CVE-2022-2551: Direct Request

The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating...

Security Bulletin: Tivoli Storage Productivity Center is affected by vulnerabilities in OpenSSL (CVE-2014-3513, CVE-2014-3567, CVE-2014-3568)

Summary OpenSSL vulnerabilities were disclosed on October 15, 2014 by the OpenSSL Project. OpenSSL is used by Tivoli Storage Productivity Center. Tivoli Storage Productivity Center has addressed the applicable CVEs. Vulnerability Details CVE-ID:CVE-2014-3513 DESCRIPTION: OpenSSL is vulnerable to ...

Exposure of Sensitive Information Lead To Admin Account Take Over

Description The AP officers account is authorized to Backup and Restore the Database, Due to this he/she can download the backup and see the password hash of the System Administrator account, The weak hash MD5 of the password can be easily cracked and get the admin password. Proof of Concept Step...

WordPress WPvivid Backup Plugin <= 0.9.74 - Authenticated PHAR Deserialization vulnerability

Authenticated PHAR Deserialization vulnerability discovered by Rasoul Jahanshahi in WPvivid Backup plugin versions = 0.9.74 Solution Update the WordPress WPvivid Backup and Migration plugin to the latest available version at least 0.9.75...

EcoStruxure Control Expert Backup Code Execution

The vulnerability of the backup function for source files in the target programming system, the EcoStruxure Control Expert programmable logic controllers, is related to insufficient verification of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code o...

WordPress WP Database Backup Plugin <= 5.8.3 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by Raad Haddad in WP Database Backup plugin versions = 5.8.3 Solution Update the WordPress WP Database Backup plugin to the latest available version at least 5.9...

WP Database Backup < 5.9 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup PoC Put the following payload in any of the Destination FTP Settings...

WP Database Backup < 5.9 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup Put the following payload in any of the Destination FTP Settings: "...

Driver Disk for Microsemi smartpqi 2.1.18-045 - For Citrix Hypervisor 8.2 LTSR

Who Should Install this Driver Disk? Customers running the Citrix Hypervisor 8.2 LTSR release who use Microsemi's smartpqi driver and wish to use the latest version of the following: Driver Module| Version ---|--- smartpqi| 2.1.18045 Issues Resolved In this Driver Disk Includes general enhancemen...

Release Information for Veeam Backup for Microsoft 365 6a

Cumulative Patches are available for this version: Veeam Backup for Microsoft 365 6a Cumulative Patches Requirements Before upgrading to Veeam Backup for Microsoft 365 6.0, Please confirm that you are running one of the following versions of Veeam Backup for Microsoft 365: 4.0 build 4.0.0.1345 4a...

Shared Server Compatibility of Veeam Backup for Microsoft 365 and Veeam Backup & Replication

Purpose It is important to remember that Veeam Backup for Microsoft 365 and Veeam Backup & Replication are separate backup products designed to operate separately from each other. However, both Veeam Backup for Microsoft 365 and Veeam Backup & Replication utilize Veeam Explorers as secondary...

Jenkins Google Cloud Backup Plugin File Copying

The vulnerability of the Jenkins Google Cloud Backup Plugin is related to the manipulation of inter-site requests. Exploiting this vulnerability could allow a malicious actor to copy arbitrary files remotely...

Jenkins Google Cloud Backup Plugin Auth Bypass

The vulnerability of the Jenkins Google Cloud Backup Plugin is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to remotely copy arbitrary files...

OpenEMR cross-site scripting vulnerability

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A security vulnerability exists in OpenEMR versions prior to 7.0.0.1, which stems...

WordPress Duplicator 1.4.7.1 Backup Disclosure

Title: WordPress Plugin Duplicator 1.4.7.1 - Unauthenticated Backup Download Author: nu11secur1ty Date: 08.08.2022 Vendor: https://wordpress.org/ Software: https://wordpress.org/plugins/duplicator/ Reference:...

WordPress Duplicator 1.4.7.1 Plugin - Unauthenticated Backup Download Vulnerability

Title: WordPress Plugin Duplicator 1.4.7.1 - Unauthenticated Backup Download Author: nu11secur1ty Vendor: https://wordpress.org/ Software: https://wordpress.org/plugins/duplicator/ Reference:...

CVE-2022-1704

Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup...

CVE-2022-1704

Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup...

Xxe

Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup...

CVE-2022-1704

CVE-2022-1704 affects Inductive Automation Ignition. The issue arises from parsing XML in the backup/restore functionality without XML security flags, enabling a potential XML External Entity (XXE) attack. Affected products/versions include: Ignition 8.1.x up to before 8.1.8, and Ignition 7.9.x b...