CVE-2022-1334

The WP YouTube Live WordPress plugin before 1.8.3 does not validate, sanitise and escape various of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-1334

The WP YouTube Live WordPress plugin before 1.8.3 does not validate, sanitise and escape various of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-1334

The CVE-2022-1334 entry concerns the WordPress WP YouTube Live plugin (versions before 1.8.3). The vulnerability stems from insufficient validation, sanitization, and escaping of multiple settings, enabling Cross-Site Scripting (XSS) by high-privilege users (e.g., admins), even when unfiltered_ht...

WordPress plugin WP YouTube Live 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions of WordPress WP YouTube Lives plugin prior to 1.8.3,...

Shiba vulnerable to XSS leading to code execution

Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration...

GHSA-GRP5-H379-J75X OpenStack Nova live snapshots use an insecure local directory

OpenStack Compute Nova Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporary directory used to store live snapshots, which allows local users to read and modify live snapshots...

GHSA-8Q95-JJ7P-X93X Openstack Neutron vulnerable to eavesdropping on private traffic

Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively down prior to live-migration and kept down after the migration is complete. This is possible due ...

Openstack Neutron vulnerable to eavesdropping on private traffic

Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively down prior to live-migration and kept down after the migration is complete. This is possible due ...

SUSE SLES12: kgraft-patch-4_4_180-94_144-default / etc (SUSE-SU-2022:1640-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1640-1 advisory. This update for the Linux Kernel 4.4.180-94144 fixes one issue. The following security issue was fixed: - CVE-2022-0330: A random memory...

SUSE: Security Advisory (SUSE-SU-2022:1641-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2022:1640-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES12 / SLES15 Security Update : kernel (Live Patch 20 for SLE 12 SP4) (SUSE-SU-2022:1589-1)

The remote SUSE Linux SLES12 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1589-1 advisory. - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run...

SUSE SLES12 Security Update : kernel (Live Patch 30 for SLE 12 SP5) (SUSE-SU-2022:1611-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2022:1611-1 advisory. - A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write. This flaw allows a local user to gain...

SUSE SLES15 Security Update : kernel (Live Patch 30 for SLE 15 SP1) (SUSE-SU-2022:1593-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1593-1 advisory. This update for the Linux Kernel 4.12.14-150100197111 fixes several issues. The following security issues were fixed: - CVE-2022-1011: A...

SUSE SLES15 Security Update : kernel (Live Patch 26 for SLE 15 SP2) (SUSE-SU-2022:1634-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1634-1 advisory. - In aiopollcompletework of aio.c, there is a possible memory corruption due to a use after free. This could lead to local escalati...

SUSE SLES15 Security Update : kernel (Live Patch 11 for SLE 15 SP3) (SUSE-SU-2022:1569-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1569-1 advisory. - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run...

SUSE SLES15 Security Update : kernel (Live Patch 17 for SLE 15 SP3) (SUSE-SU-2022:1573-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1573-1 advisory. This update for the Linux Kernel 5.3.18-1503005963 fixes several issues. The following security issues were fixed: - - CVE-2022-1158: Fixed KVM...

WordPress JivoChat Live Chat plugin <= 1.3.5.3 - Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability

Stored Cross-Site Scripting XSS via Cross-Site Request Forgery CSRF vulnerability discovered by Muhamad Hidayat in WordPress JivoChat Live Chat plugin versions = 1.3.5.3. Solution Update the WordPress JivoChat Live Chat plugin to the latest available version at least 1.3.5.4...

Exploit for Improper Access Control in Samsung Livewallpaperservice

Improper access control vulnerability in LiveWallpaperService...

New Sophisticated Malware

Mandiant is reporting on a new botnet. The group, which security firm Mandiant is calling UNC3524, has spent the past 18 months burrowing into victims networks with unusual stealth. In cases where the group is ejected, it wastes no time reinfecting the victim environment and picking up where thin...