GHSA-9PVX-FWWH-W289 Puppet does not properly restrict access to node resources

Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors...

Puppet does not properly restrict access to node resources

Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors...

Puppet does not properly restrict access to node resources

Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors...

GHSA-MVMV-RQ2J-97P2 Etherpad Lite Access Restriction Bypass

node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions...

HashiCorp Consul Access Restriction Bypass

HashiCorp Consul and Consul Enterprise 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "" as its secret is used in unusual circumstances...

GHSA-FHM8-CXCV-PWVC HashiCorp Consul Access Restriction Bypass

HashiCorp Consul and Consul Enterprise 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "" as its secret is used in unusual circumstances...

GHSA-9P54-PC88-36C4 Moodle does not properly restrict access to category and course data

The filebrowser component in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not properly restrict access to category and course data, which allows remote attackers to obtain potentially sensitive information via a request for a file...

GHSA-6XPM-Q8X9-J3RW Moodle allows attackers to bypass intended access restrictions

The choice module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote authenticated users to bypass intended access restrictions by visiting a URL to add or delete responses in the closed state...

GHSA-2VHR-4MHQ-M35C Moodle does not properly restrict access

The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict 1 view and 2 edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to...

GHSA-MG69-5Q59-8JCG Moodle does not enforce the moodle/site:accessallgroups capability requirement

mod/forum/classes/postform.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, which allows remote authenticated users...

PT-2022-19961 · Unknown · Insurance Management System

Name of the Vulnerable Software and Affected Versions: Insurance Management System version 1.0 Description: The issue allows for SQL Injection via the "/insurance/editAgent.php?agent id=" endpoint, where an attacker can manipulate the agent id variable to inject malicious SQL code. Recommendation...

PT-2022-6990 · Unknown · Solarview Compact

Name of the Vulnerable Software and Affected Versions: SolarView Compact version 6.00 Description: The issue exists due to the failure to neutralize special elements used in an operating system command in the conf mail.php component of the SolarView Compact device. This can allow an attacker to...

Design/Logic Flaw

Due to an insecure direct object reference vulnerability in Gitlab EE/CE affecting all versions from 11.0 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1, an endpoint may reveal the issue title to a user who crafted an API call with the ID of the issue from a public project that...

CVE-2022-1352

Removed by vendor...

PT-2022-10527 · Mikrotik · Routeros +1

Name of the Vulnerable Software and Affected Versions: Mikrotik RouterOs versions prior to 6.48.2 Description: The issue is related to a memory corruption vulnerability in the tr069-client process. An authenticated remote attacker can cause a Denial of Service due to a NULL pointer dereference...

PT-2022-3460 · Siemens · Desigo Pxc4 +3

Name of the Vulnerable Software and Affected Versions: Desigo DXR2 versions prior to V01.21.142.5-22 Desigo PXC3 versions prior to V01.21.142.4-18 Desigo PXC4 versions prior to V02.20.142.10-10884 Desigo PXC5 versions prior to V02.20.142.10-10884 Description: The issue is related to an error in...

PT-2022-2475 · Microsoft · Active Directory Certificate Services +2

Name of the Vulnerable Software and Affected Versions: Windows LSA versions prior to the fixed version Description: The issue is related to a spoofing vulnerability in the Windows LSA component, allowing attackers to bypass authentication mechanisms. This can enable a remote attacker to perform a...

PT-2022-3921 · Intel · Intel Advisor

Name of the Vulnerable Software and Affected Versions: Intel Advisor versions prior to 7.6.0.37 Description: The issue is related to insufficient control flow management, which may allow an authenticated user to potentially enable escalation of privilege via local access. This is due to insecure...

PT-2022-4324 · Intel · Intel Optane Ssd +2

Name of the Vulnerable Software and Affected Versions: Intel SSD versions affected versions not specified Intel Optane SSD versions affected versions not specified Intel Optane SSD DC versions affected versions not specified Intel SSD DC versions affected versions not specified Description: The...

Fortinet FortiSOAR Access Control Error Vulnerability

Fortinet FortiSOAR is a Security Orchestration, Automation and Response SOAR solution from Fortinet U.S.A. An access control error vulnerability exists in Fortinet FortiSOAR, which stems from an application access restriction error that could be exploited by a remote, unauthenticated attacker to...