Command injection

The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin...

CVE-2022-22984 Command Injection

The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin...

InsightIDR Launches Integration With New AWS Security Data Lake Service

It has been an action-packed day at AWS re:Invent. For security professionals, one of the most exciting announcements has to be the launch of Amazon Security Lake. We see a lot of potential for this new service, which is why Rapid7 is proud to announce the immediate availability of an integration...

Important: Red Hat Security Advisory: Red Hat Fuse 7.11.1 release and security update

A minor version update from 7.11 to 7.11.1 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

AutoPxGlp and AutoPxGmx are not compliant with ERC4626 standard

Lines of code Vulnerability details Proof of Concept In both contracts, the previewWithdraw function has the same body // Calculate shares based on the specified assets' proportion of the pool uint256 shares = convertToSharesassets; // Save 1 SLOAD uint256 totalSupply = totalSupply; // Factor in...

The vulnerability in the overwrite.config.php implementation: The $domain parameter of the web application for data synchronization with ownCloud allows attackers to perform spoofing attacks.

The vulnerability of the overwrite.config.php script, where $domain is used for the web application’s data synchronization with ownCloud, is related to configuration errors when processing the OWNCLOUDDOMAIN variable. Exploiting this vulnerability allows a malicious actor to perform spear-phishin...

AZL-11465 CVE-2022-4055 affecting package xdg-utils 1.1.3-7

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attac...

CVE-2022-41685 Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Integration for Szamlazz.hu & WooCommerce and Csomagpontok és szállítási címkék WooCommerce hez plugins

Multiple Cross-Site Request Forgery CSRF vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin = 5.6.3.2 and Csomagpontok és szállítási címkék WooCommerce-hez plugin = 1.9.0.2 on WordPress...

CVE-2022-41685

CVE-2022-41685 covers CSRF vulnerabilities in two WordPress/WooCommerce plugins: Viszt Péter s Integration for Szamlazz.hu & WooCommerce (<= 5.6.3.2) and Csomagpontok és szállítási címkék WooCommerce-hez (5.6.3.2 (5.6.3.3+), and upgrade Csomagpontok plugin to >1.9.0.2 (1.9.0.3+). Base CVSS...

CVE-2022-41685 Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Integration for Szamlazz.hu & WooCommerce and Csomagpontok és szállítási címkék WooCommerce hez plugins

Multiple Cross-Site Request Forgery CSRF vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin = 5.6.3.2 and Csomagpontok és szállítási címkék WooCommerce-hez plugin = 1.9.0.2 on WordPress...

WordPress plugin Integration for Szamlazz.hu & WooCommerce 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. WordPress plugin Integration for...

Rapid7 and HashiCorp Partner to Secure Terraform-based Cloud Infrastructure Deployments

Welcome to the latest installment in our cloud security “shift-left” blog series. In our last post, we covered the importance of integrating cloud infrastructure security assessments into DevOps tools and enabling Infrastructure as Code IaC developers. This time, we’re focusing on Rapid7’s recent...

SD-WAN Integration: Routing Traffic to Optimize Network Performance

Optimize network performance with SD-WAN integration to automatically route traffic to the nearest Akamai Secure Internet Access point of presence...

Plaintext Storage of a Password in Jenkins NS-ND Integration Performance Publisher Plugin

NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These passwords can be viewed by attackers with Item/Extended Read permission or access to the Jenkins controller file...

GHSA-3VWM-FC87-MQ6H Jenkins NS-ND Integration Performance Publisher Plugin disables SSL/TLS certificate validation globally and unconditionally

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM. NS-ND Integration Performance Publisher Plugin 4.8.0.146 no longer disables SSL/TLS certificate and...

GHSA-VJ5R-MMP4-3HRX SSL/TLS certificate validation unconditionally disabled by Jenkins NS-ND Integration Performance Publisher Plugin

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validation for several features. Currently, there are no known workarounds or patches...

Donation Button <= 4.0.0 - Subscriber+ Broken Access Control leading to SMS Spam

The plugin does not properly check for privileges and nonce tokens in its "donationbuttontwiliosendtestsms" AJAX action, which may allow any users with an account on the affected site, like subscribers, to use the plugin's Twilio integration to send SMSes to arbitrary phone numbers. PoC While...

IBM InfoSphere Information Server Information Disclosure Vulnerability (CNVD-2022-85418)

IBM InfoSphere Information Server is a data integration platform from International Business Machines IBM. IBM InfoSphere Information Server versions 8.1, 8.5 and 8.7 contain an information disclosure vulnerability that stems from a program that does not properly restrict directories. An...

CVE-2022-45392

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenkins controller file system...

CVE-2022-45391

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM...