CVE-2021-40335 Cross Site Request Forgery (CSRF) in Hitachi Energy’s MSM Product

A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This cause a Cross Site Request Forgery CSRF, which if exploited could lead an attack...

Fedora: Security Advisory for python-notebook (FEDORA-2022-35b698150c)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for python-notebook (FEDORA-2022-85aa8e5706)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: python-notebook-6.4.0-4.fc35

The Jupyter Notebook is a web application that allows you to create and share documents that contain live code, equations, visualizations, and explanatory text. The Notebook has support for multiple programming languages, sharing, and interactive widgets...

[SECURITY] Fedora 36 Update: python-notebook-6.4.11-3.fc36

The Jupyter Notebook is a web application that allows you to create and share documents that contain live code, equations, visualizations, and explanatory text. The Notebook has support for multiple programming languages, sharing, and interactive widgets...

UBUNTU-CVE-2022-2255

A vulnerability was found in modwsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing...

The vulnerability of the iControl REST API interface for access control and remote authentication, the BIG-IP Access Policy Manager, the virtual server for application protection, the BIG-IP Advanced Web Application Firewall, the BIG-IP Advanced Firewall Manager, the infrastructure status analysis tool, the BIG-IP Application Acceleration Manager, the DDoS protection module, the BIG-IP Fraud Protection Service, the Internet traffic balancing system, the BIG-IP Link Controller, and the local traffic balancing system – all of these allow a perpetrator to cause service interruptions.

The vulnerabilities of the iControl REST API interface for access control and remote authentication, the BIG-IP Access Policy Manager, the virtual server for application protection, the BIG-IP Advanced Web Application Firewall, the BIG-IP Advanced Firewall Manager, the infrastructure status...

Johnson Controls Metasys ADS/ADX/OAS Servers 访问控制错误漏洞

Johnson Controls Metasys ADS/ADX/OAS Servers is an application and data server from Johnson Controls, Inc. An access control error vulnerability exists in Johnson Controls Metasys ADS/ADX/OAS versions 10 and 11, which stems from the fact that under certain circumstances, an unauthenticated user c...

IBM Sterling Partner Engagement Manager Cross-Site Request Forgery Vulnerability

IBM Sterling Partner Engagement Manager is an automation management tool from IBM U.S.A. A cross-site request forgery vulnerability exists in IBM Sterling Partner Engagement Manager, which stems from a WEB application that does not adequately validate that the request is from a trusted user. An...

Fixed in Apache Tomcat 10.1.0-M17

Low: Apache Tomcat XSS in examples web application CVE-2022-34305 The Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability. This was fixed with commit d6251d1c. This issue was reported to the Apache Tomcat Securit...

Fixed in Apache Tomcat 9.0.65

Low: Apache Tomcat XSS in examples web application CVE-2022-34305 The Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability. This was fixed with commit 8b60af90. This issue was reported to the Apache Tomcat Securit...

Multiple Imperva Products Earn 2022 Fortress Cyber Security Awards

In June, the Business Intelligence Group announced that three Imperva products have earned the 2022 Fortress Cyber Security Awards. The mission of this prestigious award program is to identify and reward leading companies and products globally that are successfully keeping data and electronic...

IBM Sterling Partner Engagement Manager 跨站请求伪造漏洞

IBM Sterling Partner Engagement Manager is an automation management tool from IBM U.S.A. A cross-site request forgery vulnerability exists in IBM Sterling Partner Engagement Manager, which stems from a WEB application that does not adequately validate that the request is from a trusted user. An...

Oracle Fusion Middleware 输入验证错误漏洞

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle USA. The platform provides middleware, software collections, and other capabilities. An input validation error vulnerability exists in Oracle Fusion...

mod_wsgi 数据伪造问题漏洞

modwsgi is a package. It implements an easy-to-use Apache module. A security vulnerability exists in modwsgi that stems from the X-Client-IP header not being removed from requests from untrusted proxies, allowing an attacker to pass the X-Client-IP header to a target WSGI application due to the...

CVE-2022-34365

WMS 3.7 contains a Path Traversal Vulnerability in Device API. An attacker could potentially exploit this vulnerability, to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application...

Web Application Firewall Detected

A Web Application Firewall WAF has been detected during the scan. A WAF is designed to help protecting web applications by monitoring and filtering HTTPS traffic through a set of rules in order to prevent the most common attacks. The identified WAF may have blocked several requests during the...

WordPress Download Monitor Plugin < 4.5.91 Information Disclosure Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

Crowdsignal Polls & Ratings < 3.0.8 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting var form1 = document.getElementById'hack'; form1.submit;...

Hardcoded credentials

An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The binary file /usr/local/sbin/webproject/setparam.cgi contains hardcoded credentials to the web application. Because these accounts cannot be deactivated or have their passwords changed, they are considered to be backdoor accounts...