OPENSUSE-SU-2022:0097-1 Security update for icingaweb2

This update for icingaweb2 fixes the following issues: icingaweb2 was updated to 2.8.6 This is a security release. Security Fixes - CVE-2022-24715: SSH resources allow arbitrary code execution for authenticated users GHSA-v9mv-h52f-7g63 boo1196911 - CVE-2022-24714: Unwanted disclosure of hosts an...

Fuji Electric Alpha5 缓冲区错误漏洞

Fuji Electric Alpha5 is a servo amplifier from Fuji Electric, Japan. The Fuji Electric Alpha5 suffers from a buffer error vulnerability that stems from the susceptibility of affected products to out-of-bounds reads, which can lead to the disclosure of sensitive information...

Mitsubishi Electric MELSEC iQ-F series 授权问题漏洞

The Mitsubishi Electric MELSEC iQ-F series is a programmable logic controller from Mitsubishi Electric Japan. A security vulnerability exists in the Mitsubishi Electric MELSEC iQ-F series, which can be exploited by an unauthenticated, remote attacker to disclose or tamper with information in the...

CVE-2021-39740

In Messaging, there is a possible way to bypass attachment restrictions due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID...

CVE-2021-39757

In PermissionController, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-176094662...

The vulnerability of the Samples component of the Oracle WebLogic Server application server allows a attacker to disclose protected information and compromise its integrity.

The vulnerability of the Samples component of the Oracle WebLogic Server application server exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to disclose sensitive information and compromise its integrity...

Vulnerability of the Cluster component: The general system for managing MySQL Cluster databases, which allows attackers to disclose sensitive information or cause partial service interruptions.

Vulnerability of the Cluster component: General database management systems like MySQL Cluster involve reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information or cause partial service interruptions...

Vulnerability of the Cluster component: The general system for managing MySQL Cluster databases, which allows attackers to gain unauthorized access to protected information or cause service failures.

Vulnerability of the Cluster component: General database management systems like MySQL Cluster involve reading data from beyond the buffer in memory during data node processing. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information or cause service...

The vulnerability of the Security component in the Oracle PeopleSoft Enterprise PeopleTools business application, which allows a hacker to disclose protected information

The vulnerability of the Security component in the Oracle PeopleSoft Enterprise PeopleTools business application exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

Vulnerability of the Cluster component: The general system for managing MySQL Cluster databases, which allows attackers to disclose sensitive information and cause partial service interruptions.

Vulnerability of the Cluster component: General database management systems like MySQL Cluster involve reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information and cause partial service interruptions...

The vulnerability of the Remote Desktop Protocol Client protocol on the Microsoft Windows operating system, which allows a hacker to disclose protected information

The vulnerability of the Remote Desktop Protocol Client on the Microsoft Windows operating system is related to the disclosure of information in the erroneous data field. Exploiting this vulnerability allows a malicious actor to disclose the protected information from a remote location...

The vulnerability of Microsoft Exchange Server servers, related to the exposure of information, allows attackers to perform spear-phishing attacks and disclose protected information.

The vulnerability of Microsoft Exchange Server servers is related to the exposure of information. Exploiting this vulnerability can allow a malicious actor to perform a spear-phishing attack and expose the protected information...

Vulnerability of the Cluster component: The general database management system of Oracle MySQL Cluster, which allows attackers to disclose sensitive information or cause service failures.

Vulnerability of the Oracle MySQL Cluster component: The general system management of databases in Oracle MySQL Cluster is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to disclose sensitive information or cause service failures...

CVE-2021-44477 GE Gas Power ToolBoxST Improper Restriction of XML External Entity Reference

GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity XXE vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band OOB attack. The vulnerability is triggered when input...

PT-2022-3765 · Netapp · Active Iq Unified Manager

Name of the Vulnerable Software and Affected Versions: Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.10P1 Description: The issue is related to the insufficient protection of service data in the AutoSupport mechanism, which could allow an attacker t...

OPENSUSE-SU-2022:0087-1 Security update for icingaweb2

This update for icingaweb2 fixes the following issues: icingaweb2 was updated to 2.8.6 This is a security release. Security Fixes - CVE-2022-24715: SSH resources allow arbitrary code execution for authenticated users GHSA-v9mv-h52f-7g63 boo1196911 - CVE-2022-24714: Unwanted disclosure of hosts an...

Salon booking system < 7.6.3 - Unauthenticated Sensitive Data Disclosure

The plugin does not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number of the person who booked it. PoC Although the API only...

Salon booking system < 7.6.3 - Customer+ Bookings/Customers Data Disclosure

The plugin does not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data PoC Make a booking to get a customer account Login via API and get access token: curl...

Salon booking system < 7.6.3 - Customer+ Bookings/Customers Data Disclosure

The plugin does not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data Make a booking to get a customer account Login via API and get access token: curl...

Salon booking system < 7.6.3 - Unauthenticated Sensitive Data Disclosure

The plugin does not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number of the person who booked it. Although the API only retur...