EMC RSA Archer 6.0 < 6.9 SP3 P4 / 6.10 < 6.10 P2 Remote Code Execution

The version of EMC RSA Archer running on the remote web server is 6.x prior to 6.9.3.4 6.9 SP3 P4, 6.10.x prior to 6.10.0.2 6.10 P2. It is, therefore, affected by a remote code execution vulnerability due to unrestricted upload of a file with a dangerous type. A remote, authenticated malicious us...

Siemens APOGEE/TALON Field Panels

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: APOGEE PXC/TALON TC Vulnerabilities: Predictable Exact Value from Previous Values 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to hijack...

CVE-2022-45937

A vulnerability has been identified in APOGEE PXC Compact BACnet All versions V3.5.5, APOGEE PXC Compact P2 Ethernet All versions V2.8.20, APOGEE PXC Modular BACnet All versions V3.5.5, APOGEE PXC Modular P2 Ethernet All versions V2.8.20, TALON TC Compact BACnet All versions V3.5.5, TALON TC...

CVE-2022-45937

Siemens CVE-2022-45937 affects APOGEE PXC Series ( BACnet and P2 Ethernet ) and TALON TC Series up to specific versions: APOGEE PXC BACnet before 3.5.5; APOGEE PXC P2 Ethernet before 2.8.20; TALON TC BACnet before 3.5.5. The vulnerability is an Improper Access Control that could allow a low-privi...

PT-2022-20437 · Rubrik · Rubrik Cdm

Name of the Vulnerable Software and Affected Versions: Rubrik CDM versions 7.0.1 through 7.0.1-p3 Description: A buffer overflow vulnerability in the Rubrik Backup Service RBS Agent for Linux or Unix-based systems could allow a local attacker to obtain root privileges by sending a crafted message...

GHSA-RG7P-WMGJ-F374 Magento stored Cross-Site Scripting (XSS) vulnerability

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s...

CVE-2022-34256 Adobe Commerce Improper Authorization Privilege escalation

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does no...

CVE-2022-34258 Adobe Commerce Stored XSS Arbitrary code execution

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

CVE-2022-34258

Adobe Commerce and Magento Open Source are affected by a stored XSS vulnerability in versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier, and 2.4.4 and earlier. The issue can be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields, with malicious Jav...

PT-2022-7069 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.3-p2 through 2.4.4 Adobe Commerce versions 2.3.7-p3 and earlier Description: The issue is related to an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could levera...

CVE-2021-41037

In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation. Those touchpoints can, for example, alter the command-line used to start the application, injecting things like agent or other settings that usually...

CVE-2021-41037

In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation. Those touchpoints can, for example, alter the command-line used to start the application, injecting things like agent or other settings that usually...

Code injection

In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation. Those touchpoints can, for example, alter the command-line used to start the application, injecting things like agent or other settings that usually...

CVE-2021-41037

CVE-2021-41037 affects Eclipse p2 installable units. The vulnerability arises because touchpoints during installation can modify the Eclipse Platform installation or local machine (e.g., altering the startup command), enabling execution of malicious code without user warnings from untrusted sourc...

CVE-2021-41037

In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation. Those touchpoints can, for example, alter the command-line used to start the application, injecting things like agent or other settings that usually...

CVE-2021-41037

In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation. Those touchpoints can, for example, alter the command-line used to start the application, injecting things like agent or other settings that usually...

Nginx Plus R1 < R15-P2 / R16 < R16-P1 Multiple Vulnerabilities

According to its self reported version, the installed version of Nginx Plus is R1 built on Open Source version 1.5.3-1 prior to R15-P2 or R16 built on Open Source version 1.15.2 prior to R16-P1. It is, therefore, affected by the following issues : - An unspecified error exists related to the modu...

Deserialization of Untrusted Data

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the process of saving customer details. An authenticated attacker with admin privileges can execute arbitrary code by submitting...

Arbitrary File Upload

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Arbitrary File Upload due to improper input validation when uploading a file. An attacker with administrative privileges can execute arbitrary code on the server by uploadi...

GHSA-86PC-6MM8-542R Magento 2 Community Edition XSS Vulnerability

A stored cross-site scripting XSS vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when creating a content page via page builder. As per the Magento Release 2.3.3, if you have already implemented the pre-release versi...