SAP Fiori Launchpad Cross Site Scripting

Onapsis Security Advisory 2022-0005: Cross-Site Scripting XSS vulnerability in SAP Fiori launchpad Impact on Business Impact depends on the victim's privileges. In most cases, a successful attack allows an attacker to hijack a session, or force the victim to perform undesired requests in the SAP...

Phoenix Contact Classic Line Industrial Controllers

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Phoenix Contact Equipment: ILC 131 ETH, ILC 131 ETH/XC, ILC 151 ETH, ILC 151 ETH/XC, ILC 171 ETH 2TX, ILC 191 ETH 2TX, ILC 191 ME/AN, and AXC 1050 Vulnerability: Missing Authentication for Critical...

Malicious code in note-taking (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ea2d2fd1a7135206395b32cd06293cc0edc73f1477925f0d2002f6f0d5ddd9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4927 Malicious code in note-taking (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ea2d2fd1a7135206395b32cd06293cc0edc73f1477925f0d2002f6f0d5ddd9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SAP NetWeaver AS Java Information Disclosure (2256846)

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.1 to 7.5, allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846. Note that Nessus has not tested for this issue but has instead relied only on the application's...

HPESBCR04284 rev.1 - HPE Cray EX Supercomputers, Cray Shasta System Solutions, and HPE Slingshot Switches, Remote Authentication Bypass

Potential Security Impact: Remote: Authentication Bypass SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Cray Legacy Shasta System Solutions - All versions of node controller firmware associated with HPE Cray EX liquid cooled blades, and all versions of chassis controller firmware...

WordPress plugin Note Press SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Note Press 0.1.10 and earlier versions are vulnerable to SQL injection, which stems...

WordPress Note Press plugin SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Note Press plugin 0.1.10 and earlier versions are vulnerable to SQL injection, which stems...

WordPress Note Press plugin SQL injection vulnerability (CNVD-2022-64665)

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. FormCraft is one of the form creation plugins used in it. WordPress plugin is an application plugin. WordPress Note Press plugin 0.1.10 and earlier...

BlackBasta is the latest ransomware to target ESXi virtual machines on Linux

BlackBasta, an alleged subdivision of the ransomware group Conti, just began supporting the encryption of VMwares ESXi virtual machines VM installed on enterprise Linux servers. Because more and more organizations have begun using VMs for cost-effectiveness and easier management of devices, this...

CVE-2022-1690

The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin page, leading to an SQL injection...

CVE-2022-1688

The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboard, leading to SQL Injections...

CVE-2022-1688

The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboard, leading to SQL Injections...

CVE-2022-1689

The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the Update parameter before using it in a SQL statement when updating a note via the admin dashboard, leading to an SQL injection...

CVE-2022-1689

The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the Update parameter before using it in a SQL statement when updating a note via the admin dashboard, leading to an SQL injection...

CVE-2022-1690

The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin page, leading to an SQL injection...

CVE-2022-1689

The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the Update parameter before using it in a SQL statement when updating a note via the admin dashboard, leading to an SQL injection...

Sql injection

The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboard, leading to SQL Injections...

Redmi Note 11 和 Redmi Note 9T 缓冲区错误漏洞

Xiaomi Redmi Note 11 and Redmi Note 9T are both smartphones from Chinese company Xiaomi. The Redmi Note 11 and Redmi Note 9T suffer from a security vulnerability that stems from a stack overflow. An attacker can exploit the vulnerability to conduct a denial of service attack...

WordPress plugin Note Press SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Note Press 0.1.10 and earlier versions are vulnerable to SQL injection, which stems...