Security Bulletin: MAS Monitor 8.4, 8.5, and 8.6 log4j

Summary A new vulnerability with log4j has been detected. MAS Monitor uses log4j in all releases and interim fixes are now available for our 8.4, 8.5 and 8.6 releases. More details of the vulnerability are available here: https://nvd.nist.gov/vuln/detail/CVE-2021-44228 Vulnerability Details...

Security Bulletin: CVE-2021-44228 log4j affects MAS Monitor 8.4, 8.5 and 8.6

Summary A new vulnerability with log4j has been detected. MAS Monitor uses log4j in all releases and interim fixes are now available for our 8.4, 8.5 and 8.6 releases. More details of the vulnerability are available here: https://nvd.nist.gov/vuln/detail/CVE-2021-44228 Vulnerability Details CVEID...

WordPress Download Monitor Plugin Cross-Site Scripting (CVE-2021-23174)

A stored cross-site scripting vulnerability exists in Download Monitor Plugin for WordPress. The vulnerability is due to insufficient sanitization of user-supplied data in posttitle parameter...

PT-2022-18380 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idcCMS version 1.10 Description: The issue allows attackers to arbitrarily delete the install.lock file, resulting in a reset of the CMS settings and data. Recommendations: For idcCMS version 1.10, consider restricting access to the...

Security Bulletin: Multiple vulnerabilities fixed in IBM Maximo Application Suite Monitor

Summary IBM Maximo Application Suite Monitor is vulnerable to Multiple vulnerabilities. See Vulnerability Details. This has been addressed in each of the components; refer to the Remediation section for details. Vulnerability Details CVEID: CVE-2020-15265 DESCRIPTION: Tensorflow is vulnerable to ...

WordPress Download Monitor plugin cross-site scripting vulnerability

WordPress is a set of blogging platform developed using PHP language. File Upload is one of the file upload plugins used in it. WordPress plugin is an application plugin. The vulnerability is caused by the vulnerable parameters &posttitle, &downloadablefileversion0. An attacker could exploit this...

WordPress Download Monitor plugin arbitrary file download vulnerability

WordPress is a blogging platform developed using the PHP language. File Upload is a file upload plugin used in it. WordPress plugin is an application plugin. WordPress Download Monitor plugin version 4.4.6 and previous versions are vulnerable to arbitrary file download. stems from the fact that t...

GHSA-5MPF-HW8F-86W9 Sensitive parameter values captured in build metadata files by Jenkins Parameterized Trigger Plugin

Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, including password parameter values, in their build.xml files. These values are stored unencrypted and can be viewed by users with access to...

WordPress Simple Download Monitor path traversal vulnerability

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Simple Download Monitor has a path traversal vulnerability, which can be exploited by an attacker with a rol...

Hikvision IP Camera - Backdoor

Exploit Title: Hikvision IP Camera - Backdoor Date: 14/03/2022 Exploit Author: Sobhan Mahmoodi Reference: https://ipvm.com/reports/hik-exploit GitHub: https://github.com/bp2008/HikPasswordHelper/ Hikvision included a magic string that allowed instant access to any camera, regardless of what the...

PT-2022-18281 · Jenkins · Jenkins Parameterized Trigger Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Parameterized Trigger Plugin versions 2.43 and earlier Description: The issue concerns the capture and storage of environment variables, including password parameter values, in build.xml files by the Jenkins Parameterized Trigger...

CVE-2021-24692

The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web server such as wp-config.php via a path traversal vector...

CVE-2021-24692 Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path Traversal

The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web server such as wp-config.php via a path traversal vector...

CVE-2021-24692

The CVE concerns the WordPress plugin Simple Download Monitor (before 3.9.5). Affected component: the plugin’s access control/file serving logic allows users with roles as low as Contributor to download arbitrary files from the web server (e.g., wp-config.php) via a path traversal vector. Root ca...

WordPress plugin 路径遍历漏洞

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Simple Download Monitor has a path traversal vulnerability, which can be exploited by an attacker with a rol...

CVE-2021-43077

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the AP...

CVE-2021-43077

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the AP...

CVE-2021-43077

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the AP...

Sql injection

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the AP...

CVE-2021-43077

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the AP...