SUSE: Security Advisory (SUSE-SU-2022:2582-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress plugin “Enable SVG, WebP & ICO Upload” – Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress Gutenberg plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Autodesk Design Review buffer error vulnerability

Autodesk Design Review ADR is a suite of AutoCAD drafting software assistance software from Autodesk. The software supports viewing, marking, measuring, printing, and tracking changes to 2D and 3D design files. A buffer error vulnerability exists in Autodesk Design Review. An attacker could explo...

PT-2022-9262 · Ovarro · Ovarro Twinsoft

Name of the Vulnerable Software and Affected Versions: Ovarro TWinSoft affected versions not specified Description: An attacker may use TWinSoft and a malicious source project file TPG to extract files on the machine executing Ovarro TWinSoft, which could lead to code execution. Recommendations: ...

CVE-2022-36912

A missing permission check in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...

Missing permission check in repository-connector allows listing the Jenkins controller file system

repository-connector 2.2.0 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. A sequence of requests can b...

WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and Deletion

The plugin contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the user PoC...

DEBIAN-CVE-2022-26306

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which...

CVE-2022-26306

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which...

Design/Logic Flaw

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which...

CVE-2022-26306

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which...

CVE-2022-26306

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which...

pcl:ply_reader_fuzzer: Crash in std::__1::__split_buffer<unsigned char, std::__1::allocator<unsigned char>&>::__

Project: https://github.com/PointCloudLibrary/pcl.git Detailed Report: https://oss-fuzz.com/testcase?key=5835859303202816 Project: pcl Fuzzing Engine: libFuzzer Fuzz Target: plyreaderfuzzer Job Type: libfuzzerubsanpcl Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000009f38a70 Crash...

CVE-2022-25759

The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload...

Cybozu Office Project License Issue Vulnerability

Cybozu Office is a Web-based, cross-platform collaboration solution from Cybozu. Cybozu Office suffers from an authorization issue vulnerability that originates from an improperly restricted operation in Project, which can be exploited by an attacker to alter Project's data via an unspecified...

Cybozu Office Access Control Error Vulnerability

Cybozu Office is a Web-based, cross-platform collaboration solution from Cybozu. An Access Control Error vulnerability exists in Cybozu Office, which stems from improper access restrictions in Cabinet, and can be exploited by an attacker to gain access to Cabinet data via an unspecified vector...

Microweber cross-site scripting vulnerabilities

Microweber is an online store management system that provides drag-and-drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in versions of Microweber prior to 1.2.21, which...

Cybozu Office security vulnerabilities

Cybozu Office is a Web-based, cross-platform collaboration solution from Cybozu. Cybozu Office suffers from an authorization issue vulnerability that originates from an improperly restricted operation in Project, which can be exploited by an attacker to alter Project's data via an unspecified...

Design/Logic Flaw

Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications component: Infrastructure. The supported version that is affected is 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bankin...