WebSoft HCM 跨站脚本漏洞

WebSoft HCM is a talent management and HR services platform from WebSoft Ukraine. A security vulnerability exists in WebSoft HCM version 2021.2.3.327, which stems from insufficient handling of user input and allows an authenticated attacker to inject arbitrary HTML markup into pages processed by...

CVE-2022-46904

Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the JavaScript programming language, which leads to Self-XSS...

Fortinet Fortigate Heap-based buffer overflow in sslvpnd (FG-IR-22-398)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-398 advisory. - A heap-based buffer overflow vulnerability CWE-122 in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 throu...

CVE-2022-46904

The CVE-2022-46904 affects WebSoft HCM 2021.2.3.327. The vulnerability arises from insufficient processing of user input in WebSoft HCM, allowing an authenticated attacker to inject arbitrary HTML into pages processed by the user’s browser, enabling Self-XSS. Concrete details across connected sou...

Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2022-10078)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-10078 advisory. - proc: procskipspaces shouldn't think it is working on C strings Linus Torvalds Orabug: 34883037 CVE-2022-4378 - proc: avoid integer type confusi...

Upgraded Q -> M from #506 [1670783534926]

Judge has assessed an item in Issue 506 as M risk. The relevant finding follows: selfDestruct will probably be deactivated soon --- The text was updated successfully, but these errors were encountered: All reactions...

[SECURITY] Fedora 36 Update: snapd-2.57.6-1.fc36

Snappy is a modern, cross-distribution, transactional package manager designed for working with self-contained, immutable packages...

CVE-2022-23485

Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result...

CVE-2022-23485

Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result...

UBUNTU-CVE-2022-23485

Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result...

Design/Logic Flaw

Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result...

CVE-2022-23485 Invite code reuse via cookie manipulation in sentry

Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result...

Amazon Linux AMI : rubygem-nokogiri (ALAS-2022-1648)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1648 advisory. A flaw was found in the rubygem-nokogiri package. This flaw allows malicious users to change partial contents or configurations on the system. Additionally, this vulnerability can also cause a limited deni...

New Botnet named Zerobot Exploiting Multiple Vulnerabilities

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A new botnet named ‘Zerobot’ has two variants, both are written in Go programming language, the first variant discovered on 18 Nov 2022, and within a short time on 24 Nov 2022 second variant was...

Implementation can be self destruct by deployer, effectively break all running sale and lock all assets.

Lines of code Vulnerability details Impact Sale in Escher is deployed using minimal proxy pattern, where there is only 1 implementation contract is deployed to save deployment gas. Also, in Open Edition and FixedPrice sale, when sale is not started yet, owner can cancel it, self destruct the prox...

Amazon Linux 2022 : nss (ALAS2022-2022-223)

The version of nss installed on the remote host is prior to 3.83.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-223 advisory. - NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA...

GSD-2022-1008362 btrfs: fix ulist leaks in error paths of qgroup self tests

btrfs: fix ulist leaks in error paths of qgroup self tests This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.333 by commit...

GSD-2022-1008316 btrfs: fix ulist leaks in error paths of qgroup self tests

btrfs: fix ulist leaks in error paths of qgroup self tests This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.299 by commit...

GSD-2022-1008259 btrfs: fix ulist leaks in error paths of qgroup self tests

btrfs: fix ulist leaks in error paths of qgroup self tests This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.265 by commit...

GSD-2022-1008188 btrfs: fix ulist leaks in error paths of qgroup self tests

btrfs: fix ulist leaks in error paths of qgroup self tests This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.224 by commit...