CVE-2021-33322

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset tok...

PT-2021-20111 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.0 through 7.3.2 Liferay DXP versions 7.2 before fix pack 9 Description: The issue allows access to Cross-origin resource sharing CORS protected resources if the user is only authenticated using the portal session...

PT-2021-20103 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.0 and earlier Liferay DXP versions 7.0 before fix pack 96 Liferay DXP versions 7.1 before fix pack 18 Liferay DXP versions 7.2 before fix pack 5 Description: The issue allows remote attackers to change a user's...

CVE-2021-24430

The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its cachingexcludeurls and cachingincludequerystrings settings before outputting them in a PHP file, which could lead to RCE...

CVE-2021-24430

The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its cachingexcludeurls and cachingincludequerystrings settings before outputting them in a PHP file, which could lead to RCE...

Design/Logic Flaw

The Speed Booster Pack âš¡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its cachingexcludeurls and cachingincludequerystrings settings before outputting them in a PHP file, which could lead to RCE...

CVE-2021-24430

The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its cachingexcludeurls and cachingincludequerystrings settings before outputting them in a PHP file, which could lead to RCE...

CVE-2021-24430

The CVE-2021-24430 entry concerns WordPress Speed Booster Pack plugin prior to 4.2.0. The root cause is improper validation of caching_exclude_urls and caching_include_query_strings when outputting them in a PHP file, enabling remote code execution (RCE) under authentication. Affected component: ...

CVE-2021-24430 Speed Booster Pack 4.2.0-beta - Authenticated (admin+) RCE

The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its cachingexcludeurls and cachingincludequerystrings settings before outputting them in a PHP file, which could lead to RCE...

PT-2021-15960

Name of the Vulnerable Software and Affected Versions Speed Booster Pack PageSpeed Optimization Suite WordPress plugin versions prior to 4.2.0 Description The issue arises from the plugin not validating its caching exclude urls and caching include query strings settings before outputting them in ...

CVE-2021-24430: Improper Control of Generation of Code

The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its cachingexcludeurls and cachingincludequerystrings settings before outputting them in a PHP file, which could lead to RCE...

openSUSE: Security Advisory for git (openSUSE-SU-2021:2555-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2021:2555-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: WebSphere Application Server is vulnerable to a Privilege Escalation vulnerability (CVE-2021-29736)

Summary WebSphere Application Server is vulnerable to a privilege escalation vulnerability. This has been addressed. Vulnerability Details CVEID: CVE-2021-29736 DESCRIPTION: IBM WebSphere Application Server could allow a remote user to gain elevated privileges on the system. CVSS Base score: 5 CV...

Security Bulletin: IBM MQ is vulnerable to an issue within Pacemaker. (CVE-2020-25654)

Summary An issue was identified with Pacemaker which is used by IBM MQ to supply RDQM functionality. Vulnerability Details CVEID: CVE-2020-25654 DESCRIPTION: ClusterLabs Pacemaker could allow a local attacker to bypass security restrictions, caused by an access control list bypass flaw. By sendin...

Elastic Cloud Enterprise security update

Elastic Cloud Enterprise security update ESA-2021-17 Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker...

PT-2021-6440

Name of the Vulnerable Software and Affected Versions PeopleSoft Enterprise CS SA Integration Pack versions 9.0 through 9.2 Description The issue is related to insufficient input validation in the Snapshot Integration component of the PeopleSoft Enterprise CS SA Integration Pack product. This...

Security Bulletin: IBM Data Replication Affected by Vulnerabilities in IBM Java SDK (CVE-2020-2654)

Summary This bulletin covers common Java SDK vulnerability findings in the IBM Java SDK packaged with this offering. Vulnerability Details CVEID: CVE-2020-2654 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Libraries component could allow an unauthenticated attacker t...

Security Bulletin: IBM Data Replication Affected by IBM Java SDK Vulnerability (CVE-2019-4732)

Summary This bulletin covers common Java SDK vulnerability findings in the IBM Java SDK packaged with this offering. Vulnerability Details CVEID: CVE-2019-4732 DESCRIPTION: IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0...

Security Bulletin: IBM Data Replication Affected by Multiple Vulnerabilities in IBM Java SDK

Summary This bulletin covers common Java SDK vulnerability findings in the IBM Java SDK packaged with this offering. Vulnerability Details CVEID: CVE-2019-11771 DESCRIPTION: Eclipse OpenJ9 could allow a local attacker to gain elevated privileges on the system, caused by the inclusion of unused...