CVE-2022-1067

The CVE-2022-1067 issue affects LifePoint Informatics Patient Portal (Product: LifePoint Informatics Patient Portal; Affected Version: LPI 3.5.12.P30). It is an Authentication Bypass using an alternate path or channel (CWE-288) where navigating to a URL with a patient ID causes the server to gene...

CVE-2022-24804

CVE-2022-24804 affects Discourse where, in stable versions before 2.8.3 and beta versions before 2.9.0.beta4, the name of a group with restricted visibility can be leaked to any user who can see a category that uses that group for permissions. The underlying issue is an information disclosure in ...

CVE-2021-38929

CVE-2021-38929 affects IBM System Storage DS8000 Management Console (HMC) versions R8.5 88.5x.x.x, R9.1 89.1x.0.0, and R9.2 89.2x.0.0. The issue allows a remote attacker to obtain sensitive information via unpublished URLs (information disclosure). Affected IBM advisories note fixes in ICS patch ...

CVE-2022-27041

OpenSIS/Solution: CVE-2022-27041 is a SQL injection vulnerability in OpenSIS Classic 8.0 where the parameter student_id in /modules/eligibility/Student.php can be abused to inject SQL and exfiltrate data. The connected documents (CNVD, RH Red Hat, OSV, CNVD, NVD, CVELIST, CVE records, and related...

MTN Group: Unprotected Direct Object Reference

Hello MTN Security Team, During my hunting, I discovered that there's an Insecure Direct Object Reference on https://nin.mtnonline.com Vulnerable Path: https://nin.mtnonline.com/nin/success?message=1 Steps To Reproduce: You may not even require to submit any NIN before accessing this unprotected...

CVE-2022-28363

Reprise License Manager 14.2 is affected by a reflected cross-site scripting (XSS) vulnerability in the /goform/login_process endpoint, specifically the GET parameter username. No authentication is required. The issue allows arbitrary JavaScript execution in the victim’s browser, enabling potenti...

CVE-2022-27149

...

CVE-2022-24820

CVE-2022-24820 affects XWiki Platform: a guest user without view permissions can list documents by rendering velocity templates. The issue is fixed in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround documented in the provided sources. Exploitation status is not detail...

CVE-2022-20754 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities

Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow an authenticated, remote attacker with read/write privileges to the application to write files or execute arbitrary code on the...

CVE-2022-22410

IBM Watson Query with Cloud Pak for Data as a Service is affected by CVE-2022-22410. An authenticated internal attacker could exploit an exposed administrator APIKEY (GET APIKEY) to alter system configuration or view data sources and customer data. The vulnerability is tied to a mismanaged API ke...

ledonneasociados.com Cross Site Scripting vulnerability OBB-2472184

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

gesetzlichekrankenkassen.de Cross Site Scripting vulnerability OBB-2470806

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-25584

The CVE-2022-25584 entry affects Seyeon Tech FlexWATCH FW3170-PS-E Network Video System, specifically version 4.23-3000_GY. The connected documents confirm a vulnerability in that product that could allow attackers to access sensitive information via network access (attack vector: network; impact...

CVE-2022-0453

CVE-2022-0453 describes a use-after-free in Chrome/Chromium’s Reader Mode prior to 98.0.4758.80, allowing a remote attacker who already compromised the renderer process to potentially trigger heap corruption with a crafted HTML page. The vulnerability affects Chrome/Chromium’s rendering component...

CVE-2022-0791

CVE-2022-0791 describes a use-after-free in Google Chrome's Omnibox prior to 99.0.4844.51, enabling heap corruption when a user is coerced into specific interactions. The flaw allows remote code execution with a high impact (as reflected in multiple advisories) but exploitation requires user inte...

CVE-2022-0790

The CVE-2022-0790 issue is a use-after-free in Chrome’s Cast UI affecting Google Chrome prior to 99.0.4844.51. The root cause is a memory management error that could be triggered when a user interacts with a crafted HTML page, potentially enabling a sandbox escape. Multiple connected sources (e.g...

CVE-2022-1026

CVE-2022-1026 affects Kyocera multifunction printers running vulnerable Net View versions, where the address book export feature exposes user data (including usernames and passwords) due to insufficient access controls. The root cause is unprotected/exportable address book data, allowing unauthen...

CVE-2022-26233

CVE-2022-26233 affects Barco Control Room Management Suite prior to or equal to 2.9 Build 0275. The vulnerability is a local file inclusion/directory traversal (LFI) where inputs from URLs are not properly sanitized, allowing an attacker to read sensitive files. The attack vector described is a c...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM HTTP Server shipped with IBM Rational ClearCase

Summary IBM HTTP Server IHS is shipped as a component of IBM Rational ClearCase. Information about a security vulnerability affecting IHS has been published in a security bulletin. CVE-2022-25315, CVE-2022-25313, CVE-2022-25235, CVE-2022-25236 Vulnerability Details CVEID: CVE-2022-25315...

CVE-2022-26546

CVE-2022-26546 affects Hospital Management System v1.0. The root cause is lack of an authorization component, enabling unauthorized access to sensitive data and the admin password. Descriptions across multiple sources corroborate that the vulnerability stems from missing access control rather tha...