17256 matches found
WordPress Catalyst Connect Zoho CRM Client Portal Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)
Software Catalyst Connect Zoho CRM Client Portal Type Plugin Vulnerable versions = 2.0.0 Fixed in 2.1.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0588 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 2843a5139fb1 Credit...
Vulnerabilities fixed in IBM Aspera Connect and Aspera Cargo
IBM has fixed vulnerabilities in Aspera Connect and Aspera Cargo. A malicious party could exploit the vulnerabilities to access gain access to login credentials, or to be able to execute arbitrary code execute with application privileges. IBM has released updates to fix the vulnerabilities in...
Catalyst Connect Zoho CRM Client Portal < 2.1.0 - Reflected XSS
The plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin. Make a logged-in admin a page with the code below: Note: Make sure in Client Portal the company...
CVE-2023-27285
CVE-2023-27285 affects IBM Aspera Connect and IBM Aspera Cargo at versions up to 4.2.5, with a buffer overflow caused by improper bounds checking. The impact is potential arbitrary code execution on the target system. The vulnerability is addressed by IBM’s remediation: upgrading to version 4.2.6...
CVE-2023-22862
CVE-2023-22862 affects IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5, where authentication credentials are transmitted using an insecure method that can lead to unauthorized interception and retrieval. The IBM Security Bulletin (B3AE4522A366582F82BAA72D23E6FD29726FC63DA16335263B492D5C25D88B...
IBM Aspera 安全漏洞
IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM. An information disclosure vulnerability exists in IBM Aspera Cargo and IBM Aspera Connect, which can be exploited by attackers to cause unauthorized...
IBM Aspera 缓冲区错误漏洞
IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM. A buffer overflow vulnerability exists in IBM Aspera Connect and IBM Aspera Cargo, which originates from a boundary check error and can be exploited by an...
CVE-2023-22862: Unprotected Transport of Credentials
IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval...
PT-2023-18736 · Ibm · Ibm Aspera Connect +1
Name of the Vulnerable Software and Affected Versions: IBM Aspera Connect version 4.2.5 IBM Aspera Cargo version 4.2.5 Description: The issue concerns the transmission of authentication credentials using an insecure method, making them susceptible to unauthorized interception and/or retrieval...
CVE-2023-27285: Improper Restriction of Operations within the Bounds of a Memory Buffer
IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 is vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the system. IBM X-Force ID: 248625...
PT-2023-21051 · Ibm · Ibm Aspera Connect +1
Name of the Vulnerable Software and Affected Versions: IBM Aspera Connect version 4.2.5 IBM Aspera Cargo version 4.2.5 Description: The issue is caused by improper bounds checking, leading to a buffer overflow. An attacker could overflow a buffer and execute arbitrary code on the system...
connectjournals.com Cross Site Scripting vulnerability OBB-3374432
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-23602
A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers. This vulnerability affects Firefox 109, Firefox ESR 102.7, and Thunderbird 102.7...
CVE-2023-23602: Improper Check for Unusual or Exceptional Conditions
A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers. This vulnerability affects Firefox 109, Firefox ESR 102.7, and Thunderbird 102.7...
Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that run designer flows containing Box nodes are vulnerable to security restriction bypass due to [CVE-2023-32313]
Summary Node.js module vm2 is used by IBM App Connect Enterprise Certified Container by the Box connector in designer flows. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that run designer flows containing Box nodes are vulnerable to security...
Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that use MQ Client nodes are vulnerable to disclosure of sensitive information due to [CVE-2023-28950]
Summary IBM MQ is used by IBM App Connect Enterprise Certified Container by the MQ Client nodes. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that run toolkit flows containing MQ Client nodes are vulnerable to disclosure of sensitive information...
Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that use the MQ Client nodes are vulnerable to denial of service due to [CVE-2023-22874]
Summary IBM MQ is used by IBM App Connect Enterprise Certified Container by the MQ Client nodes. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that run toolkit flows containing MQ Client nodes are vulnerable to denial of service. This bulletin...
Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to denial of service due to [CVE-2023-31125]
Summary npm module Engine.IO is used by IBM App Connect Enterprise Certified Container for updating the webconsole in a DesignerAuthoring instance. IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to denial of service. This bulletin provides patch informati...
Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable to arbitrary code execution due to [CVE-2022-1471]
Summary SnakeYAML is used by IBM App Connect Enterprise Certified Container for processing yaml configuration files. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable to arbitrary code execution. This bulletin provides patch informatio...
