CVE-2022-26102

Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacker, to access content on the start screen of any transaction that is available with in the same SAP system even if he/she isn't authorized for that transactio...

Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments

The software is a booking management system that has a public form to place bookings, and a private area for the calendar and management of services, users, settings, etc. There is a backend API that allows data manipulation, including listing the appointments for a specific time range. This...

CVE-2022-24396

CVE-2022-24396 affects SAP Focused Run’s Simple Diagnostics Agent (versions 1.0–1.57). The vulnerability stems from missing authentication checks for functions accessible via localhost on http://localhost:3005, enabling an attacker to access administrative/privileged functionalities and read, mod...

CVE-2022-24309

A vulnerability has been identified in Mendix Runtime V7 All versions V7.23.29, Mendix Runtime V8 All versions V8.18.16, Mendix Runtime V9 All versions V9.13 only with Runtime Custom Setting DataStorage.UseNewQueryHandler set to False. If an entity has an association readable by the user, then in...

CVE-2022-24309

Summary: CVE-2022-24309 affects Mendix Runtime (V7 < 7.23.29, V8 < 8.18.16, V9

CVE-2022-24309

A vulnerability has been identified in Mendix Runtime V7 All versions V7.23.29, Mendix Runtime V8 All versions V8.18.16, Mendix Runtime V9 All versions V9.13 only with Runtime Custom Setting DataStorage.UseNewQueryHandler set to False. If an entity has an association readable by the user, then in...

Vulnerabilities fixed in Siemens products

Vulnerabilities have been fixed in several Siemens products. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Manipulation of data Circumvention of authentication...

Vulnerabilities fixed in Microsoft Office

Vulnerabilities have been fixed in Microsoft Office products. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Manipulation of data. Circumvention of security measure Remote code execution User rights Access to...

CVE-2021-37209

CVE-2021-37209 affects Siemens RUGGEDCOM ROS/RMC/RS/RSG/RSL/RST devices with the SSH server offering weak ciphers by default, enabling potential MITM data exposure. Connected sources list affected products and versions (e.g., RUGGEDCOM ROS i800/i801/i802/i803, M2100/M2200, RMC8388, RS416/RS416Pv2...

Vulnerabilities fixed in Firefox

Vulnerabilities have been fixed in Firefox. The vulnerabilities allow a malicious person to launch attacks that lead to the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution User rights Access to system data Mozilla has released updates to fix the...

Vulnerability fixed in Elasticsearch and Kibana

Vulnerabilities have been fixed in Elasticsearch and Kibana. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Cross-Site Scripting XSS. Manipulation of data Increased user privileges Elastic has made updates...

Vulnerabilities fixed in Aruba AOS-CX switches

Vulnerabilities have been fixed in Aruba AOS-CX switches. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Cross-Site Scripting XSS. Denial-of-Service DoS. Manipulation of data Remote code execution...

Code injection

An issue exists in Fuchsia where VMO data can be modified through access to copy-on-write snapshots. A local attacker could modify objects in the VMO that they do not have permission to. We recommend upgrading past commit d97c05d2301799ed585620a9c5c739d36e7b5d3d or any of the listed versions...

DoS in permitAndMulticall

Lines of code Vulnerability details Impact The permitAndMulticall function does not authenticate the data argument through any signatures. Only the from, amount parameters are as chosen by the from user as these are checked in the permitAndMulticall - ERC20ticket.permit call. An attacker can...

Vulnerabilities fixed in VMware Workstation, Fusion & ESXi

VMware has fixed several vulnerabilities in various products, namely Workstation Pro/Player, Fusion and ESXi. The vulnerabilities allow a malicious party to launch attacks that lead to the following categories of damage: Denial-of-Service DoS. Manipulation of data Remote code execution User right...

Code injection

In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer...

Prototype Pollution leading to Remote Code Execution in superjson

Impact This is critical vulnerability, as it allows to run arbitrary code on any server using superjson input, including a Blitz.js server, without prior authentication or knowledge. Attackers gain full control over the server so they could steal and manipulate data or attack further systems. The...

Vulnerabilities fixed in IBM Spectrum Protect Plus

IBM has fixed vulnerabilities in Spectrum Protect Plus. The vulnerabilities, which include those in the Node.js and PostgreSQL components of the product, allow a malicious party to perform attacks that result in the following categories of damage: Cross-Site Scripting XSS. Manipulation of data...

Vulnerabilities fixed in IBM Cognos Controller

IBM has fixed vulnerabilities in Cognos Controller. The vulnerabilities potentially enable a malicious person to launch attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Circumvention of security measure Remote code execution Use...

in alextselegidis/easyappointments

Description The software is a booking management system that has a public form to place bookings, and a private area for the calendar and management of services, users, settings, etc... There is a backend API that allows data manipulation, including listing the appointments for a specific time...