Cross site scripting

CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting XSS vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator who is addin...

CVE-2022-48110

CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting XSS vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator who is addin...

UBUNTU-CVE-2022-48110

DISPUTED CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting XSS vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator who...

CVE-2022-48110

CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting XSS vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator who is addin...

CVE-2022-48110

CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting XSS vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator who is addin...

PT-2023-1068 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: The issue is related to errors in security settings, allowing a remote attacker to bypass existing security restrictions. This can potentially enable the attacker to...

PT-2023-1080 · Microsoft · Windows Smart Card Resource Management Server +1

Name of the Vulnerable Software and Affected Versions: Windows Smart Card Resource Management Server affected versions not specified Description: The issue is related to errors in security settings, allowing an attacker to bypass security restrictions and elevate their privileges. It is a...

CVE-2022-26969

In Directus before 9.7.0, the default settings of CORSORIGIN and CORSENABLED are true...

SmartScreen Security Component Bypass

The vulnerability of the SmartScreen security component against phishing and malicious programs in Windows operating systems is related to errors in security settings. Exploiting this vulnerability allows a remote attacker to circumvent security restrictions by downloading specially created malwa...

CVE-2021-26360

An attacker with local access to the system can make unauthorized modifications of the security configuration of the SOC registers. This could allow potential corruption of AMD secure processor’s encrypted memory contents which may lead to arbitrary code execution in ASP...

PT-2022-5505

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A security feature bypass issue exists in the BitLocker Device Encryption of Windows operating systems due to security configuration errors. This flaw allows an attacker to bypass security...

PT-2022-5406 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to errors in security settings of the Mark of the Web mechanism in the Windows operating system. It allows a remote attacker to bypass existing security restrictions...

IBM WebSphere MQ 安全漏洞

IBM WebSphere MQ is a system from International Business Machines IBM, Inc. A denial-of-service vulnerability exists in IBM WebSphere MQ version 7.1. A remote attacker could use this vulnerability to bypass security configuration settings and cause a denial of service...

The nature of cyber incidents

Kaspersky provides incident response services and trainings to organizations around the world. In our annual incident response report, we share our observations and statistics based on investigation of real-life incidents. The report contains anonymized data collected by the Kaspersky Global...

Login Block IPs <= 1.0.0 - Arbitrary Setting Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack PoC Make a logged in admin open a page containing the HTML code below...

Outbyte PC Repair Uncontrolled Search Path Privilege Escalation

The vulnerability of Outbyte PC Repair’s file cleaning and security settings checking function is related to an uncontrolled search path element. Exploiting this vulnerability can allow attackers to enhance their privileges...

PT-2022-4559 · Microsoft · Windows Defender

Name of the Vulnerable Software and Affected Versions: Windows Defender affected versions not specified Description: The issue is related to errors in security settings, which can allow an attacker to bypass security restrictions. Recommendations: At the moment, there is no information about a...

PT-2022-4089 · Microsoft · Windows Defender +1

Name of the Vulnerable Software and Affected Versions: Windows Defender affected versions not specified Description: The issue is related to a security feature bypass in Windows Defender, allowing attackers to bypass the Kerberos authentication procedure. This could potentially enable an attacker...

PT-2022-4117 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to errors in security settings of the Windows Hello biometric authentication feature in the Windows operating system. This could allow an attacker to bypass existing...

PT-2022-4305 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows affected versions not specified Description: The issue is related to errors in security settings, allowing an attacker to bypass the authentication process. It is a security-feature bypass vulnerability that enables attacker...