CVE-2022-36437

The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affecte...

CVE-2022-36437

The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affecte...

Add any thoughts via CSRF

Description An attacker can add any user thoughts via a CSRF attack When you send a link to the victim and click on it, any thoughts will be added Proof of Concept 1- When the attacker adds any thoughts, it then intercepts the request 2- Take this request to generate a CSRF PoC history.pushState'...

GHSA-C5HG-MR8R-F6JP Hazelcast connection caching

Impact The Connection handler in Hazelcast and Hazelcast Jet allows an unauthenticated, remote attacker to access and manipulate data in the cluster with another authenticated connection's identity. The affected Hazelcast versions are through 3.12.12, 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The...

Images Optimize and Upload CF7 <= 2.1.4 - Unauthenticated Arbitrary File Deletion

The plugin does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack. 1. Install contact-form-7 dependency 2. Install the vulnerable plugin images-optimize-and-upload-cf7...

Vulnerabilities fixed in NetApp Clustered Data ONTAP

NetApp has fixed several vulnerabilities in Clustered Data ONTAP. The vulnerabilities are in underlying libraries such as libcurl, libexpat and libxml2. The vulnerabilities allow a malicious party to cause a denial-of-service, gain access to sensitive data and/or manipulate it. NetApp has release...

Spitfire CMS 1.0.475 (cms_backup_values) PHP Object Injection

Summary Spitfire is a system to manage the content of webpages. Description The application is prone to a PHP Object Injection vulnerability due to the unsafe use of unserialize function. A potential attacker, authenticated, could exploit this vulnerability by sending specially crafted requests t...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK (October 2022) affect IBM InfoSphere Information Server

Summary There are multiple vulnerabilities in the IBM® SDK Java™ Technology Edition, Version 8 that is used by IBM InfoSphere Information Server. These issues were disclosed as part of the IBM Java SDK updates in October 2022. Vulnerability Details CVEID:CVE-2022-21626 DESCRIPTION: An unspecified...

DEBIAN-CVE-2022-32224

A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record 7.0.3.1, 6.1.6.1, 6.0.5.1 and 5.2.8.1 which could allow an attacker, that can manipulate data in the database via means like SQL injection, the ability to escalate to an RCE...

UBUNTU-CVE-2022-32224

A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record 7.0.3.1, 6.1.6.1, 6.0.5.1 and 5.2.8.1 which could allow an attacker, that can manipulate data in the database via means like SQL injection, the ability to escalate to an RCE...

Security Bulletin: IBM Sterling Control Center is vulnerable to unauthenticated data manipulation due to Java SE (CVE-2021-2163)

Summary IBM Sterling Control Center has addressed a Java SE difficult to exploit vulnerability that allows unauthenticated attacker with network access to successfully create, delete or modify critical data. Vulnerability Details CVEID:CVE-2021-2163 DESCRIPTION: An unspecified vulnerability in Ja...

PT-2022-27523 · Acronis +2 · Acronis Agent +4

Name of the Vulnerable Software and Affected Versions: Acronis Agent versions before build 29633 Acronis Cyber Protect 15 versions before build 30984 Description: The issue is related to sensitive information disclosure and manipulation due to improper certification validation. This affects Acron...

Vulnerabilities fixed in Liferay Portal

Vulnerabilities have been fixed in Liferay Portal. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Cross-Site Scripting XSS. Manipulation of data Remote code execution User Rights SQL Injection Access to sensitiv...

Vulnerabilities fixed in PHP

Vulnerabilities have been fixed in PHP. The vulnerabilities allow a malicious person to perform attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution User rights Access to system data PHP developers have released updates to...

Vulnerabilities fixed in IBM QRadar SIEM

IBM has fixed vulnerabilities in QRadar SIEM and in the QRadar Assistant App. A malicious party could potentially exploit them for attacks that could result in the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution User rights Access to sensitive data...

Vulnerabilities fixed in Cisco products

Vulnerabilities have been fixed in the following Cisco products: Cisco Adaptive Security Appliance ASA. Cisco Firepower Management Center Cisco Firepower Threat Defense Cisco Secure Firewall Snort The vulnerabilities allow a malicious party to launch attacks execute attacks that result in the...

Vulnerabilities fixed in Juniper Junos Space

Juniper has fixed several vulnerabilities in Third-Party products fixed in Junos Space. For the vulnerabilities, previous security advisories published for the specific product. Juniper has bundled the third-party updates into the new release of Junos Space. A malicious party could exploit the...

Vulnerabilities fixed in Cisco Identity Serrvices Engine (ISE).

Cisco has fixed several vulnerabilities in the Identity Services Engine ISE. A malicious person with access to the management interface can exploit the vulnerabilities for attacks that can lead to the following categories of damage: Cross-Site Request Forgery XSRF. Cross-Site Scripting XSS...

PT-2022-10461 · Unknown · Hospital Management System

Name of the Vulnerable Software and Affected Versions: Hospital Management System version 4.0 Description: The issue concerns SQL Injection, which can be exploited via the file hospital/hms/admin/view-patient.php. This allows for potential unauthorized access or manipulation of data...

mysql: Server: DML unspecified vulnerability (CPU Oct 2021)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...