CVE-2022-40357

Z-BlogPHP

CVE-2022-40357

A security issue was discovered in Z-BlogPHP = 1.7.2. A Server-Side Request Forgery SSRF vulnerability in the zbusers/plugin/UEditor/php/actioncrawler.php file allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter...

CVE-2022-40357

A security issue was discovered in Z-BlogPHP = 1.7.2. A Server-Side Request Forgery SSRF vulnerability in the zbusers/plugin/UEditor/php/actioncrawler.php file allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter...

CVE-2022-40357

A security issue was discovered in Z-BlogPHP = 1.7.2. A Server-Side Request Forgery SSRF vulnerability in the zbusers/plugin/UEditor/php/actioncrawler.php file allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter...

PT-2022-25359 · Z Blogphp · Z-Blogphp

Name of the Vulnerable Software and Affected Versions: Z-BlogPHP versions prior to 1.7.3 Description: A security issue was discovered that allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter, due to a Server-Side...

Z-BlogPHP 代码问题漏洞

Z-BlogPHP is an open source PHP-based blogging system for the Z-blog community. A security vulnerability exists in Z-BlogPHP 1.7.2 and earlier versions, which stems from a server-side request forgery SSRF vulnerability in the zbusers/plugin/UEditor/php/actioncrawler.php file that allows a remote...

Security Bulletin: Security vulnerability in IBM WebSphere Application Server, which is shipped with IBM Business Process Manager (BPM): CPU Utilization (CVE-2014-0963)

Summary IBM WebSphere Application Server is shipped as a component of IBM Business Process Manager. Information about a security vulnerability, which affects IBM WebSphere Application Server, has been published in a security bulletin. Vulnerability Details For vulnerability details, see the...

Security Bulletin: z/Transaction Processing Facility is affected by an OpenSSL vulnerability

Summary The z/TPF version of OpenSSL was updated to address the vulnerability described by CVE-2019-1563. Vulnerability Details CVEID:CVE-2019-1563 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a padding oracle attack in PKCS7dataDecode and...

Important: Red Hat Security Advisory: Release of containers for OSP 16.2.z director operator tech preview

Red Hat OpenStack Platform 16.2 Train director operator containers, with several Important security fixes, are available for technology preview. Release osp-director-operator images Security Fixes: CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read important CVE-2021-41103...

Important: Red Hat Security Advisory: Release of containers for OSP 16.2.z director operator tech preview

Red Hat OpenStack Platform 16.2 Train director operator containers, with several Important security fixes, are available for technology preview. Release osp-director-operator images Security Fixes: go-getter: unsafe download issue 1 of 3 Important CVE-2022-30321 go-getter: unsafe download issue 2...

apache-commons-compress: infinite loop when reading a specially crafted 7Z archive

A flaw was found in apache-commons-compress. When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This flaw allows the mounting of a denial of service attack against services that use Compress' SevenZ package...

z-mike.de Cross Site Scripting vulnerability OBB-2699766

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

IBM DB2 Denial of Service Vulnerability (CNVD-2022-51655)

IBM DB2 is a relational database management system. The system's execution environments are mainly UNIX, Linux, IBMi, z/OS, and Windows server versions. IBM DB2 suffers from a denial-of-service vulnerability that stems from failure to properly handle incoming error messages, which can be exploite...

IBM DB2 Information Disclosure Vulnerability (CNVD-2022-51656)

IBM DB2 is a relational database management system. The system's execution environments are mainly UNIX, Linux, IBMi, z/OS, and Windows server versions. IBM DB2 has an information disclosure vulnerability, which stems from improper privilege management when using table functions and can be...

A Man of Action: Meet Callum Carney

Hidden Talents : He was a competitive swimmer for many years. Instrument of Choice : His fingers were made for the keyboard, but he used to play the trumpet. 5 pieces of entertainment for the rest of his life : The Office, World War Z, The Matrix, Breaking Bad, The Thick of It...

A Man of Action: Meet Callum Carney

Hidden Talents : He was a competitive swimmer for many years. Instrument of Choice : His fingers were made for the keyboard, but he used to play the trumpet. 5 pieces of entertainment for the rest of his life : The Office, World War Z, The Matrix, Breaking Bad, The Thick of It...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect z/Transaction Processing Facility

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 that is used by the z/TPF system. z/TPF has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2021-35550 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE component could...

z-results.com Cross Site Scripting vulnerability OBB-2644609

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Malicious code in z-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 267edd18c42ec833c902e8d40509bb674420bf51fbb0584b5e386586388bbda8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7372 Malicious code in z-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 267edd18c42ec833c902e8d40509bb674420bf51fbb0584b5e386586388bbda8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...