Improper Authorization

wallabag/wallabag is vulnerable to Improper Authorization. A remote attacker is able to gain access to unauthorized projects from other users due to insecure direct object references which is made possible because of improper validation of the user permissions...

Trellix Advanced Research Center patches 61,000 vulnerable open-source projects

Trellix Advanced Research Center Patches 61,000 Vulnerable Open-Source Projects By Trellix · January 23, 2023 This blog was written by Douglas McKee Late last year, the Trellix Advanced Research Center team uncovered a vulnerability in Python’s tarfile module. As we dug in, we realized this was...

Trellix Advanced Research Center patches 61,000 vulnerable open-source projects

Trellix Advanced Research Center Patches 61,000 Vulnerable Open-Source Projects By Trellix · January 23, 2023 This blog was written by Douglas McKee Late last year, the Trellix Advanced Research Center team uncovered a vulnerability in Python’s tarfile module. As we dug in, we realized this was...

Year in Review: Rapid7 Vulnerability Management

2022 began on a solemn note — many organizations across the globe were recovering from the Log4Shell zero-day vulnerability. For the InsightVM and Nexpose team, 2022 began with a lot of introspection on how we can add more value and keep meeting our customer needs in the best possible ways. This...

CVE-2022-46825

In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects...

Open redirect

In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects...

openstack-neutron: unrestricted creation of security groups

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significa...

openstack-neutron: unrestricted creation of security groups

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significa...

CVE-2022-44956

webtareas 2.4p5 was discovered to contain a cross-site scripting XSS vulnerability in the component /projects/listprojects.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

PT-2022-6456 · Mitsubishi · Mitsubishi Electric Gx Works3 +1

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U GT Designer3 Version1 GOT2000 versions from 1.122C to 1.290C Description: The issue is related to the use of hard-coded passwords in the software, allowing an unauthenticated attack...

College Management System SQL Injection Vulnerability (CNVD-2022-81235)

College Management System is a simple project organized by Code Projects. It is used to keep track of students, teachers, subjects, schedules and all things related to college. College Management System v1.0 suffers from a SQL injection vulnerability that can be exploited to insert SQL commands...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab CE/EE that stems from an incorrect...

1st-project (=1.0.2), 2d-game-assets (=0.0.1) +8879 more potentially affected by CVE-2022-39353 via @xmldom/xmldom (>=0.8.0 <=0.8.3)

@xmldom/xmldom NPM version =0.8.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =2.1.0, =2.8.6 and more Source cves: CVE-2022-39353 Source advisory: OSV:GHSA-CRH6-FP67-6883...

au.csiro.pathling:fhir-server (>=5.3.1 <=6.4.2), au.org.consumerdatastandards:data-holder (>=2.3.0 <=2.4.1) +2396 more potentially affected by CVE-2022-31692 via org.springframework.security:spring-security-core (>=5.7.0 <=5.7.4)

org.springframework.security:spring-security-core MAVEN version =5.7.0, =5.3.1, =2.3.0, =2.4.1 - au.org.consumerdatastandards:mock-data-holder-java =2.6.0 - be.jidoka:jdk-keycloak-admin =1.3.0 - br.com.m4rc310:br-com-m4rc310-graphql =1.0.1 - br.com.m4rc310:br-com-m4rc310-libs =1.0.1 -...

Microsoft Exposed 2.4 TB of Business Customer Data in BlueBleed Breach

By Deeba Ahmed According to researchers, the data included 335,000 emails, 548,000 users, and 133,000 projects. This is a post from HackRead.com Read the original post: Microsoft Exposed 2.4 TB of Business Customer Data in BlueBleed Breach...

africa.absa:inception-application (>=1.1.0 <=1.2.0), ai.ylyue:yue-library-webflux (>=j11.2.6.0 <=j11.2.6.1) +1561 more potentially affected by CVE-2022-31684 via io.projectreactor.netty:reactor-netty-http (>=1.0.11 <=1.0.23)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.11, =1.1.0, =j11.2.6.0, =v0.3.12, =v0.3.12, =v0.3.12, =1.7, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.485 and more Source cves: CVE-2022-31684 Source advisory: OSV:GHSA-7W4X-4H67-PGM...

GHSA-73V5-W6FG-2M44 Jenkins Tuleap Git Branch Source Plugin allows unauthenticated attackers to trigger Tuleap projects whose configured repo matches attacker-specified value

A missing permission check in Jenkins Tuleap Git Branch Source Plugin 3.2.4 and earlier allows unauthenticated attackers to trigger Tuleap projects whose configured repository matches the attacker-specified value. Tuleap Git Branch Source Plugin 3.2.5 requires a token to access the webhook endpoi...

CVE-2022-43421

A missing permission check in Jenkins Tuleap Git Branch Source Plugin 3.2.4 and earlier allows unauthenticated attackers to trigger Tuleap projects whose configured repository matches the attacker-specified value...

Design/Logic Flaw

A missing permission check in Jenkins Tuleap Git Branch Source Plugin 3.2.4 and earlier allows unauthenticated attackers to trigger Tuleap projects whose configured repository matches the attacker-specified value...

CVE-2022-43421

A missing permission check in Jenkins Tuleap Git Branch Source Plugin 3.2.4 and earlier allows unauthenticated attackers to trigger Tuleap projects whose configured repository matches the attacker-specified value...