PT-2022-7688 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the mlx5 eswitch add termtbl rule function in the Linux kernel, which is associated with the reuse of previously freed memory. This can potentially allow an...

CVE-2020-23586

A vulnerability found in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack to Add Network Traffic Control Type Rule...

CVE-2020-23586

The CVE-2020-23586 vulnerability affects OPTILINK OP-XT71000N hardware (v2.2) with firmware OP_V3.3.1-191028 and enables an unauthenticated remote attacker to perform a CSRF attack that adds a Network Traffic Control Type Rule. Connected sources (CNNVD-202211-3359, Red Hat page mirrors, and CVE r...

nuvola - Tool To Dump And Perform Automatic And Manual Security Analysis On Aws Environments Configurations And Services

nuvola with the lowercase n is a tool to dump and perform automatic and manual security analysis on AWS environments configurations and services using predefined, extensible and custom rules created using a simple Yaml syntax. The general idea behind this project is to create an abstracted digita...

Improper access control

patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control. Access to the password.txt file is not properly restricted as it is in the root directory served by StaticFileHandler and the Tornado rule to throw a 403 error when...

CVE-2022-37109

CVE-2022-37109 affects the "camp" Raspberry Pi camera server up to commit bbd53a256ed70e79bd8758080936afbf6d738767. The root cause is Incorrect Access Control: password.txt is served from the StaticFileHandler root and the 403 bypass persists, allowing access to password.txt. Additionally, the pa...

Theft of ETH that was not used for successful execution of orders in non-atomic execution

Lines of code Vulnerability details Description There is an execute function in LooksRareAggregator contract. It refunds any ETH that was unused for example that left due to the unsuccessful execution of an order at the end of its execution flow: returnETHIfAnyoriginator; returnETHIfAny function ...

CVE-2022-43488

Cross-Site Request Forgery CSRF vulnerability in Advanced Dynamic Pricing for WooCommerce plugin = 4.1.5 on WordPress leading to rule type migration...

CVE-2022-43488

Cross-Site Request Forgery CSRF vulnerability in Advanced Dynamic Pricing for WooCommerce plugin = 4.1.5 on WordPress leading to rule type migration...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Advanced Dynamic Pricing for WooCommerce plugin = 4.1.5 on WordPress leading to rule type migration...

PT-2022-26940 · Woocommerce · Advanced Dynamic Pricing For Woocommerce

Name of the Vulnerable Software and Affected Versions: Advanced Dynamic Pricing for WooCommerce plugin versions = 4.1.5 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which can lead to rule type migration. Recommendations: For Advanced Dynamic Pricing for...

Sandman - NTP Based Backdoor For Red Team Engagements In Hardened Networks

Sandman is a backdoor that is meant to work on hardened networks during red team engagements. Sandman works as a stager and leverages NTP a protocol to sync time & date to get and run an arbitrary shellcode from a pre-defined server. Since NTP is a protocol that is overlooked by many defenders...

Cisco Secure Web Appliance Content Encoding Filter Bypass (cisco-sa-wsa-bypass-bwBfugek)

According to its self-reported version, Cisco Secure Web Appliance Content Encoding Filter Bypass is affected by a filter bypass vulnerability. An unauthenticated, remote attacker can exploit this, by sending malformed encoded traffic, to bypass an explicit block rule and receive traffic that...

PT-2022-23622 · Algosec · Algosec Fireflow

Name of the Vulnerable Software and Affected Versions: AlgoSec FireFlow affected versions not specified Description: The issue involves a Reflected Cross-Site-Scripting RXSS attack. A malicious user can inject JavaScript code into the IntersectudRule parameter on the "search/result.html" page. By...

Cross-Site Scripting (XSS)

oro/commerce is vulnerable to cross-site scripting. The vulnerability is due to lack of sanitization in the shipping rule edit page which allows an attacker to inject and execute arbitrary JavaScript...

F5 BIG-IP 资源管理错误漏洞

F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, load balancing, and other features from F5 USA. A resource management error vulnerability exists in all versions of F5 BIG-IP 13.1.x. The vulnerability stems from an...

GHSA-4VF4-955G-VXP2 OroCommerce Cross site scripting vulnerability during shipping rule editing for UPS integration

Impact Shipping rule edit page is vulnerable to cross site scripting XSS payload added to UPS Surcharge field. The attacker should have permission to create or edit a shipping rule...

OroCommerce Cross site scripting vulnerability during shipping rule editing for UPS integration

Impact Shipping rule edit page is vulnerable to cross site scripting XSS payload added to UPS Surcharge field. The attacker should have permission to create or edit a shipping rule...

CVE-2022-31037

OroCommerce is an open-source Business to Business Commerce application. Versions between 4.1.0 and 4.1.17 inclusive, 4.2.0 and 4.2.11 inclusive, and between 5.0.0 and 5.0.3 inclusive, are vulnerable to Cross-site Scripting in the UPS Surcharge field of the Shipping rule edit page. The attacker...

Cross site scripting

OroCommerce is an open-source Business to Business Commerce application. Versions between 4.1.0 and 4.1.17 inclusive, 4.2.0 and 4.2.11 inclusive, and between 5.0.0 and 5.0.3 inclusive, are vulnerable to Cross-site Scripting in the UPS Surcharge field of the Shipping rule edit page. The attacker...