CVE-2022-34857

CVE-2022-34857 is a reflected Cross-Site Scripting vulnerability in the WordPress plugin SP Project & Document Manager (smartypants) version

Malicious Package

Overview sp-bootstrap is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

WordPress SP Project & Document Manager plugin <= 4.59 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Vlad Vector Patchstack in WordPress SP Project & Document Manager plugin versions = 4.59. Solution Update the WordPress SP Project & Document Manager plugin to the latest available version at least 4.62...

SP Project & Document Manager < 4.62 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

August 9, 2022-Security and Quality Rollup for .NET Framework 2.0, 3.0, 4.6.2 for Windows Server 2008 SP2 (KB5016741)

August 9, 2022-Security and Quality Rollup for .NET Framework 2.0, 3.0, 4.6.2 for Windows Server 2008 SP2 KB5016741 Applies to:Microsoft .NET Framework 2.0 Microsoft .NET Framework 3.0 Microsoft .NET Framework 4.6.2 IMPORTANT Verify that you have installed the required updates listed in the How t...

CVE-2022-1551

The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files...

CVE-2022-1551 SP Project & Document Manager < 4.58 - Sensitive File Disclosure

The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files...

CVE-2022-1551

CVE-2022-1551 affects the SP Project & Document Manager WordPress plugin prior to version 4.58. The issue stems from an easily guessable path used to store user files, enabling a user to access other users’ sensitive files. Exploitation details in connected documents include a PoC demonstrating a...

Malicious code in sp-test-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0747fa45a6337d47013511fb9ca8dc324f8023f4b8a0c8ccd0b5a9a7801bed6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6225 Malicious code in sp-test-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0747fa45a6337d47013511fb9ca8dc324f8023f4b8a0c8ccd0b5a9a7801bed6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sp-messaging-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f04c7112192b8f05201e25876a21a254bf15d23cc05565b041a89956b5839a66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6224 Malicious code in sp-messaging-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f04c7112192b8f05201e25876a21a254bf15d23cc05565b041a89956b5839a66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sp-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12ea0ed6eb9e952555479abaffce89b9ec1fabf26dab71f7e5fff8cf1b0ed57a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6223 Malicious code in sp-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12ea0ed6eb9e952555479abaffce89b9ec1fabf26dab71f7e5fff8cf1b0ed57a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-26493

Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker with access to a HTTP-request intercepting method is able to bypass authentication and authorization by removing the SAML Assertion Signatur...

CVE-2022-26493

CVE-2022-26493 affects Xecurify’s miniOrange Drupal SAML SP modules (Premium, Standard, Enterprise) for Drupal 7, 8, and 9. The root cause is an authentication/authorization bypass via removing the SAML Assertion Signature, allowing an attacker who can intercept HTTP requests to impersonate exist...

CVE-2022-26493 miniOrange SAML Authentication Bypass

Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker with access to a HTTP-request intercepting method is able to bypass authentication and authorization by removing the SAML Assertion Signatur...

CVE-2022-26493

Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker with access to a HTTP-request intercepting method is able to bypass authentication and authorization by removing the SAML Assertion Signatur...

GHSA-PMJ6-9F8C-8G2M Saltstack Salt Unauthenticated Arbitrary Code Execution

A Incorrect Implementation of Authentication Algorithm vulnerability in of SUSE SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE SUSE Linux Enterprise Server ...

taciba.sp.gov.br Cross Site Scripting vulnerability OBB-2624753

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...