CVE’s

Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports.

An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json" header.

An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page."

An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another administrator clicks on it.

An issue was discovered in MISP before 2.4.158. There is stored XSS in the event graph via a tag name.

An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters.

LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 48d6ece8.

An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field.

An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur.

Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inject Sudo rules and escalate privileges to root. This occurs in certain situations involving a race condition.