1278 matches found
WordPress SP Project & Document Manager Plugin <= 4.67 is vulnerable to SQL Injection
Software SP Project & Document Manager Type Plugin Vulnerable versions = 4.67 Fixed in 4.68 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-36677 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID 5776b5f22100 Credits Le Ngoc Anh Required privilege...
SP Project & Document Manager < 4.68 - Subscriber+ Insecure Direct Object References
The plugin allows direct access to objects, allowing an authenticated user with subscriber privileges or above, to bypass authorization and change user passwords and potentially take over administrator accounts...
Trend Micro Mobile Security for Enterprise å®å Øę¼ę“
Trend Micro Mobile Security for Enterprise is a mobile antivirus software from Trend Micro. A security vulnerability exists in Trend Micro Mobile Security for Enterprise version 9.8 SP5, which originates from the inclusion of vulnerable php files. The vulnerability can be exploited by an attacker...
The vulnerability in the implementation of the Kerberos network protocol on Debian GNU/Linux, Red Hat Enterprise Linux, Ubuntu, Fedora, and Alt 8 SP operating systems allows a perpetrator to cause a service failure.
The vulnerability of the Kerberos network protocol implementation in Debian GNU/Linux, Red Hat Enterprise Linux, Ubuntu, Fedora, and Alt 8 SP is related to an uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...
CVE-2023-36661
Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows...
PT-2023-24403 Ā· Unknown Ā· Imperial Cms
Name of the Vulnerable Software and Affected Versions: Imperial CMS version 7.5 Description: The issue allows for arbitrary file deletion via the DelspReFile function in the /sp/ListSp.php API endpoint. Attackers can exploit this by sending a crafted POST request to the vulnerable endpoint...
caieiras.sp.gov.br Cross Site Scripting vulnerability OBB-3384629
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Malicious code in discord-sp (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32f41fb60beb906f09872435c3ee0bdf7290d56df0a8cf1a097f7416ce1b898c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Security Bulletin: OpenSSL security vulnerability CVE-2021-3449 and CVE-2021-3450 in IBM Safer Payments versions of 6.1 and 6.2 below 6.1.0.08 and 6.2.1.03
Summary CVE-2021-3449: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference in signaturealgorithms processing. By sending a specially crafted renegotiation ClientHello message from a client, a remote attacker could exploit this vulnerability to cause the TLS server t...
B. Braun Battery Pack SP with Wi-Fi
1. EXECUTIVE SUMMARY CVSS v3 5.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: B. Braun Melsungen AG Equipment: Battery Pack SP with Wi-Fi Vulnerability: Improper neutralization of directives in dynamically evaluated code 'Eval Injection' 2. RISK EVALUATION Successful exploitation...
WordPress Sp*tify Play Button for WordPress Plugin <= 2.07 is vulnerable to Cross Site Scripting (XSS)
Software Sptify Play Button for WordPress Type Plugin Vulnerable versions = 2.07 Fixed in 2.08 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1840 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a420be81ae3b Credits Marco...
Cross site scripting
The Sptify Play Button for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.07 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
Malicious code in kemnasa-sp (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11e53e1596af827447edef4919e4a6f003dcb35cfd0e674d6062c2a626982249 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-553 Malicious code in kemnasa-sp (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11e53e1596af827447edef4919e4a6f003dcb35cfd0e674d6062c2a626982249 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
openssl security update
1.0.2k-26fips - Change Epoch from 1 to 10 - Fix DH self-test to add shared secret comparison Orabug: 32467026 - Add DH support changes for SP 800-56A rev3 requirements Orabug: 32467059 - Add TLS KDF self-test Orabug: 32467193 - Add EC keys pairwise consistency test Orabug: 32467059 1:1.0.2k-26 -...
Malicious code in sp-home-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 666572c644b50ae47d8c155e0e6297e840cf222216ebb534d81b4e4d1e501491 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in sp-yammer-common (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23e8aa9f2fdde63c7f1d8b9e4885d5fb8dcc69ae8544c66b319067aba02d0c62 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-784 Malicious code in sp-home-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 666572c644b50ae47d8c155e0e6297e840cf222216ebb534d81b4e4d1e501491 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-785 Malicious code in sp-yammer-common (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23e8aa9f2fdde63c7f1d8b9e4885d5fb8dcc69ae8544c66b319067aba02d0c62 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview sp-yammer-common is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...