Description of the security update for SharePoint Foundation 2013: January 10, 2023 (KB5002336)

Description of the security update for SharePoint Foundation 2013: January 10, 2023 KB5002336 Summary This security update resolves a Microsoft SharePoint Server remote code execution vulnerability. To learn more about the vulnerability, see the following security advisories: Microsoft Common...

CVE-2023-0012

In SAP Host Agent Windows - versions 7.21, 7.22, an attacker who gains local membership to SAPLocalAdmin could be able to replace executables with a malicious file that will be started under a privileged account. Note that by default all user members of SAPLocaAdmin are denied the ability to logo...

Siemens S7-1500 CPU devices

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

PT-2023-15947 · Sap · Sap Host Agent

Name of the Vulnerable Software and Affected Versions: SAP Host Agent Windows versions 7.21, 7.22 Description: An attacker who gains local membership to SAP LocalAdmin could replace executables with a malicious file that will be started under a privileged account. This can only occur if the syste...

CVE-2023-22911

An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. E-Widgets does widget replacement in HTML attributes, which can lead to XSS, because widget authors often do not expect that their widget is executed in an HTML attribute context...

PT-2025-54009

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.0.10-2 Description The Linux kernel contained a flaw within the btrfs subsystem related to handling device replacement during repair operations. Specifically, a bug report indicated a kernel panic BUG ON...

The vulnerability of the software access control mechanism for Mitsubishi Electric GX Works3 allows a intruder to execute arbitrary code.

The vulnerability of the software access control mechanism for Mitsubishi Electric’s GX Works3 programming platform is related to the use of a strictly encrypted cryptographic key. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary code by replacing the...

AZL-38788 CVE-2022-43551 affecting package tensorflow for versions less than 2.16.1-1

A vulnerability exists in curl 7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypasse...

The vulnerability of the AVEVA Edge InstallShield SCADA system’s installation component allows a perpetrator to execute arbitrary code or enhance their privileges.

The vulnerability of the AVEVA Edge InstallShield SCADA system’s installation component is related to the possibility of replacing the dynamic library. Exploiting this vulnerability could allow a intruder to execute arbitrary code or enhance their privileges...

Description of the security update for SharePoint Server Subscription Edition: December 13, 2022 (KB5002327)

None None...

CVE-2022-40680

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9 and 7.0.0 - 7.0.3 allows a privileged attacker to execute unauthorized code or commands via storing malicious payloads in replacement messages...

Cross site scripting

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9 and 7.0.0 - 7.0.3 allows a privileged attacker to execute unauthorized code or commands via storing malicious payloads in replacement messages...

CVE-2022-40680

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9 and 7.0.0 - 7.0.3 allows a privileged attacker to execute unauthorized code or commands via storing malicious payloads in replacement messages...

PT-2022-6108 · Fortinet · Fortios

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 6.0.7 through 6.0.15 Fortinet FortiOS versions 6.2.2 through 6.2.12 Fortinet FortiOS versions 6.4.0 through 6.4.9 Fortinet FortiOS versions 7.0.0 through 7.0.3 Description: The issue is related to improper...

CVE-2022-3850 Find and Replace All <= 1.3 - Arbitrary Replacement via CSRF

The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a logged admin replace arbitrary string in database tables via a CSRF attack...

PT-2022-24430 · WordPress · Find/Replace All

Name of the Vulnerable Software and Affected Versions: Find and Replace All WordPress plugin versions prior to 1.3 Description: The issue is related to the lack of a CSRF check when replacing strings, which could allow attackers to make a logged admin replace arbitrary strings in database tables...

OPENSUSE-SU-2022:10219-1 Security update for opera

This update for opera fixes the following issues: Update to 93.0.4585.11 - CHR-9051 Update chromium on desktop-stable-107-4585 to 107.0.5304.88 - DNA-95965 Add support for more UD TLDs - DNA-102960 Replace messengers icons - DNA-102964 Crash at -FramedBrowserWindow sendEvent: - DNA-103125...

TaoSecurity on Mastodon

--- I am now using Mastodon as a replacement for the blue bird. This is my attempt to verify myself via my blog. I am no longer posting to my old bird account. Copyright 2003-2020 Richard Bejtlich and TaoSecurity taosecurity.blogspot.com and www.taosecurity.com...

Description of the security update for SharePoint Foundation 2013: November 8, 2022 (KB5002303)

Description of the security update for SharePoint Foundation 2013: November 8, 2022 KB5002303 Summary This security update resolves a Microsoft SharePoint Server remote code execution vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures...

Description of the security update for Excel 2013: November 8, 2022 (KB5002275)

Description of the security update for Excel 2013: November 8, 2022 KB5002275 Summary This security update resolves a Microsoft Excel remote code execution vulnerability and Microsoft Excel security feature bypass vulnerability. To learn more about the vulnerabilities, see the following security...