‼ CVE-2022-24116 ‼
📖 Read
via "National Vulnerability Database".
Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II before 8.3.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44758 ‼
📖 Read
via "National Vulnerability Database".
Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred_mech_type of GSS_C_NO_OID and a nonzero initial_response value to send_accept.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44855 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. There is Blind Stored XSS via a URL to the Upload Image feature.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37309 ‼
📖 Read
via "National Vulnerability Database".
OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37307 ‼
📖 Read
via "National Vulnerability Database".
OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37310 ‼
📖 Read
via "National Vulnerability Database".
OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&cap= URI.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45467 ‼
📖 Read
via "National Vulnerability Database".
In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=guadaapi URI. Any number of %00 instances can be used, e.g., .%00%00%00./.%00%00%00./api/account_new_create could also be used for the scripts parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44854 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API publicly caches results from private wikis.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29853 ‼
📖 Read
via "National Vulnerability Database".
OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45466 ‼
📖 Read
via "National Vulnerability Database".
In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_keys text file in the /resources/ folder.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37308 ‼
📖 Read
via "National Vulnerability Database".
OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24117 ‼
📖 Read
via "National Vulnerability Database".
Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, TD220X before 2.0.16, and TD220MAX before 1.2.6.📖 Read
via "National Vulnerability Database".
⚠ LastPass finally admits: Those crooks who got in? They did steal your password vaults, after all… ⚠
📖 Read
via "Naked Security".
The crooks now know who you are, where you live, which computers are yours, where you go online... and they got those password vaults, too.📖 Read
via "Naked Security".
Naked Security
LastPass finally admits: Those crooks who got in? They did steal your password vaults, after all…
The crooks now know who you are, where you live, which computers are yours, where you go online… and they got those password vaults, too.
‼ CVE-2022-4266 ‼
📖 Read
via "National Vulnerability Database".
The Bulk Delete Users by Email WordPress plugin through 1.2 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete non admin users by knowing their email via a CSRF attack📖 Read
via "National Vulnerability Database".
‼ CVE-2022-4042 ‼
📖 Read
via "National Vulnerability Database".
The Paytium: Mollie payment forms & donations WordPress plugin through 4.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-4156 ‼
📖 Read
via "National Vulnerability Database".
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the user_id POST parameter before concatenating it to an SQL query in ajax-functions-backend.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-4268 ‼
📖 Read
via "National Vulnerability Database".
The Plugin Logic WordPress plugin through 1.0.7 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3835 ‼
📖 Read
via "National Vulnerability Database".
The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-4157 ‼
📖 Read
via "National Vulnerability Database".
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_option_id POST parameter before concatenating it to an SQL query in export-votes-all.php. This may allow malicious users with administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-4150 ‼
📖 Read
via "National Vulnerability Database".
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-search.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-4152 ‼
📖 Read
via "National Vulnerability Database".
The Contest Gallery WordPress plugin before 19.1.5, Contest Gallery Pro WordPress plugin before 19.1.5 do not escape the option_id POST parameter before concatenating it to an SQL query in edit-options.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.📖 Read
via "National Vulnerability Database".