CVE-2022-40963

CVE-2022-40963 concerns the WordPress plugin WP Page Builder (versions ≤ 1.2.6). The vulnerability is a Stored XSS in which parameters are not properly sanitized/escaped, enabling authenticated users with Author+ privileges to inject scripts. Impact is cross-site scripting within WordPress pages ...

IT threat evolution in Q3 2022. Non-mobile statistics

IT threat evolution in Q3 2022 IT threat evolution in Q3 2022. Non-mobile statistics IT threat evolution in Q3 2022. Mobile statistics These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data. Quarterly...

WordPress plugin WP Page Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin WP Page Builder version 1.2.6 and prior versions are vulnerable. An attacker could use this...

PT-2022-25640 · WordPress · Wp Page Builder

Name of the Vulnerable Software and Affected Versions: WP Page Builder plugin version 1.2.6 and earlier Description: The issue concerns Stored Cross-Site Scripting XSS vulnerabilities in the WP Page Builder plugin. These vulnerabilities allow for multiple authentication bypasses. Recommendations:...

GetYourGuide Ticketing < 1.0.4 - Admin+ Stored XSS

The plugin does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Navigate toward the GYG Ticketing and GYG Ticketing...

Rocky Linux 8 : flatpak-builder (RLSA-2022:7458)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:7458 advisory. - Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6...

GHSA-8847-XVJW-9G43 XXE vulnerability on agents in Jenkins OSF Builder Suite : : XML Linter Plugin

OSF Builder Suite : : XML Linter 1.0.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control XML files that get processed by the 'OSF Builder Suite : : XML Linter' build step to have agent processes parse a crafted file tha...

Easy Form Builder < 3.4.0 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Navigate to New Form » go to the Settings...

Oracle Linux 8 : Image / Builder (ELSA-2022-7548)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-7548 advisory. cockpit-composer 41-1.0.1 - Make per page documentation links point to Oracle Linux Orabug: 32013095 41-1 - New upstream release Tenable has extracted the...

Easy Form Builder < 3.4.0 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Navigate to New Form » go to the Settings of t...

RHEL 9 : Image Builder (RHSA-2022:7950)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:7950 advisory. Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Security...

CVE-2022-45397

Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

Low: Red Hat Security Advisory: Image Builder security, bug fix, and enhancement update

An update for cockpit-composer, osbuild, osbuild-composer, and weldr-client is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Image Builder security, bug fix, and enhancement update

An update is available for cockpit-composer, weldr-client. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Image Builder is a service for building customized OS...

RLSA-2022:7950 Low: Image Builder security, bug fix, and enhancement update

Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Security Fixes: golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service...

CVE-2022-45397

Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

PT-2022-27499 · Jenkins · Jenkins Osf Builder Suite : : Xml Linter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins OSF Builder Suite : : XML Linter Plugin versions 1.0.2 and earlier Description: The issue arises from the XML parser not being configured to prevent XML external entity XXE attacks. This allows attackers who can control XML files...

Jenkins Plugin OSF Builder Suite :: XML Linter 代码问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. Jenkins Plugin A code issu...

Image Builder security, bug fix, and enhancement update

cockpit-composer 41-1.0.1 - Make per page documentation links point to Oracle Linux Orabug: 32013095 41-1 - New upstream release...

Oracle Linux 8 : flatpak-builder (ELSA-2022-7458)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2022-7458 advisory. - Fix CVE-2022-21682 2042007 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...