PT-2022-28737

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.25 Description The issue is related to the use of noinstr in favor of notrace in the gcc-plugins/stackleak. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kern...

PT-2022-28671

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.102 Description The issue is related to the use of noinstr in favor of notrace in gcc-plugins/stackleak. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2022-28816

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.11 Description The issue is related to the use of noinstr in favor of notrace in the gcc-plugins/stackleak. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kern...

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement...

RHEL 7 : OpenShift Container Platform 3.11.634 (RHSA-2022:0555)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0555 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

Oracle Linux 7 : cyrus-sasl (ELSA-2022-0666)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-0666 advisory. - Fix for CVE-2022-24407 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not tested...

CVE-2022-24407: Improper Neutralization of Special Elements used in an SQL Command

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement...

CVE-2022-24407

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement...

Exploit for Authentication Bypass by Spoofing in Apache Apisix

CVE-2022-24112 CVE-2022-24112: Apache APISIX apisix/batch-re...

PT-2022-1907

Name of the Vulnerable Software and Affected Versions Cyrus SASL versions 2.1.17 through 2.1.27 Description The issue is related to the implementation of the authentication mechanism in Cyrus SASL, where the SQL query structure is not properly protected. This could allow a remote attacker to...

CVE-2021-44967: Unrestricted Upload of File with Dangerous Type

A Remote Code Execution RCE vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file. NOTE: the Supplier's position is that plugins intentionally can contain arbitrary PHP code, and can only be...

PT-2022-12270

Name of the Vulnerable Software and Affected Versions LimeSurvey version 5.2.4 Description A Remote Code Execution RCE issue exists via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file. Recommendations For LimeSurvey version 5.2.4,...

CVE-2022-0288

The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the htmlelementselection parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

CVE-2021-24867

Numerous Plugins and Themes from the AccessPress Themes aka Access Keys vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to...

CVE-2021-24867

Numerous Plugins and Themes from the AccessPress Themes aka Access Keys vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to...

Design/Logic Flaw

Numerous Plugins and Themes from the AccessPress Themes aka Access Keys vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to...

CVE-2021-24867

CVE-2021-24867 relates to backdoored AccessPress Themes plugins/themes distributed via the vendor site (not from wordpress.org). The vulnerability was exploited in the wild to deploy web shells and site defacements, observed by Talos IR as part of initial access through exploitation of a WordPres...

WordPress plugin AccessPress 安全漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress plugin AccessPress Themes has a security vulnerability that stems from the existence of a backdoor in the vendor...

Jenkins Pipeline Multibranch Plugin Arbitrary File Read Vulnerability

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. Jenkins Pipeline Multibranch Plugin 706.vd43c65dec013 and earlier versions contain an arbitrary file reading vulnerability...

Improper Authorization

librenms is vulnerable to improper authorization. The vulnerability exists due to the lack of validation of the user's role and level allowing an attacker to switch on/off installed plugins...