLab Community Edition and Enterprise Edition log information leakage vulnerabilities

GitLab Enterprise Edition is a content management system.GitLab Community Edition is a community edition of GitLab from GitLab, Inc. A log message disclosure vulnerability exists in GitLab Community Edition CE and Enterprise Edition EE due to a lack of cleanup of logged exception messages. A remo...

Apple Releases Security Updates

Apple has released security updates to address vulnerabilities—CVE-2022-22674 and CVE-2022-22675—in multiple products. An attacker could exploit one of these vulnerabilities to take control of an affected device. These vulnerabilities have been detected in exploits in the wild. CISA encourages...

CVE-2021-44312

An issue was discovered in Firmware Analysis and Comparison Tool v3.2. Logged in administrators could be targeted by a CSRF attack through visiting a crafted web page...

CVE-2021-44312

An issue was discovered in Firmware Analysis and Comparison Tool v3.2. Logged in administrators could be targeted by a CSRF attack through visiting a crafted web page...

CVE-2021-44312

An issue was discovered in Firmware Analysis and Comparison Tool v3.2. Logged in administrators could be targeted by a CSRF attack through visiting a crafted web page...

Cross site request forgery (csrf)

An issue was discovered in Firmware Analysis and Comparison Tool v3.2. Logged in administrators could be targeted by a CSRF attack through visiting a crafted web page...

CVE-2021-44312

The CVE-2021-44312 entry affects Firmware Analysis and Comparison Tool (FACT) version 3.2. A cross-site request forgery (CSRF) vulnerability exists in the web application, stemming from insufficient validation that requests originate from trusted users. Consequence: logged-in administrators could...

CVE-2021-44312

An issue was discovered in Firmware Analysis and Comparison Tool v3.2. Logged in administrators could be targeted by a CSRF attack through visiting a crafted web page...

PT-2022-12040

Name of the Vulnerable Software and Affected Versions Firmware Analysis and Comparison Tool version 3.2 Description An issue allows logged in administrators to be targeted by a CSRF attack through visiting a crafted web page. Recommendations For Firmware Analysis and Comparison Tool version 3.2,...

Nozomi Networks Guardian: Input validation error vulnerability

Nozomi Networks Guardian is an IoT device and software inspection system from Nozomi Networks, Switzerland. An input validation error vulnerability exists in versions of Nozomi Networks Guardian prior to 22.0.0, which can be exploited by an authenticated attacker with the administrator or import...

Sql injection

McAfee Enterprise ePolicy Orchestrator ePO prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the restoration of the ePO server. To achieve this the attacker would have to be logged onto the server hosting the ePO server restricted to...