hw: cpu: Intel: Stale Data Read from legacy xAPIC vulnerability

A flaw was found in hw. The APIC can operate in xAPIC mode also known as a legacy mode, in which APIC configuration registers are exposed through a memory-mapped I/O MMIO page. This flaw allows an attacker who can execute code on a target CPU to query the APIC configuration page. When reading the...

IBM CICS TX Advanced Clickjacking Vulnerability

IBM CICS TX Advanced is a comprehensive, single transaction runtime package from IBM USA. It can provide a cloud-native deployment model for standalone applications. IBM CICS TX Advanced version 11.1 is vulnerable to a clickjacking vulnerability that stems from the program's failure to adequately...

IBM CICS TX Advanced Input Validation Error Vulnerability

IBM CICS TX Advanced is a comprehensive, single transaction runtime package from IBM USA. It can provide a cloud-native deployment model for standalone applications. IBM CICS TX Advanced version 11.1 contains an input validation error vulnerability that stems from improper input validation of the...

IBM CICS TX Cross-Site Request Forgery Vulnerability

IBM CICS TX Advanced is a comprehensive, single transaction runtime package from IBM USA, Inc. It can provide a cloud-native deployment model for standalone applications. IBM CICS TX Advanced version 11.1 contains a security vulnerability that stems from a lack of authentication measures or...

IBM CICS TX Advanced Access Control Error Vulnerability

IBM CICS TX Advanced is a comprehensive, single transaction runtime package from IBM USA. It can provide a cloud-native deployment model for standalone applications. An Access Control Error vulnerability exists in IBM CICS TX Advanced version 11.1, which stems from a failure to set a security...

openssl: AES OCB fails to encrypt some bytes

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimized implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption...

GHSA-XV97-C62V-4587 NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails

Impact next-auth users who are using the EmailProvider either in versions before 4.10.3 or 3.29.10 are affected. If an attacker could forge a request that sent a comma-separated list of emails eg.: [email protected],[email protected] to the sign-in endpoint, NextAuth.js would send emails to...

NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails

Impact next-auth users who are using the EmailProvider either in versions before 4.10.3 or 3.29.10 are affected. If an attacker could forge a request that sent a comma-separated list of emails eg.: [email protected],[email protected] to the sign-in endpoint, NextAuth.js would send emails to...

IBM CICS TX 安全漏洞

IBM CICS TX Advanced is a comprehensive, single transaction runtime package from IBM USA. It can provide a cloud-native deployment model for standalone applications. IBM CICS TX Advanced version 11.1 is vulnerable to a clickjacking vulnerability that stems from the program's failure to adequately...

WordPress plugin Advanced WordPress Reset 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

IBM CICS TX 安全漏洞

IBM CICS TX Advanced is a comprehensive, single transaction runtime package from IBM USA. It can provide a cloud-native deployment model for standalone applications. An Access Control Error vulnerability exists in IBM CICS TX Advanced version 11.1, which stems from a failure to set a security...

IBM CICS TX Standard and Advanced 输入验证错误漏洞

IBM CICS TX Standard and Advanced is a comprehensive, single transaction runtime package from IBM USA. It can provide a cloud-native deployment model for standalone applications. An input validation error vulnerability exists in IBM CICS TX Advanced version 11.1 that stems from improper input...

Vulnerability fixed in SonicWall Hosted Email Security

SonicWall has fixed a vulnerability in Hosted Email Security. An unauthenticated malicious person could exploit it to bypass the Capture ATP service, thereby bypass the functionality of the product. SonicWall has released updates to fix the vulnerability in Hosted Email Security 10.0.18.7423. For...

WordPress Advanced Custom Fields PRO premium plugin <= 5.12.2 - Unauthenticated File Upload vulnerability

Unauthenticated File Upload vulnerability discovered by James Golovich in WordPress Advanced Custom Fields PRO premium plugin versions = 5.12.2. Solution Update the WordPress Advanced Custom Fields PRO plugin to the latest available version at least 5.12.3...

WordPress Advanced Custom Fields plugin <= 5.12.2 - Unauthenticated File Upload vulnerability

Unauthenticated File Upload vulnerability discovered by James Golovich in WordPress Advanced Custom Fields plugin versions = 5.12.2. Solution Update the WordPress Advanced Custom Fields plugin to the latest available version at least 5.12.3...

CVE-2022-34580

CVE-2022-34580 affects Advanced School Management System v1.0. The issue is a cross-site scripting (XSS) vulnerability exploitable via the address parameter at ip/school/index.php. Documented CVSS: 4.8 (MEDIUM) with network attack vector, high privileges required and user interaction. APT/Exploit...

Schneider Electric Modicon Path Traversal (CVE-2022-34762)

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause unauthorized firmware image loading when unsigned images are added to the firmware image path. Affected Products: X80 advanced RTU Communication Module BMENOR2200H V2.01 an...

PT-2022-22219 · Unknown · Advanced School Management System

Name of the Vulnerable Software and Affected Versions: Advanced School Management System version 1.0 Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability can be exploited via the address parameter at the "ip/school/index.php" endpoint. Recommendations:...

Malicious Package

Overview docs-component-advanced-permission is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerabl...

CVE-2022-34594

CVE-2022-34594 affects Advanced School Management System v1.0. The vulnerability is a cross-site scripting (XSS) flaw exploitable via the component ip/school/moudel/update_subject.php, where a crafted payload in the Edit Subject field can cause arbitrary web scripts/HTML to execute. The NVD entry...