PT-2022-3284 · Ping Identity · Pingid Windows Login

Name of the Vulnerable Software and Affected Versions: PingID Windows Login versions prior to 2.8 Description: The issue is related to errors in authentication of the connection with a local Java service used to capture security key requests. An attacker with the ability to execute code on the...

Security Bulletin: IBM Spectrum Protect Server vulnerable to offline dictionary and brute force attacks (CVE-2022-22496, CVE-2022-22487)

Summary The IBM Spectrum Protect Server is vulnerable to an offline dictionary attack when using SESSIONSECURITY=TRANSITIONAL. The IBM Spectrum Protect Storage agent is vulnerable to a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrati...

CVE-2022-22496

While a user account for the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 is being established, it may be configured to use SESSIONSECURITY=TRANSITIONAL. While in this mode, it may be susceptible to an offline dictionary attack. IBM X-Force ID: 226942...

PT-2022-31562

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.0 through v5.15.45 Description The issue is related to inflight count imbalances and IO hangs on offline devices. It was introduced in version v5.0 and fixed in version v5.15.46. The actual impact and attack plausibili...

PT-2022-30916

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.0 through v5.18.2 Description The issue is related to inflight count imbalances and IO hangs on offline devices. It was introduced in version v5.0 and fixed in version v5.18.3. The actual impact and attack plausibility...

PT-2022-31976

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.198 Description The issue is related to inflight count imbalances and IO hangs on offline devices. It was introduced in version v5.0 and fixed in version v5.4.198. The actual impact and attack plausibility...

PT-2022-31808

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.0 through v5.10.120 Description The issue is related to inflight count imbalances and IO hangs on offline devices. It was introduced in version v5.0 and fixed in version v5.10.121. The actual impact and attack...

CVE-2022-1593

The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them. As a result, attackers could make a logged in admin change them and put Cross-Site Scripting payloads ...

CVE-2022-1593

CVE-2022-1593 affects the WordPress Site Offline or Coming Soon plugin (versions 1.6.6 and earlier). The root cause is missing CSRF checks and inadequate sanitisation/escaping in settings updates, enabling a logged-in administrator to inject stored XSS payloads via CSRF. Several sources corrobora...

CVE-2022-1593: Improper Neutralization of Input During Web Page Generation

The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them. As a result, attackers could make a logged in admin change them and put Cross-Site Scripting payloads ...

WordPress plugin Site Offline or Coming Soon 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Site Offline or Coming Soon plugin version 1.6.6 and earlier are vulnerable to cross-site request...

PT-2022-13990 · WordPress · The Site Offline/Coming Soon

Name of the Vulnerable Software and Affected Versions: The Site Offline or Coming Soon WordPress plugin versions 1.6.6 and earlier Description: The issue is related to the lack of CSRF check when updating settings, as well as insufficient sanitisation and escaping in some settings. This allows...

MAL-2022-3273 Malicious code in gapminder-offline (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1019f58b695765ea809aec01de37e4c7db43d9ee11f7baec18f57da5036ae3c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gapminder-offline (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1019f58b695765ea809aec01de37e4c7db43d9ee11f7baec18f57da5036ae3c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2021-40776

Adobe Lightroom Classic 10.3 and earlier are affected by a privilege escalation vulnerability in the Offline Lightroom Classic installer. An authenticated attacker could leverage this vulnerability to escalate privileges. User interaction is required before product installation to abuse this...

CVE-2021-40776

Adobe Lightroom Classic 10.3 and earlier are affected by a privilege escalation vulnerability in the Offline Lightroom Classic installer. An authenticated attacker could leverage this vulnerability to escalate privileges. User interaction is required before product installation to abuse this...

CVE-2021-40776 Adobe Lightroom Classic DLL Hijacking Local Privilege Escalation Vulnerability

Adobe Lightroom Classic 10.3 and earlier are affected by a privilege escalation vulnerability in the Offline Lightroom Classic installer. An authenticated attacker could leverage this vulnerability to escalate privileges. User interaction is required before product installation to abuse this...

CVE-2021-40776: Creation of Temporary File in Directory with Insecure Permissions

Adobe Lightroom Classic 10.3 and earlier are affected by a privilege escalation vulnerability in the Offline Lightroom Classic installer. An authenticated attacker could leverage this vulnerability to escalate privileges. User interaction is required before product installation to abuse this...

Debian DLA-3049-1 : mailman - LTS security update

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3049 advisory. - In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS. CVE-2021-43331 - In GNU Mailman...

CVE-2022-28384

An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they allow an offline brute-force attack for determining the correct passcode, and thus gaining unauthorized access to the stored encrypted data. This affects Keypad Secure USB 3.2 Gen 1 Drive Part...