Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.9.35 bug fix and security update

Red Hat OpenShift Container Platform release 4.9.35 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.9. Red Hat Product Security has rated this update as having a...

GHSA-6MH2-98GR-WV76 phpBB Cross-Site Request Forgery (CSRF)

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS...

Avast Premium Security DLL劫持漏洞

Avast Premium Security is an application from the Czech company Avast. Avast Premium Security suffers from a DLL hijacking vulnerability that originates when the instup.exe and wscproxy.exe processes attempt to load a DLL by failing to specify the absolute path to the DLL. An attacker could use...

New Research Paper: Pre-hijacking Attacks on Web User Accounts

In 2020, MSRC awarded two Identity Project Research Grants to support external researchers working to further strengthen the security of identity protocols and systems. Today we are pleased to release the results of the first of these projects. This research, led by independent security researche...

CVE-2022-31467

A DLL hijacking vulnerability in the installed for Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, leading to execution of arbitrary code, via the installer not restricting the search path for required DLLs and then not verifying the signature...

CVE-2022-31467

A DLL hijacking vulnerability in the installed for Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, leading to execution of arbitrary code, via the installer not restricting the search path for required DLLs and then not verifying the signature...

CVE-2022-31467

A DLL hijacking vulnerability in the installed for Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, leading to execution of arbitrary code, via the installer not restricting the search path for required DLLs and then not verifying the signature...

Privilege escalation

A DLL hijacking vulnerability in the installed for Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, leading to execution of arbitrary code, via the installer not restricting the search path for required DLLs and then not verifying the signature...

CVE-2022-31467

A DLL hijacking vulnerability (CVE-2022-31467) affects Quick Heal Total Security prior to version 12.1.1.27. The installer does not restrict the DLL search path and fails to verify DLL signatures, enabling a local attacker to escalate privileges and execute arbitrary code. The Red Hat/NVD entries...

Security Bulletin: A vulnerability in IBM WebSphere Application Server Liberty affects IBM Spectrum Scale packaged in IBM ESS ( CVE-2021-39031)

Summary There is a vulnerability in IBM WebSphere Application Server Liberty, used by IBM ESS, which could allow a remote attacker to cause a denial of service. Vulnerability Details CVEID:CVE-2021-39038 DESCRIPTION: IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Libert...

New Research Paper: Pre-hijacking Attacks on Web User Accounts

In 2020, MSRC awarded two Identity Project Research Grants to support external researchers working to further strengthen the security of identity protocols and systems. Today we are pleased to release the results of the first of these projects. This research, led by independent security researche...

New Research Paper: Pre-hijacking Attacks on Web User Accounts

In 2020, MSRC awarded two Identity Project Research Grants to support external researchers working to further strengthen the security of identity protocols and systems. Today we are pleased to release the results of the first of these projects. This research, led by independent security researche...

CVE-2022-29182 DOM-based XSS in GoCD

GoCD is a continuous delivery server. GoCD versions 19.11.0 through 21.4.0 inclusive are vulnerable to a Document Object Model DOM-based cross-site scripting attack via a pipeline run's Stage Details Graphs tab. It is possible for a malicious script on a attacker-hosted site to execute script tha...

CVE-2022-28965

Multiple DLL hijacking vulnerabilities via the components instup.exe and wscproxy.exe in Avast Premium Security before v21.11.2500 allows attackers to execute arbitrary code or cause a Denial of Service DoS via a crafted DLL file...

CVE-2022-28965

Multiple DLL hijacking vulnerabilities via the components instup.exe and wscproxy.exe in Avast Premium Security before v21.11.2500 allows attackers to execute arbitrary code or cause a Denial of Service DoS via a crafted DLL file...

CVE-2022-28965

Multiple DLL hijacking vulnerabilities via the components instup.exe and wscproxy.exe in Avast Premium Security before v21.11.2500 allows attackers to execute arbitrary code or cause a Denial of Service DoS via a crafted DLL file...

Design/Logic Flaw

Multiple DLL hijacking vulnerabilities via the components instup.exe and wscproxy.exe in Avast Premium Security before v21.11.2500 allows attackers to execute arbitrary code or cause a Denial of Service DoS via a crafted DLL file...

CVE-2022-28965

Multiple DLL hijacking vulnerabilities via the components instup.exe and wscproxy.exe in Avast Premium Security before v21.11.2500 allows attackers to execute arbitrary code or cause a Denial of Service DoS via a crafted DLL file...

CVE-2022-28965

In Avast Premium Security, CVE-2022-28965 refers to DLL hijacking in the components instup.exe and wsc_proxy.exe prior to version 21.11.2500 . The vulnerability allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) by presenting a crafted DLL file, due to loading a DLL w...

Improper Access Control - Articles

Description A low-privileged user can modify and delete admin articles just by changing the value of the articleid parameter. Proof of Concept - Step 1 - Authenticated as an unprivileged user, create a New article - Step 2 - Click Edit article - Step 3 - Intercept requests and Save your article -...