High Severity Vulnerability Patched in Download Manager Plugin

On July 8, 2022 the Wordfence Threat Intelligence team initiated the responsible disclosure process for a vulnerability we discovered in “Download Manager,” a WordPress plugin that is installed on over 100,000 sites. This flaw makes it possible for an authenticated attacker to delete arbitrary...

CVE-2022-30572

The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains an easily exploitable Directory Traversal vulnerability that allows a low privileged attacker with network access to read arbitrary resources on the affected system. Affected releases are TIBCO...

Cross site scripting

The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains easily exploitable Reflected Cross Site Scripting XSS vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's...

Directory traversal

The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains an easily exploitable Directory Traversal vulnerability that allows a low privileged attacker with network access to read arbitrary resources on the affected system. Affected releases are TIBCO...

CVE-2022-30572 TIBCO iWay Service Manager Directory Traversal Vulnerability

The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains an easily exploitable Directory Traversal vulnerability that allows a low privileged attacker with network access to read arbitrary resources on the affected system. Affected releases are TIBCO...

McAfee Agent Code Issue Vulnerability (CNVD-2022-55631)

McAfee Agent MA is a set of client components from McAfee, Inc. that provides secure communications between ePolicy Orchestrator antivirus management platform and managed products. A code issue vulnerability exists in McAfee Agent MA versions prior to 5.7.7, which stems from a vulnerability that...

JVN#81563390: "Hulu / フールー" App for iOS vulnerable to improper server certificate verification

"Hulu / フールー" App for iOS provided by HJ Holdings, Inc. is vulnerable to improper server certificate verification CWE-295. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the application Update the application to the latest versi...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Bottle vulnerability (USN-5532-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5532-1 advisory. It was discovered that Bottle incorrectly handled errors during early request binding. An attacker could possibly use this issue to disclo...

Apple iOS and iPadOS Buffer Overflow Vulnerability

Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for the iPad tablet computer. Apple iOS and iPadOS buffer overflow vulnerability, which originates from a boundary error in ImageIO when...

Apple iOS and iPadOS WebKit Buffer Overflow Vulnerability

Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for the iPad tablet computer. A buffer error vulnerability exists in Apple iOS and iPadOS, which stems from a boundary error in WebKit when...

Apple iOS and iPadOS ImageIO Buffer Overflow Vulnerability

Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for the iPad tablet computer. A buffer error vulnerability exists in Apple iOS prior to 15.6 and iPadOS prior to 15.6, which stems from a...

ICONICS GENESIS64 Path Traversal Vulnerability

ICONICS GENESIS64 is a suite of advanced HMI SCADA solutions designed for Microsoft operating systems from ICONICS, Inc. A path traversal vulnerability exists in ICONICS GENESIS64 versions 10.97 and 10.97.1, which allows a remote, unauthenticated attacker to access arbitrary files in the GENESIS6...

CVE-2022-28666

Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin = 1.7.7 at WordPress leading to &yikes-the-content-toggle option update...

Improper access control

Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin = 1.7.7 at WordPress leading to &yikes-the-content-toggle option update...

CVE-2022-28666 WordPress Custom Product Tabs for WooCommerce plugin <= 1.7.7 - Broken Access Control vulnerability

Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin = 1.7.7 at WordPress leading to &yikes-the-content-toggle option update...

CVE-2022-28666 WordPress Custom Product Tabs for WooCommerce plugin <= 1.7.7 - Broken Access Control vulnerability

Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin = 1.7.7 at WordPress leading to &yikes-the-content-toggle option update...

CVE-2022-28666

CVE-2022-28666 affects the YIKES Inc. Custom Product Tabs for WooCommerce plugin for WordPress, specifically versions

PT-2022-19152

Name of the Vulnerable Software and Affected Versions YIKES Inc. Custom Product Tabs for WooCommerce plugin version 1.7.7 and earlier Description The issue is related to a Broken Access Control vulnerability, which allows for the update of the yikes-the-content-toggle option. This vulnerability...

WordPress plugin YIKES Inc. Custom Product Tabs for WooCommerce 授权问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An authorization issue vulnerability exists...

Johnson Controls Metasys ADS, ADX, OAS

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls, Inc Equipment: Metasys ADS, ADX, OAS with MUI Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow...