GHSA-QFG7-WC25-R3J2 eGroupware Community Edition Stored XSS vulnerability

Stored XSS vulnerability in eGroupware Community Edition before 16.1.20170922 allows an unauthenticated remote attacker to inject JavaScript via the User-Agent HTTP header, which is mishandled during rendering by the application administrator...

TIBCO Software JasperReports Server 跨站脚本漏洞

TIBCO Software JasperReports Server is an embeddable reporting server from TIBCO Software, Inc. that provides reporting and analytics capabilities that can be embedded into web or mobile devices. A security vulnerability exists in TIBCO Software JasperReports Server that could allow an attacker...

The vulnerability of the update process for Cisco Unified Communications Manager (CM) and Cisco Unified Communications Manager Session Management Edition (SME) allows a perpetrator to write arbitrary files.

The vulnerability of the Cisco Unified Communications Manager CM and Cisco Unified Communications Manager Session Management Edition SME system updates lies in improper external management of file names or paths. Exploiting this vulnerability allows a malicious actor to write arbitrary files usin...

The vulnerability in the web interface of the Cisco Unified Communications Manager (CM), Cisco Unified Communications Manager Session Management Edition (SME), and the integrated messaging system Cisco Unity Connection allows a perpetrator to perform cross-site scripting attacks.

The vulnerability of the Web interface for managing Cisco Unified Communications Manager CM, Cisco Unified Communications Manager Session Management Edition SME, and the integrated messaging system Cisco Unity Connection is related to the lack of security measures taken to protect the web page...

Oracle Java SE Multiple Vulnerabilities (April 2022 CPU)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory: - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Librarie...

CVE-2022-30523

Trend Micro Password Manager Consumer version 5.0.0.1266 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow a low privileged local attacker to delete the contents of an arbitrary folder as SYSTEM which can then be used for privilege escalation on the...

Security Bulletin: A vulnerability in IBM Java SDK affects IBM Standards Processing Engine and IBM Transformation Extender Advanced (CVE-2015-4872)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 7 and 8, that is used by IBM Standards Processing Engine and IBM Transformation Extender Advanced. This issue was disclosed as part of the IBM Java SDK updates for October 2015. Vulnerability Details CVEID: CVE-2015-48...

Debian DLA-3006-1 : openjdk-8 - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3006 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affected are Oracle...

GHSA-Q8CR-XPHM-7GFV Akeneo PIM vulnerable to shell injection in the mass edition

Akeneo PIM CE and EE 1.6.6, 1.5.15, 1.4.28 are vulnerable to shell injection in the mass edition, resulting in remote execution...

Akeneo PIM vulnerable to shell injection in the mass edition

Akeneo PIM CE and EE 1.6.6, 1.5.15, 1.4.28 are vulnerable to shell injection in the mass edition, resulting in remote execution...

GHSA-4262-WR7P-GPCJ Rundeck Community Edition vulnerable to Cross-site Scripting

An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditorKO.js and views/execution/wfitemEdit.gsp...

Rundeck Community Edition vulnerable to Cross-site Scripting

An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditorKO.js and views/execution/wfitemEdit.gsp...

The vulnerability of the Cisco Discovery Protocol implementation in Cisco Unified Communications Manager (CM) and Cisco Unified Communications Manager Session Management Edition (SME) systems allows a attacker to cause service interruptions.

The vulnerability of the Cisco Discovery Protocol implementation in Cisco Unified Communications Manager CM and Cisco Unified Communications Manager Session Management Edition SME systems is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability could all...

CVE-2022-22798

Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects him to the service portal or EndUserPortal.JSP, then he needs to change the path in the URL to /ConcurrentLogin%2ejsp...

CVE-2022-22798

Sysaid – Pro Plus Edition (v20.4.74 b10 through v22.1.30 b49) suffers a broken access control vulnerability where an attacker logged in as a guest can manipulate the URL (ending in /ConcurrentLogin%2ejsp) to access the system dashboard via EndUserPortal.JSP, potentially exposing server details, u...

CVE-2022-22798 Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control

Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects him to the service portal or EndUserPortal.JSP, then he needs to change the path in the URL to /ConcurrentLogin%2ejsp...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Oct 2021and Jan 2022

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 8 that are used by Rational Software Architect Designer and Rational Software Architect Designer for Websphere Software. These issues were disclosed as part of the IBM Java SDK updates in Oct 2021 and Jan 20...

@web-desktop-environment/development-edition-server (>=0.0.4, <=1.0.2), @web-desktop-environment/pack-dev (>=1.0.1-alpha.1, <=1.0.2) potentially affected by CVE-2021-42648 via code-server (>=3.9.2, <=3.9.3)

code-server NPM version =3.9.2, =0.0.4, =1.0.1-alpha.1, =1.0.2 Source cves: CVE-2021-42648 Source advisory: OSV:GHSA-2GP3-6C9P-JP7W...

Security Bulletin: IBM MQ is vulnerable to multiple issues in IBM® Runtime Environment Java™ Technology Edition, Version 8 and Version 7 (CVE-2021-35578, CVE-2021-35588, CVE-2021-41035)

Summary Multiple issues were identified in IBM® Runtime Environment Java™ Technology Edition, Version 8 and IBM® Runtime Environment Java™ Technology Edition, Version 7 which affect IBM MQ. Vulnerability Details CVEID: CVE-2021-35578 DESCRIPTION: An unspecified vulnerability in Java SE related to...

CVE-2022-1545

It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1 if an unauthorised project member was tagged in the note...