IBM Cloud Pak System Encryption Issue Vulnerability

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. The product supports cross-hybrid cloud deployment, management, and mobile application environments. IBM Cloud Pak System has an encryption issue vulnerability that stems from t...

CVE-2021-42646

CVE-2021-42646 is an XML External Entity (XXE) vulnerability in the file-based Service Provider Creation feature of the WSO2 Management Console. Affected: WSO2 API Manager 2.6.0, 3.0.0, 3.1.0, 3.2.0, 4.0.0; WSO2 Identity Server as Key Manager 5.7.0, 5.9.0, 5.10.0; WSO2 Identity Server 5.7.0, 5.8....

Malicious Open Source: the cost of using someone else’s code

Hello everyone! This video was recorded for the VMconf 22 Vulnerability Management conference, vmconf.pw. I will be talking about malicious open source and the cost of using someone elses code. Alternative video link for Russia: Video in Russian from CISO Forum 2022: To be honest, at the beginnin...

Information disclosure

In TBD of TBD, there is a possible way to decrypt local data encrypted by the GSC due to improperly used crypto. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

CVE-2022-29140

Technical details about CVE-2022-29140 (Windows Print Spooler information disclosure) are not publicly provided in the supplied Connected Documents. No specific affected product/version or remediation is described here; monitor official advisories for updates.

CVE-2022-20121

CVE-2022-20121 describes an information-disclosure vulnerability in Android related to the USCCDMPlugin/USCCDMService. The root cause is a missing permission check in getNodeValue of USCCDMPlugin.java, enabling local disclosure of ICCID with no extra execution privileges and without user interact...

CVE-2022-29801

CVE-2022-29801 describes an XML External Entity (XXE) vulnerability in Siemens Teamcenter. Affected products are Teamcenter v12.4 (all versions before 12.4.0.13) and v13.0 (all versions before 13.0.0.9). The root cause is improper restriction/handling of XML external entities, allowing an attacke...

CVE-2022-24043

Siemens Desigo DXR2, PXC3, PXC4 and PXC5 are affected by CVE-2022-24043 due to a login-side-channel: the system does not normalize response times between failed logins with wrong usernames and correct usernames, enabling username enumeration. Affected versions are: Desigo DXR2 < v01.21.142.5-2...

CVE-2022-24039

The CVE-2022-24039 vulnerability affects Siemens Desigo PXC4 (pre-2.20.142.10-10884) and Desigo PXC5 (pre-2.20.142.10-10884). The addCell JavaScript function does not properly sanitize user-controlled input when building the XML for XLS reports, allowing injection of arbitrary content (e.g., XML ...

Improper Access Control in wp-graphql

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site...

GHSA-W3XG-7Q6M-3XWP Improper Access Control in wp-graphql

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site...

nonagones.info Cross Site Scripting vulnerability OBB-2613537

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-30286

CVE-2022-30286 affects pyscriptjs (PyScript Demonstrator) in PyScript up to 2022-05-04. Multiple connected sources document that a remote attacker could read Python source code from the victim’s environment via PyScript usage. The available records do not provide detailed root-cause analysis beyo...

Hospital Management System SQL Injection Vulnerability

Hospital Management System HMS is a computer system that helps manage health care-related information and helps health care providers do their jobs efficiently. v1.0 of Hospital Management System is vulnerable to SQL injection, which can be exploited by attackers via the patientsearch.php with th...

CVE-2021-39020

IBM Guardium Data Encryption (GDE) has an information disclosure vulnerability (CVE-2021-39020) where sensitive data is stored in URL parameters. Affected: Vormetric Data Security Manager (DSM) inside GDE Server 4.0.0.7 and earlier. Impact described as potential exposure via server logs, referrer...

CVE-2022-27925

creationtimestamp| type| source ---|---|--- 2022-05-05 14:03:26+00:00| seen| https://t.me/ptswarm/123 2022-06-22 11:01:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/6249 2022-08-12 12:07:32+00:00| exploited| https://t.me/truesecator/3286 2022-08-12 18:43:37+00:00|...

CVE-2022-28461

The CVE-2022-28461 entry concerns Mingyuefusu Library Management System. Connected sources confirm a SQL Injection vulnerability affecting all versions as of 2022-03-27, with root cause described as improper preprocessing of SQL data in src/javabean/JDBCBean.java (CN/CNNVD detail). This is suppor...

Thousands of Borrowers' Data Exposed from ENCollect Debt Collection Service

An ElasticSearch server instance that was left open on the Internet without a password contained sensitive financial information about loans from Indian and African financial services. The leak, which was discovered by researchers from information security company UpGuard, amounted to 5.8GB and...

CVE-2022-25786

GateManager exposes an unprotected alternate channel in its debug console that can disclose sensitive information. Affected product: GateManager, all versions prior to 9.7. Root cause: unprotected alternate channel in the debug console. Impact: confidentiality loss of information. Mitigation deta...

CVE-2022-29969

CVE-2022-29969 describes a cross-site scripting (XSS) vulnerability in the MediaWiki RSS extension prior to 2022-04-29. The issue arises when an RSS feed is processed with the RSS whitelist enabled ($wgRSSUrlWhitelist) and $wgRSSAllowLinkTag set to true, allowing an attacker-controlled rss elemen...