GitLab CE/EE 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab CE/EE that stems from its improper...

DRUPAL-CONTRIB-2022-061

Social Flexible Group is an Open Social extension that allows users to create groups with many different configurations. In specific uncommon scenarios, where a platform doesn't have any flexible groups with the "Group members only secret" visibility, community groups are visible to anonymous use...

Open Social - Moderately critical - Access bypass - SA-CONTRIB-2022-061

Social Flexible Group is an Open Social extension that allows users to create groups with many different configurations. In specific uncommon scenarios, where a platform doesn't have any flexible groups with the "Group members only secret" visibility, community groups are visible to anonymous use...

Menu Item Visibility Control <= 0.5 - Admin+ Arbitrary PHP Code Execution

The plugin doesn't sanitize and validate the "Visibility logic" option for WordPress menu items, which could allow highly privileged users to execute arbitrary PHP code even in a hardened environment. 1. As an admin, go to "Appearance - Menus" and create a menu with some items of your choice. 2. ...

Reducing Risk In The Cloud with Agentless Vulnerability Management

In order to gain visibility into vulnerabilities in their public cloud environments, many organizations still rely on agent or network-based scanning technology that was initially built for traditional infrastructure and endpoints. These methods often struggle to keep up with the speed of change...

CVE-2022-30170

creationtimestamp| type| source ---|---|--- 2022-11-15 10:58:08+00:00| seen| https://t.me/itsecnews/1733 2025-03-11 16:26:29+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114144732022473396 2025-03-11 16:37:20+00:00| seen| https://bsky.app/profile/cti-news.bsky.social/post/3lk4itx4jqk...

QSC 2022: Listening to the Voice of the Customer

It would be redundant to state that today’s threat landscape is growing increasingly sophisticated and erratic. With all types of attacks becoming “commonplace,” the baseline for normal is abnormal. Bad actors are taking advantage of whatever attack vector they can whether that is a phishing...

CVE-2022-39393

Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously ...

Bug in pooling instance allocator

bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance. Mitigations are described here...

SpigotLib._claimRevenue is marked public instead of internal

Lines of code Vulnerability details Impact SpigotLib.claimRevenue is marked public instead of internal. This public function is wrapped in the external claimRevenue function. Attacker can call claimRevenue to claim Revenue Tokens into the Spigot escrow for later withradrawal. Tools Used Manual...

CVE-2022-39393

Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously ...

PT-2022-25283 · WordPress · Wpforo Forum

Name of the Vulnerable Software and Affected Versions: wpForo Forum plugin versions = 2.0.5 Description: The issue is related to an insecure direct object references IDOR vulnerability. This vulnerability allows attackers with subscriber or higher user roles to mark any forum post as private or...

A System Reserved partition is visible in a vDisk when it is created using the Imaging Wizard.

Using the Imaging Wizard a new vDisk is created. A drive letter is assigned to the System Reserved partition and it is visible in the new vDisk. It is expected behavior by design. The System Reserved partition should be invisible to users. Before publishing the vDisk to target devices, the drive...

Join Us November 7-10 for Qualys Security Conference 2022 Las Vegas!

Get ready for our annual event for cybersecurity professionals: Qualys Security Conference 2022 Las Vegas! This years theme is Get More Security which emphasizes simplifying security to drive better outcomes. At the event, you will experience two days of training followed by two days of keynotes,...

Internal function declared but not called

Lines of code Vulnerability details Impact JBTiered721Delegate.processPayment is an internal function that overrides JB721Delegate.processPayment, however is not called by any other function or contract. With this, users who make a paid contribution will not mint any tier for beneficiary. Proof o...

Gain Control of Rapidly Securing Your Critical APIs Without Worrying About Your Backend Stack

Imagine trying to protect your web application farm, while needing to integrate with all the different web servers backend stacks on a one-to-one basis. This requires a WAF that understands systems such as Nginx, Apache, IIS, and Tomcat. You will effectively start a project that will never end du...

How Microsoft Purview and Priva help simplify data protection

At Microsoft Security, we understand how challenging it is to protect your most important asset, your data, in today’s threat landscape. You’re faced with evolving challenges—from empowering employees for greater productivity to eliminating gaps in your infrastructure—all while trying to protect...

How Microsoft Purview and Priva help simplify data protection

At Microsoft Security, we understand how challenging it is to protect your most important asset, your data, in today’s threat landscape. You’re faced with evolving challenges—from empowering employees for greater productivity to eliminating gaps in your infrastructure—all while trying to protect...

CISA BOD 23-01: Meeting and Exceeding CISA Requirements with Qualys

The latest Binding Operational Directive from the Cybersecurity and Infrastructure Security Agency CISA BOD 23-01 requires agencies to implement an essential cybersecurity practice within the next 6 months. While this new mandate impacts agencies directly, it also impacts their supply chain...

CVE-2022-20394

In getInputMethodWindowVisibleHeight of InputMethodManagerService.java, there is a possible way to determine when another app is showing an IME due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is...