CVE-2022-3227

CVE-2022-3227 corresponds to a Local File Inclusion flaw in the WordPress plugin SearchWP Live Ajax Search (versions

CVE-2022-36056

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

CVE-2022-36056 Vulnerabilities with blob verification in sigstore cosign

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

CVE-2022-36056

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

CVE-2022-1972

Removed by vendor...

CVE-2019-4479

CVE-2019-4479 is linked to IBM Business Process Manager (BPM) and IBM Business Automation Workflow (BAW). The connected IBM bulletins describe two concrete exposure types: (1) SQL injection allowing a remote attacker to view/modify/delete data via crafted SQL, affecting BPM/BAW across multiple ve...

CVE-2018-1849

CVE-2018-1849 is a Cross-Site Scripting vulnerability in IBM Business Automation Workflow (BPM/BPM Advanced/BPM Explorer) that allows embedding arbitrary JavaScript in the web UI, potentially exposing credentials in a trusted session. Affected products and versions include: IBM Business Automatio...

InsightVM: Best Practices to Improve Your Console

Over the years, our recommendations and best practices for the InsightVM console have changed with the improvements and updates we’ve made to the system. Here are some of the most common improvements to help you get the most out of your InsightVM console in 2022. Ensure everything is up to date T...

CVE-2019-25074

CVE-2019-25074 is a FRRouting FRR defect where the IS-IS daemon has a memory leak that can exhaust server memory. The SUSE/SUSE-SU-2022:3246-1 advisory fixes this issue (and relates to a separate CVE-2022-37032 BGP out-of-bounds read). OpenVAS entries reference the same SUSE update for SLES/SUSE ...

CVE-2022-22403

IBM Aspera Faspex 5.0.0 and 5.0.1 are affected by CVE-2022-22403. The root cause is that authorization tokens or session cookies are not set with the Secure attribute, enabling an attacker to snoop cookie values when a user visits an insecure http link or a compromised site. IBM has addressed thi...

CVE-2022-25704

CVE-2022-25704 is listed in the Android/Qualcomm Bluetooth vulnerability set as a high-severity issue affecting Qualcomm closed-source components. Connected sources indicate it is part of the 2022 Android security update; no exploitation details are provided in the supplied documents. Remediation...

CVE-2021-3364

Technical details about CVE-2021-3364 are not publicly available in the provided documents. The Connected Fedora package notices mention libtar updates but do not describe the vulnerability. Monitor for future updates.

GitHub: Managing Pages

An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages via the API. To exploit this vulnerability, an attacker would need to be added to an organization's repo with write permissions. This...

CVE-2022-35644

IBM’s advisory documents confirm CVE-2022-35644 is a persistent cross-site scripting vulnerability in IBM Business Process Manager and related IBM Business Automation products. The flaw allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a tru...

mst.or.kr Cross Site Scripting vulnerability OBB-2883037

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-36051 Broken Authorization in ZITADEL Actions

ZITADEL combines the ease of Auth0 and the versatility of Keycloak.Actions, introduced in ZITADEL 1.42.0 on the API and 1.56.0 for Console, is a feature, where users with role.ORGOWNER are able to create Javascript Code, which is invoked by the system at certain points during the login. Actions,...

多款 ZITADEL 产品 安全漏洞

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the age of containers and serverless, open sourced by ZITADEL in Switzerland. ZITADEL suffers from a security vulnerability that stems from a lack of authorization checks, where Actions is abl...

PT-2022-23143 · Zitadel · Zitadel

Name of the Vulnerable Software and Affected Versions: ZITADEL versions 1.42.0 through 1.87.0 ZITADEL versions 1.56.0 through 1.87.0 ZITADEL version 2.x prior to 2.2.0 Description: The issue is related to a missing authorization check in the Actions feature, introduced in ZITADEL 1.42.0 on the AP...

vbsa.org.au Cross Site Scripting vulnerability OBB-2873627

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

nss.org.sg Cross Site Scripting vulnerability OBB-2872568

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...