Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that enable the assisted mapping capability may be vulnerable to arbitrary code injection due to CVE-2022-21797

Summary Python module Joblib used by IBM App Connect Enterprise Certified Container for mapping assistance in flow development. IBM App Connect Enterprise Certified Container DesignerAuthoring operands that enable mapping assistance may be vulnerable to arbitrary code injection. This bulletin...

Arbitrary Code Injection

azurecli is vulnerable to arbitrary code injection. The vulnerability exist in azurecli only when running on windows, due to incorrect input validations during the submission of values containing & or | symbols which allows an attacker to inject and execute malicious code into the system...

PT-2022-26221

Name of the Vulnerable Software and Affected Versions Zemana AntiMalware version 3.2.28 Watchdog Anti-Malware version 4.1.422 Description The issue allows for arbitrary code injection, which can be exploited to execute code in kernel mode. This can lead to disabling mandatory driver signature...

CVE-2021-31858

DotNetNuke DNN 9.9.1 CMS is vulnerable to a Stored Cross-Site Scripting vulnerability in the user profile biography section which allows remote authenticated users to inject arbitrary code via a crafted payload...

Cross Site Scripting (XSS)

ruoyi is vulnerable to cross-site scripting. The vulnerability exists in the updateAvatar function in SysProfileController.java due to the lack of sanitization in user input which allows an attacker to inject and execute arbitrary code via a crafted HTML file...

Arbitrary Code Injection

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 the user name field at login could be used to enumerate LDAP data. This is only the case for LDAP search configuration. This issue has been fixed ...

Mobile web: upgrade Underscore.js to 1.13.1 or higher

h3. Issue Summary The mobile web view in Confluence is currently using underscore.js 1.3.3. However, it is being affected due to CVE-2021-23358 The package underscore from 1.13.0-0 and before 1.13.0-2 From 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template functio...

UPM: upgrade Underscore.js to 1.13.1 or higher

h3. Issue Summary UPM is currently using underscore.js 1.4.4. However, it is being affected due to CVE-2021-23358 The package underscore from 1.13.0-0 and before 1.13.0-2 From 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variabl...

Remote Code Execution (RCE)

concrete5/core is vulnerable to remote code execution. The vulnerability exists due to insecure http requests which allow an attacker to inject and execute arbitrary codes into the system...

CVE-2022-23057 ERPNext - Stored XSS in My Profile

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting XSS, due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile...

PT-2022-15817

Name of the Vulnerable Software and Affected Versions ERPNext versions v12.0.9 through v13.0.3 Description The issue is related to Stored Cross-Site-Scripting XSS due to improper validation of user input. This allows a low-privileged attacker to inject arbitrary code into input fields when editin...

CVE-2022-24127

A Stored Cross-Site Scripting XSS vulnerability was discovered in ProjectGeneral/editprojectsettings.php in REDCap 12.0.11. This issue allows any user with project management permissions to inject arbitrary code into the project title apptitle field when editing an existing project. The payload i...

Cross site scripting

A Stored Cross-Site Scripting XSS vulnerability was discovered in ProjectGeneral/editprojectsettings.php in REDCap 12.0.11. This issue allows any user with project management permissions to inject arbitrary code into the project title apptitle field when editing an existing project. The payload i...

CVE-2022-24127

A Stored Cross-Site Scripting XSS vulnerability was discovered in ProjectGeneral/editprojectsettings.php in REDCap 12.0.11. This issue allows any user with project management permissions to inject arbitrary code into the project title apptitle field when editing an existing project. The payload i...

Improper access control

A vulnerability has been identified in Xpedition Designer VX.2.10 All versions VX.2.10 Update 13, Xpedition Designer VX.2.11 All versions VX.2.11 Update 11, Xpedition Designer VX.2.12 All versions VX.2.12 Update 5, Xpedition Designer VX.2.13 All versions VX.2.13 Update 1. The affected application...

CVE-2022-31465: Incorrect Permission Assignment for Critical Resource

A vulnerability has been identified in Xpedition Designer VX.2.10 All versions VX.2.10 Update 13, Xpedition Designer VX.2.11 All versions VX.2.11 Update 11, Xpedition Designer VX.2.12 All versions VX.2.12 Update 5, Xpedition Designer VX.2.13 All versions VX.2.13 Update 1. The affected application...

Arbitrary Code Injection

convert-svg-core is vulnerable to arbitrary code injection. The vulnerability exists because the library does not properly remove the malicious attributes from the SVG element before being rendered, allowing an attacker to read files from the file system and show the file content as a PNG file by...

Code injection via SVG file in convert-svg-core

The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file...

CVE-2022-24429

The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file...

Code injection

The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file...