12616 matches found
PT-2022-6174 · Cisco · Cisco Ios Xe
Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points affected versions not specified Description: A vulnerability in the self-healing functionality could allow an authenticated, local attacker to escape the...
PT-2022-6312 · Cisco · Cisco Ios Xe Rom Monitor (Rommon) +1
Name of the Vulnerable Software and Affected Versions: Cisco IOS XE ROM Monitor ROMMON Software for Cisco Catalyst Switches affected versions not specified Description: A problem with file and boot variable permissions in ROMMON could allow an unauthenticated, local attacker to recover the...
Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics Installed WebSphere Application Server is vulnerable to Cross-site Scripting (CVE-2022-22477)
Summary The security issue described in CVE-2022-22477 has been identified in the WebSphere Application Server included as part of IBM Tivoli Composite Application Manager for Application Diagnostics Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...
CVE-2022-40817
Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some operations on such tickets, like adding and removing links, tags. and related answers. This issue has been fixed in 5.2.2...
PT-2022-25980 · Check Point · Zonealarm Extreme Security
Name of the Vulnerable Software and Affected Versions: Check Point ZoneAlarm Extreme Security versions prior to 15.8.211.19229 Description: The issue allows local users to escalate privileges due to weak permissions for the %PROGRAMDATA%CheckPointZoneAlarmDataUpdates directory and a self-protecti...
HPESBHF04370 rev.1 - HPE OneView Global Dashboard (OVGD), Remote Unauthorized Disclosure of Information, Unauthorized Modification
Potential Security Impact: Remote: URL Redirection SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE OneView Global Dashboard prior to 2.7 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2022-37927 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | 6.1 |...
hoek subject to prototype pollution via the clone function.
hoek versions prior to 8.5.1, and 9.x prior to 9.0.3 are vulnerable to prototype pollution in the clone function. If an object with the proto key is passed to clone the key is converted to a prototype. This issue has been patched in version 9.0.3, and backported to 8.5.1...
PT-2022-25470 · WordPress · Cpo Shortcodes
Name of the Vulnerable Software and Affected Versions: CPO Shortcodes plugin versions prior to 1.5.0 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin or higher privileges can inject malicious scripts into t...
PT-2022-24413 · Kraken.Io · Kraken.Io Image Optimizer
Name of the Vulnerable Software and Affected Versions: Kraken.io Image Optimizer plugin versions = 2.6.5 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web...
PT-2022-21797 · Apache · Apache Pulsar Java Client
Name of the Vulnerable Software and Affected Versions: Apache Pulsar Java Client versions 2.6.4 and earlier Apache Pulsar Java Client versions 2.7.0 through 2.7.4 Apache Pulsar Java Client versions 2.8.0 through 2.8.3 Apache Pulsar Java Client versions 2.9.0 through 2.9.2 Apache Pulsar Java Clien...
PT-2022-25287 · Tabs · Tabs
Name of the Vulnerable Software and Affected Versions: Tabs plugin versions 3.7.1 and earlier Description: The issue concerns multiple authenticated stored Cross-Site Scripting XSS vulnerabilities. This means that an attacker can inject malicious scripts into the website, which will be executed b...
PT-2022-25274 · WordPress · Awesome-Filterable-Portfolio
Name of the Vulnerable Software and Affected Versions: Awesome Filterable Portfolio plugin version 1.9.7 and earlier Description: The issue is an Unauthenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the website without needin...
WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability leading to sending of test emails discovered by Muhammad Daffa Patchstack Alliance in WordPress Customer Reviews for WooCommerce plugin versions = 5.3.5. Solution Update the WordPress Customer Reviews for WooCommerce plugin to the latest available...
PT-2022-24405 · Apache +5 · Apache Xml Graphics Batik +5
Name of the Vulnerable Software and Affected Versions: Apache XML Graphics Batik version 1.14 Description: A Server-Side Request Forgery SSRF vulnerability in Apache XML Graphics Batik allows an attacker to load a URL through the jar protocol. This issue enables information disclosure...
PT-2022-6388 · Adobe · Bridge
Name of the Vulnerable Software and Affected Versions: Adobe Bridge versions 12.0.3 and earlier Adobe Bridge versions 13.0.1 and earlier Description: The issue is related to an out-of-bounds read vulnerability in Adobe Bridge, specifically when parsing embedded fonts. This could lead to the...
MGASA-2022-0339 Updated redis packages fix security vulnerability
Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the potentially higher privileges of another Redis user. The Lua scri...
PT-2022-16362 · Keylime · Keylime
Name of the Vulnerable Software and Affected Versions: Keylime versions prior to 6.3.0 Description: The issue concerns quote responses from the agent that can contain possibly untrusted ZIP data, leading to zip bombs. Recommendations: For versions prior to 6.3.0, update to version 6.3.0 or later ...
PT-2022-20185 · Tibco Software · Tibco Ebx
Name of the Vulnerable Software and Affected Versions: TIBCO EBX versions 6.0.0 through 6.0.8 Description: The Web Server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting XSS on t...
PT-2022-24833 · Netlify · Netlify-Ipx
Name of the Vulnerable Software and Affected Versions: netlify-ipx versions prior to 1.2.3 Description: The issue allows an attacker to bypass the source image domain allowlist by sending specially crafted headers, causing the handler to load and return arbitrary images. Because the response is...