CVE-2023-26480: Improper Neutralization of Input During Web Page Generation

XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scripting by using the Live Data macro. This has been patched in XWiki 14.9, 14.4.7, and 13.10.10. There are no known workarounds...

SUSE SLES12: kernel-livepatch-5_3_18-150200_24_112-default / etc (SUSE-SU-2023:0560-1)

The remote SUSE Linux SLES12 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0560-1 advisory. This update for the Linux Kernel 4.12.14-122116 fixes one issue. The following security issue was fixed: - CVE-2022-3564: Fixed use-after-free ...

SUSE SLES15 Security Update : kernel (Live Patch 20 for SLE 15 SP3) (SUSE-SU-2023:0578-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0578-1 advisory. This update for the Linux Kernel 5.3.18-1503005976 fixes several issues. The following security issues were fixed: - CVE-2022-3564: Fixed...

SUSE SLES15 Security Update : kernel (Live Patch 19 for SLE 15 SP3) (SUSE-SU-2023:0553-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0553-1 advisory. This update for the Linux Kernel 5.3.18-1503005971 fixes several issues. The following security issues were fixed: - CVE-2022-3564: Fixed...

New EX-22 Tool Empowers Hackers with Stealthy Ransomware Attacks on Enterprises

A new post-exploitation framework called EXFILTRATOR-22 aka EX-22 has emerged in the wild with the goal of deploying ransomware within enterprise networks while flying under the radar. "It comes with a wide range of capabilities, making post-exploitation a cakewalk for anyone purchasing the tool,...

Important: Red Hat Security Advisory: kpatch-patch security update

An update for kpatch-patch is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Important: Red Hat Security Advisory: kpatch-patch security update

An update for kpatch-patch is now available for Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

SUSE SLES12: kernel-livepatch-4_12_14-197_108-default / etc (SUSE-SU-2023:0528-1)

The remote SUSE Linux SLES12 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0528-1 advisory. This update for the Linux Kernel 4.12.14-122113 fixes one issue. The following security issue was fixed: - CVE-2022-3564: Fixed use-after-free ...

SUSE SLES12: kernel-livepatch-4_12_14-150100_197_111-default / etc (SUSE-SU-2023:0552-1)

The remote SUSE Linux SLES12 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0552-1 advisory. This update for the Linux Kernel 4.12.14-122124 fixes one issue. The following security issue was fixed: - CVE-2022-3564: Fixed use-after-free ...

SUSE SLES12: kernel-livepatch-5_3_18-150200_24_139-default / etc (SUSE-SU-2023:0525-1)

The remote SUSE Linux SLES12 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0525-1 advisory. This update for the Linux Kernel 4.12.14-122139 fixes one issue. The following security issue was fixed: - CVE-2022-3564: Fixed use-after-free ...

SUSE SLES12: kernel-livepatch-4_12_14-150100_197_131-default / etc (SUSE-SU-2023:0519-1)

The remote SUSE Linux SLES12 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0519-1 advisory. This update for the Linux Kernel 4.12.14-150100197131 fixes one issue. The following security issue was fixed: - CVE-2022-3564: Fixed...

K01112063: NGINX ngx_http_hls_module vulnerability CVE-2022-41743

Security Advisory Description NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngxhttphlsmodule that might allow a local attacker to corrupt NGINX worker memory, resulting in its crash or potential other impact using a specially crafted audio or video file. The issu...

K03202240: FFmpeg vulnerabilities CVE-2016-1897 and CVE-2016-1898

Security Advisory Description CVE-2016-1897 FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a...

Important: Red Hat Security Advisory: kpatch-patch security update

An update for kpatch-patch is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

Important: Red Hat Security Advisory: kpatch-patch security update

An update for kpatch-patch is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

CVE-2022-4669

The Page Builder: Live Composer WordPress plugin before 1.5.23 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

Cross site scripting

The Page Builder: Live Composer WordPress plugin before 1.5.23 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

CVE-2022-4669 Page Builder: Live Composer < 1.5.23 - Contributor+ Stored XSS via Shortcode

The Page Builder: Live Composer WordPress plugin before 1.5.23 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

CVE-2022-4669 Page Builder: Live Composer < 1.5.23 - Contributor+ Stored XSS via Shortcode

The Page Builder: Live Composer WordPress plugin before 1.5.23 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

CVE-2022-4669

The CVE-2022-4669 entry concerns the Page Builder: Live Composer WordPress plugin, affected up to version 1.5.22 where shortcode attributes were not properly validated/escaped before output in posts/pages. This stored-XSS flaw could enable a contributor+ user to inject malicious scripts via short...