org.apache.cxf.systests:cxf-systests-uncategorized (3.2.14), org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-jms (4.3.27.release_1) +5 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.27.release)

org.springframework:spring-messaging MAVEN version 4.3.27.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - org.apache.cxf.systests:cxf-systests-uncategorized 3.2.14 -...

cn.home1:oss-configserver (>=1.0.6.oss, <=1.0.7.oss), cn.home1:oss-turbine (>=1.0.6.oss, <=1.0.7.oss) +479 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.3.release)

org.springframework:spring-messaging MAVEN version 4.3.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - cn.home1:oss-configserver =1.0.6.oss, =1.0.6.oss, =1.1.14-release,...

com.almis.awe:awe-annotation (>=4.0.3, <=4.1.1), com.almis.awe:awe-annotations-spring-boot-starter (>=4.0.3, <=4.1.1) +428 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.14.release)

org.springframework:spring-messaging MAVEN version 4.3.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - com.almis.awe:awe-annotation =4.0.3, =4.0.3, =4.0.4, =4.0.3, =4.0.3, =4.0.3,...

br.jus.stf.digital:core (>=0.2.0, <=1.6.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (2.3) +139 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.6.release)

org.springframework:spring-messaging MAVEN version 4.3.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - br.jus.stf.digital:core =0.2.0, =1.1.32-release, =1.1.32-release,...

IBM MQ for HPE NonStop 信息泄露漏洞

IBM MQ IBM WebSphere MQ is a messaging middleware product from IBM. The product is mainly for the service-oriented architecture SOA to provide a reliable and proven messaging backbone. An information disclosure vulnerability exists in IBM MQ for HPE NonStop version 8.1.0, which can be exploited b...

ai.superstream:spring-kafka (>=2.8.4-alpha1, <=2.8.4-alpha6), biz.eyebeam.mssc:mssc-public-bom (>=1.0.1, <=1.0.5) +2369 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (>=5.3.0, <=5.3.19)

org.springframework:spring-messaging MAVEN version =5.3.0, =2.8.4-alpha1, =1.0.1, =1.0.3, =0.0.1-alpha, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =5.6.5, =5.6.5, =5.3.0, =5.6.5, =5.3.0, =5.3.0, =6.0.5 and more Source cves: CVE-2022-22971 Source advisory: MEND:CVE-2022-22971...

Vulnerabilities fixed in IBM MQ

IBM has fixed multiple vulnerabilities in supporting software supplied with IBM MQ. The vulnerabilities are in Java, Eclipse Jetty and Websphere Liberty and were previously fixed in the individual products. A malicious party could potentially exploit the vulnerabilities to cause a...

CVE-2019-25060

creationtimestamp| type| source ---|---|--- 2022-05-09 20:36:36+00:00| seen| https://t.me/cibsecurity/42187...

Low: Red Hat Security Advisory: Red Hat AMQ Broker 7.9.4 release and security update

Red Hat AMQ Broker 7.9.4 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

cloud.genesys:web-messaging-sdk (>=3.0.0, <=5.0.0), cn.acooly:acooly-auth-wechat-authenticator (>=5.2.1, <=5.2.2) +405 more potentially affected by CVE-2022-24891 via org.owasp.esapi:esapi (>=2.0.1, <=2.2.3.1)

org.owasp.esapi:esapi MAVEN version =2.0.1, =3.0.0, =5.2.1, =5.2.1, =5.2.1, =5.2.1, =5.2.1, =5.2.1, =5.2.1, =5.2.1, =5.2.1, =5.2.1, =5.2.1, =5.2.1, =5.2.2 - com.acooly:acooly-component-holiday 5.2.2 and more Source cves: CVE-2022-24891 Source advisory: MEND:CVE-2022-24891...

The vulnerability of the goform/formEMR30 component of the Symantec Messaging Gateway, which exists due to insufficient validation of input data, allows a perpetrator to execute arbitrary code or escalate their privileges.

The vulnerability of the goform/formEMR30 component of the Symantec Messaging Gateway exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to enhance their privileges or execute arbitrary code...

CVE-2022-24866 Exposure of Sensitive Information to an Unauthorized Actor in Discourse Assign

Discourse Assign is a plugin for assigning users to a topic in Discourse, an open-source messaging platform. Prior to version 1.0.1, the UserBookmarkSerializer serialized the whole User / Group object, which leaked some private information. The data was only being serialized to people who could...

CVE-2022-28053

creationtimestamp| type| source ---|---|--- 2022-04-25 16:36:13+00:00| seen| https://t.me/cibsecurity/41380...

Improper authorization - receptionist can read all secure messaging

Description Hi there openemr maintainers, I would like to report an improper authorization vulnerability in your source code. Proof of Concept 1. Install openemr in your system and create an admin account and a receptionist account 2. Use admin account and create a secure message by go to Portal...

WS-2022-0221

Improper authorization - receptionist can read all secure messaging in openemr/openemr before 700...

A Bootiful Podcast: Spring Cloud legend Glenn Renfro about batch processing, tasks, stream processing, data flow, and t-shirts

Hi, Spring fans! Welcome to another installment of A Bootiful Podcast! In this installment Josh Long @starbuxman talks to Spring Cloud luminary and all around lovable guy Glenn Renfro @cppwfs about batch processing, tasks, messaging, integration, data flow, and a million other things. Also:...

CVE-2022-24799

wire-webapp is the web application interface for the wire messaging service. Insufficient escaping in markdown “code highlighting” in the wire-webapp resulted in the possibility of injecting and executing arbitrary HTML code and thus also JavaScript. If a user receives and views such a malicious...

CVE-2022-24799

CVE-2022-24799 describes a cross-site scripting vulnerability in Wire Webapp caused by insufficient escaping of markdown code highlighting, allowing execution of arbitrary HTML/JavaScript in the victim’s browser. Affected: wire-webapp and connected Wire desktop clients. Impact per description: at...

CVE-2022-24799 Cross Site Scripting in Wire Webapp

wire-webapp is the web application interface for the wire messaging service. Insufficient escaping in markdown “code highlighting” in the wire-webapp resulted in the possibility of injecting and executing arbitrary HTML code and thus also JavaScript. If a user receives and views such a malicious...

Microsoft Skype for Business and Lync Spoofing Vulnerability

Microsoft Skype for Business Server is a secure, unified communications platform from Microsoft that provides instant messaging IM, audio and video calling, online conferencing, online status messaging, and sharing capabilities. A spoofing vulnerability exists in Microsoft Skype for Business and...