Design/Logic Flaw

A permissions issue was addressed with improved validation. This issue is fixed in Security Update 2022-001 Catalina, macOS Monterey 12.2, macOS Big Sur 11.6.3. An application may be able to access restricted files...

PT-2022-2075

Name of the Vulnerable Software and Affected Versions Paramiko versions prior to 2.10.1 Description The issue is related to a race condition in the write private key file function, which could allow unauthorized information disclosure due to synchronization errors when using a shared resource. Th...

PT-2022-6932 · Mariadb +9 · Mariadb Server +9

Name of the Vulnerable Software and Affected Versions: MariaDB Server versions 10.6.3 and below Description: The issue is related to an use-after-free in the my mb wc latin1 component at /strings/ctype-latin1.c. This could potentially allow a remote attacker to cause a denial of service...

PT-2022-6936 · Mariadb +9 · Mariadb Server +9

Name of the Vulnerable Software and Affected Versions: MariaDB Server versions 10.9 and below Description: The issue is related to a segmentation fault in the sql/field conv.cc component of the MariaDB Server. This fault can be exploited by a remote attacker to cause a denial of service. The...

PT-2022-6937 · Mariadb +9 · Mariadb Server +9

Name of the Vulnerable Software and Affected Versions: MariaDB Server versions 10.9 and below Description: The issue is related to a segmentation fault in the sql/item cmpfunc.h component of the MariaDB Server. It is associated with insufficient use of the assert function. Exploitation of this...

PT-2022-18293 · Jenkins · Jenkins Gitlab Authentication Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins GitLab Authentication Plugin versions 1.13 and earlier Description: The issue concerns the storage of the GitLab client secret in an unencrypted form within the global config.xml file on the Jenkins controller. This allows users with...

SPIP Information Disclosure Vulnerability (CNVD-2022-21820)

SPIP is a Web-based content distribution system used primarily for online collaboration. A security vulnerability exists in SPIP, which stems from a web-based system or product that does not properly restrict access to resources from unauthorized roles. An unauthenticated attacker could use this...

PT-2022-12910 · Unknown +2 · Phpliteadmin +2

Name of the Vulnerable Software and Affected Versions: phpLiteAdmin versions prior to 1.9.8.2 Description: The issue allows for XSS attacks via the newRows parameter, also known as num or number, in the index.php file. Recommendations: For versions prior to 1.9.8.2, avoid using the newRows...

PT-2022-10510

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 8.9 Description An issue was discovered in OpenSSH where a client using public-key authentication with agent forwarding but without -oLogLevel=verbose may be unable to determine whether FIDO authentication is confirmi...

CVE-2021-32477

The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability site administrators by default. Moodle versions 3.10 to 3.10.3 are affected...

CVE-2022-24726 Unauthenticated control plane denial of service attack in Istio

Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing when the...

jenkins-2-plugins/subversion: does not restrict the name of a file when looking up a subversion key

An incorrect access restriction vulnerability was found in the Subversion Plugin for Jenkins. An agent's ability to learn the name of a file is not restricted when looking up a subversion key file on the controller. This may allow attackers to control agent processes and read arbitrary files on t...

PT-2022-1803 · Terramaster · Terramaster Tos

Name of the Vulnerable Software and Affected Versions: TerraMaster OS versions 4.2.29 and earlier Description: The issue is related to the webNasIPS module in TerraMaster OS, which allows for the injection of arbitrary commands. This can enable a remote attacker to gain access to protected...

PT-2022-8592

Name of the Vulnerable Software and Affected Versions Intelliants Subrion CMS version 4.2.1 Description A Cross Site Request Forgery CSRF issue exists via the Members administrator function, allowing a remote unauthenticated malicious user to send an authorized request to a victim and successfull...

Access Restriction Bypass

Overview Affected versions of this package are vulnerable to Access Restriction Bypass because a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify message from the handshake, and never present a certificate. Remediation...

PT-2022-16262 · Zoho · Zoho Manageengine Desktop Central

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Desktop Central versions prior to 10.1.2137.8 Description: The issue allows the exposure of the installed server name to anyone, enabling the discovery of the internal hostname by reading HTTP redirect responses. This can be...

GHSA-MJ6M-246H-9W56 Improper regex in htaccess file

Impact the default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path. Patches Please upgrade to...

Missing access restriction on addConnectedChain

Lines of code Vulnerability details Impact The addConnectedChain function is supposed to be called only by the CHAINCONNECTORROLE. / Requirements: - Function caller has to be granted with CHAINCONNECTORROLE. - Target chain must be different from the current. / However, there is no such restrictio...

PT-2022-17099 · WordPress · Wp Statistics

Name of the Vulnerable Software and Affected Versions: WP Statistics versions up to and including 13.1.5 Description: The issue is related to SQL Injection due to insufficient escaping and parameterization of the current page id parameter found in the /includes/class-wp-statistics-hits.php file...

PT-2022-3896 · Totolink · Totolink A3600R

Name of the Vulnerable Software and Affected Versions: TOTOLink A3600R version 4.1.2cu.5182 B20201102 Description: The issue is related to a command injection vulnerability in the "Main" function of the TOTOLink A3600R router's firmware. This vulnerability is caused by the lack of input data...