4775 matches found
PT-2022-5374 · Microsoft · Windows
Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to the implementation of the Microsoft Security Support Provider Interface SSPI in the Windows operating system, which is associated with access control weaknesses...
The vulnerability of the SMTP server of the SuiteCRM system, which manages customer relationships, allows attackers to compromise the integrity of the protected information.
The vulnerability of the SMTP server of the SuiteCRM system for managing customer relationships is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the protected information...
CVE-2022-31008
RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker link state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions...
The vulnerability of the Valmet System 2019 software suite (Metso DNA) lies in the lack of authentication for a critical function, allowing a perpetrator to execute arbitrary codes.
The vulnerability of the Valmet System 2019 software suite Metso DNA is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a remote attacker to execute any code on the server...
The vulnerability of Xen hypervisors, related to deficiencies in the authorization process, allows attackers to gain unauthorized access to protected information.
The vulnerability of Xen hypervisors is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
UBUNTU-CVE-2022-3128
The Donation Thermometer WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
The vulnerability of the “id” parameter in the “content.php” script of the Webexcels Ecommerce CMS allows a hacker to execute XSS attacks.
The vulnerability of the “id” parameter in the “content.php” script of the Webexcels Ecommerce CMS system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...
The vulnerability of the devMode debugging mode implementation in the Apache Struts software platform allows attackers to perform cross-site scripting attacks.
The vulnerability of the devMode debugging mode implementation in the Apache Struts software platform is related to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
Zyxel CloudCNM SecuManager 安全漏洞
Zyxel CloudCNM SecuManager is a set of network management software from China Hopkins Zyxel. The software supports centralized control, device management and intelligent monitoring. A security vulnerability exists in Zyxel CloudCNM SecuManager version 3.1.0 and 3.1.1, which originates from weak...
Smart eVision 安全漏洞
Smart eVision Information Technology Smart eVision is a business intelligence platform of China Union Quan Information Technology Smart eVision Information Technology Company. Smart eVision is a business intelligence platform that combines business management rooms, dashboards, reports, and input...
Mozilla: Content-Security-Policy base-uri bypass
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that when injecting an HTML base element; some requests would ignore the CSP's base-uri settings and accept the injected element's base instead...
Backdoor.Win32.Bingle.b MVID-2022-0643 Hardcoded Credential
Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/eacaa12336f50f1c395663fba92a4d32.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Bingle.b Vulnerability: Weak Hardcoded Credentials Description: The malware...
Security Bulletin: WebSphere eXtreme Scale Monitoring Console Web Vulnerabilities (CVE-2013-5390, CVE-2013-5393, CVE-2013-5394)
Abstract Three web security vulnerabilities were identified in the WebSphere eXtreme Scale monitoring console, those being a cross site scripting vulnerability, a log-off processing weakness, and vulnerability to a phishing attack. Content VULNERABILITY DETAILS: CVEID:CVE-2013-5390 DESCRIPTION: A...
PT-2022-22662 · Node.Js +6 · Node.Js +6
Name of the Vulnerable Software and Affected Versions: Node.js version 18 Description: A weak randomness issue exists in the WebCrypto keygen due to a change with EntropySource in SecretKeyGenTraits::DoKeyGen in src/crypto/crypto keygen.cc. There are two main problems: 1. The return value of...
The vulnerability of the “EMIAS” operating system’s libacl.so.1 library allows attackers to execute unintended logic and other unexpected behaviors in applications.
The vulnerability of the “libacl.so.1” library in the “EMIAS” operating system is related to the use of an erroneous operator. Exploiting this vulnerability may allow attackers to execute unintended logic and other unexpected behaviors in the application...
Microsoft Visual Studio Code Remote Code Execution (CVE-2021-27084)
A remote code execution vulnerability exists in the Maven for Java Extension for Microsoft Visual Studio Code. The vulnerability is due to a design weakness. A remote attacker can exploit this vulnerability by enticing a user to open a maliciously crafted Java Maven project folder...
PT-2022-5617 · Microsoft · Windows Print Spooler +1
Name of the Vulnerable Software and Affected Versions: Windows Print Spooler affected versions not specified Description: The issue is related to insufficient access control in the Windows Print Spooler, which can be exploited to elevate privileges. This allows an attacker to affect the system. N...
CVE-2022-37164
Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes...
DRUPAL-CONTRIB-2022-054
The Next.js module provides an inline preview for content. Authenticated requests are made to Drupal to fetch JSON:API content and render them in an iframe from the decoupled Next.js site. The current implementation doesn’t sufficiently check access for fetching data. All requests made to Drupal...
The vulnerability of the Corosync/Pacemaker PCS configuration tool is related to deficiencies in the authentication process, which allows attackers to escalate their privileges.
The vulnerability of the Corosync/Pacemaker PCS configuration tool is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...