CVE-2023-1335

CVE-2023-1335 affects the RapidLoad Power-Up for Autoptimize WordPress plugin. A missing capability check in the ucss_connect function (versions up to and including 1.7.1) allows authenticated subscribers to update plugin settings by connecting a new license key to the site. Impact is limited to ...

CVE-2023-1022

CVE-2023-1022 affects the WP Meta SEO WordPress plugin. Root cause: missing capability check in wpmsGGSaveInformation, with access control relying on nonce checks that are accessible to all authenticated users. Affected versions: up to and including 4.5.3. Impact: authenticated subscribers can up...

CVE-2023-1023

The CVE-2023-1023 entry concerns the WordPress WP Meta SEO plugin. A missing capability check in the saveSitemapSettings function allows authenticated users with subscriber-level access to update sitemap-related plugin settings, due to reliance on a nonce-based access control that is accessible t...

WordPress plugin WP Meta SEO 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

K42534513: Multiple PeopleSoft Enterprise PeopleTools vulnerabilities

Security Advisory Description CVE-2018-3129 Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Portal. Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows unauthenticated attacker with...

SUSE CVE-2017-10241

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to...

SUSE CVE-2017-10239

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to...

SUSE CVE-2022-21368

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Components Services. Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

PT-2022-24175

Name of the Vulnerable Software and Affected Versions Jeg Elementor Kit plugin for WordPress versions up to, and including, 2.5.6 Description The issue allows unauthenticated users to bypass authorization and update plugin settings, including the MailChimp API key, global styles, 404 page setting...

PT-2022-22419 · WordPress · Wp Hide

Name of the Vulnerable Software and Affected Versions: WP Hide WordPress plugin versions 0.0.0 through 0.0.2 Description: The issue concerns a lack of authorization and CSRF checks when updating the custom wpadmin slug settings. This allows unauthenticated attackers to update the settings with a...

Design/Logic Flaw

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions 12.9.99.228 and above, prior to 14.0.99.24, authorizations are not properly verified when updating the branch prefix used by the GitLab repository integration. Authenticated users ca...

CVE-2022-21619

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to...

mysql: InnoDB unspecified vulnerability (CPU Apr 2022)

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of...

PT-2022-6472

Name of the Vulnerable Software and Affected Versions Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 Description The issue is related to insufficient access control in the Active IQ Unified Manager, which allows unauthorized users to update EMS...

GHSA-77QM-WVQQ-FG79 Directus vulnerable to unhandled exception on illegal filename_disk value

The Directus process can be aborted by having an authorized user update the filenamedisk value to a folder and accessing that file through the /assets endpoint. The vulnerability is patched and released in v9.15.0. You can prevent this problem by making sure no untrusted non-admin users have...

Oracle WebLogic Server Core Component Input Validation Error Vulnerability

Oracle WebLogic Server is a product of Oracle Corporation. Oracle WebLogic Server is an application services middleware for cloud and traditional environments that provides a modern, lightweight development platform that supports the entire lifecycle management of applications from development to...

PT-2022-3786

Name of the Vulnerable Software and Affected Versions Oracle MySQL Server versions 8.0.29 and prior Description The issue is related to the InnoDB component of Oracle MySQL Server and is associated with access control weaknesses. It allows a low-privileged attacker with network access via multipl...

CVE-2022-21549

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 17.0.3.1; Oracle GraalVM Enterprise Edition: 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated...

CVE-2022-23705

A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays, and HPE Nimble Storage Secondary Flash Arrays which could potentially allow the upload, but not execution, of unauthorized update binaries to the array. HPE has made the...

CVE-2022-23705

CVE-2022-23705 affects HPE Nimble Storage Hybrid Flash Arrays, All Flash Arrays, and Secondary Flash Arrays. The vulnerability could allow the upload of unauthorized update binaries to the array, but not their execution. Publicly documented exploitation details are not provided in these sources. ...