#redis

Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for production environments. Versions prior to 1.8.8-release are subject to authentication bypass in the admin and monitor user groups by deleting the X-Requested-With: XMLHttpRequest field in the request header. This issue has been patched in 1.8.8-release. There are no known workarounds.

RRX IOB LP version 1.0 suffers from a DNS cache snooping vulnerability.

WiFi File Transfer version 1.0.8 suffers from a cross site scripting vulnerability.

Backdoor.Win32.Redkod.d malware suffers from a hardcoded credential vulnerability.

Webile version 1.0.1 suffers from a directory traversal vulnerability.

Backdoor.Win32.DarkSky.23 malware suffers from a buffer overflow vulnerability.

anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens.

Data importation mechanism failed to sanitize imports

Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Gabe Livan's Asset CleanUp: Page Speed Booster plugin <= 1.3.8.4 at WordPress.

lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be acquired nested within one another, but in respectively opposite order. With suitable timing between the involved grant copy operations this may result in the locking up of a CPU.