CVE-2022-39249

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be...

CVE-2022-39248

matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker...

CVE-2022-39249

CVE-2022-39249 affects the Matrix Javascript SDK (matrix-js-sdk) prior to 19.7.0. A malicious homeserver can coordinate to craft messages that appear from another user due to a permissive key-forwarding policy. Starting with 19.7.0, the default policy was tightened to only accept forwarded keys i...

CVE-2022-1322

The Coming Soon - Under Construction WordPress plugin through 1.1.9 does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

WordPress plugin Coming Soon - Under Construction 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

PT-2022-13796 · WordPress · The Coming Soon - Under Construction

Name of the Vulnerable Software and Affected Versions: The Coming Soon - Under Construction WordPress plugin versions 1.1.9 and earlier Description: The issue allows high-privileged users to perform Cross-Site Scripting attacks due to the plugin not sanitizing and escaping some of its settings,...

New Grandoreiro Banking Malware Campaign Targeting Spanish Manufacturers

Organizations in the Spanish-speaking nations of Mexico and Spain are in the crosshairs of a new campaign designed to deliver the Grandoreiro banking trojan. "In this campaign, the threat actors impersonate government officials from the Attorney General's Office of Mexico City and from the Public...

vicoreconstruction.com.au Cross Site Scripting vulnerability OBB-2839271

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

kamnarconstruction.com.au Cross Site Scripting vulnerability OBB-2833292

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

constructionguarantee.ie Cross Site Scripting vulnerability OBB-2807453

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Oracle Primavera Gateway (Jul 2022 CPU)

The versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2022 CPU advisory. - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering component: Admin jackson-databind. Supported versions that a...

CVE-2022-21558

Vulnerability in the Oracle Crystal Ball product of Oracle Construction and Engineering component: Installation. Supported versions that are affected are 11.1.2.0.000-11.1.2.4.900. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle...

Design/Logic Flaw

Vulnerability in the Oracle Crystal Ball product of Oracle Construction and Engineering component: Installation. Supported versions that are affected are 11.1.2.0.000-11.1.2.4.900. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle...

CVE-2022-21558

Vulnerability in the Oracle Crystal Ball product of Oracle Construction and Engineering component: Installation. Supported versions that are affected are 11.1.2.0.000-11.1.2.4.900. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle...

CVE-2022-21558

The CVE-2022-21558 entry concerns Oracle’s Crystal Ball within Oracle Construction and Engineering. Affected component: Installation. Supported vulnerable versions are 11.1.2.0.000–11.1.2.4.900. The vulnerability allows a low-privilege attacker with local logon to compromise Oracle Crystal Ball, ...

Oracle Construction and Engineering Suite 输入验证错误漏洞

Oracle Construction and Engineering Suite is a portfolio management solution suite product for construction projects from Oracle Corporation. An input validation error vulnerability exists in Oracle Construction and Engineering Suite versions 11.1.2.0.000 through 11.1.2.4.900, which can be...

everest-construction.co.uk Cross Site Scripting vulnerability OBB-2775863

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-1895

The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack...

CVE-2022-1895

The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack...

Russian Ministry Website Hacked to Display “Glory To Ukraine” Message

By Deeba Ahmed The targeted website which belongs to the Russian Ministry of Construction, Housing, and Utilities, was also asked to… This is a post from HackRead.com Read the original post: Russian Ministry Website Hacked to Display "Glory To Ukraine" Message...