CVE-2022-32407

CVE-2022-32407 affects Softr v2.0 with a Cross‑Site Scripting (XSS) issue in the Create A New Account module, exploitable via the First Name parameter to execute arbitrary scripts/HTML. Primary CVE entry notes a medium severity (CVSS v3.1 base score 6.1) with network access and user interaction r...

CVE-2022-32407

Softr v2.0 was discovered to contain a Cross-Site Scripting XSS vulnerability via the First Name parameter under the Create A New Account module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

A Pro-China Disinfo Campaign Is Targeting US Elections—Badly

The suspected Chinese influence operation had limited success. But it signals a growing threat from a new disinformation adversary...

USN-5696-1: MySQL vulnerabilities

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.31 in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. Ubuntu 18.04 LTS has been updated to MySQL 5.7.40. In addition to security fixes, the updated...

CVE-2022-3649

A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfsnewinode of the file fs/nilfs2/inode.c of the component BPF. The manipulation leads to use after free. It is possible to launch the attack remotely. It is recommended to apply a patch t...

CVE-2022-3649

A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfsnewinode of the file fs/nilfs2/inode.c of the component BPF. The manipulation leads to use after free. It is possible to launch the attack remotely. It is recommended to apply a patch t...

Unbreakable Enterprise kernel-container security update

5.4.17-2136.312.3.4 - Revert 'fs: check FMODELSEEK to control internal pipe splicing' Saeed Mirzamohammadi Orabug: 34666845 5.4.17-2136.312.3.3 cpusreadlock deadlock Tejun Heo Orabug: 34607590 - cgroup: Elide write-locking threadgrouprwsem when updating csses on an empty subtree Tejun Heo Orabug:...

CVE-2021-33231

Cross Site Scripting XSS vulnerability in New equipment page in EasyVista Service Manager 2018.1.181.1 allows remote attackers to run arbitrary code via the notes field...

Security Bulletin: QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM has released a new version which addresses the vulnerabilities. Vulnerability Details CVEID:CVE-2019-11358 DESCRIPTION: jQuery, as used in Drupal core, is...

assembly.state.ny.us Cross Site Scripting vulnerability OBB-3001858

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Metasploit Wrap-Up

Spring Cloud Gateway RCE This week, a new module that exploits a code injection vulnerability in Spring Cloud Gateway CVE-2022-22947 has been added by @Ayantaker. Versions 3.1.0 and 3.0.0 to 3.0.6 are vulnerable if the Gateway Actuator endpoint is enabled, exposed and unsecured. The module sends ...

Cross site scripting

A Cross-site scripting XSS vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic...

CVE-2022-38902

A Cross-site scripting XSS vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic...

Security update for gdcm, orthanc, orthanc-gdcm, orthanc-webviewer (important)

openSUSE Security Update: Security update for gdcm, orthanc, orthanc-gdcm, orthanc-webviewer Announcement ID: openSUSE-SU-2022:10144-1 Rating: important References: 1181400 Cross-References: CVE-2022-2119 CVE-2022-2120 CVSS scores: CVE-2022-2119 NVD : 9.8...

Description of the security update for SharePoint Server 2019: October 11, 2022 (KB5002278)

None None...

PT-2022-6242 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: A vulnerability was found in the Linux Kernel, classified as problematic. It affects the nilfs new inode function of the fs/nilfs2/inode.c file in the BPF component, leading to use aft...

PT-2022-21860 · Xapi · Xapi

Name of the Vulnerable Software and Affected Versions: XAPI affected versions not specified Description: The issue allows an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit. This results in XAPI being unable to accept new requests from other trusted clients an...

ZKTeco ZKBio Time Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in ZKTeco ZKBio Time version 8.0.7, which originates from the "Content" text field of the "Add New Message" module. Content" text field of the "Add New Message" module lacks effective filtering and escaping of user-supplied data, which can be exploited ...

PT-2022-22086 · Nocodb · Nocodb

Name of the Vulnerable Software and Affected Versions: NocoDB versions prior to 0.92.0 Description: The issue allows actors to cause a Denial of Service DoS by inserting large characters into the input field New Project on the create field via a crafted HTTP request. Recommendations: For versions...

NocoDB 资源管理错误漏洞

NocoDB is an open source Airtable replacement. A resource management error vulnerability exists in versions of NocoDB prior to 0.92.0, which stems from allowing the insertion of large characters into the input field "New Project" in the creation field. ", an attacker could use this vulnerability ...