Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vulnerability can be exploited by using the file download or execution path as the parameter value of the vulnerable function.
Improper input validation vulnerability in Mangboard commerce package could lead to occur for abnormal request. A remote attacker can exploit this vulnerability to manipulate the total order amount into a negative number and then pay for the order.
rubygem-git-1.11.0-1.fc34
Security fix for CVE-2022-25648
rubygem-git-1.11.0-1.fc36
Security fix for CVE-2022-25648
rubygem-git-1.11.0-1.fc35
Security fix for CVE-2022-25648
USN-5424-1 fixed a vulnerability in OpenLDAP. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that OpenLDAP incorrectly handled certain SQL statements
within LDAP queries in the experimental back-sql backend. A remote attacker
could possibly use this issue to perform an SQL injection attack and alter
the database.
Multiple security issues were discovered in Thunderbird, which could
result in denial of service or the execution of arbitrary code.
Jacek Konieczny discovered a SQL injection vulnerability in the back-sql
backend to slapd in OpenLDAP, a free implementation of the Lightweight
Directory Access Protocol, allowing an attacker to alter the database
during an LDAP search operation when a specially crafted search filter
is processed.
Multiple vulnerabilities have been discovered in VMware Products, the most severe of which could result in Authentication Bypass.
VMware Workspace ONE Access is an access control application for Workspace ONE.
VMware Identity Manager is the identity and access management component of Workspace ONE.
vRealize Automationi is a management platform for automating the delivery of container-based applications.
VMware Cloud Foundation is a hybrid cloud platform that provides a set of software-defined services for compute, storage, networking, security and cloud management to run enterprise apps.
vRealize Suite Lifecycle Manager allows for complete lifecycle and content management capabilities for vRealize Suite products.
Successful exploitation of the most severe of these vulnerabilities could result in Authentication Bypass. A malicious actor may be able to obtain administrative access. Depending on the permission associated with the application running the exploit, an attacker could then install programs; view, change, or delete data.
Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on May 18
SEC Consult Vulnerability Lab Security Advisory < 20220518-0 >
=======================================================================
title: Multiple Critical Vulnerabilities
product: SAP® Application Server
ABAP and ABAP® Platform (Different Software Components)
vulnerable version: see section “Vulnerable / tested versions”
fixed version: see SAP security notes…
