PT-2022-5779 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows affected versions not specified Description: The issue is related to insufficient input validation in the Remote Procedure Call RPC runtime environment of Microsoft Windows operating systems. This can be exploited by a remot...

PT-2022-5734 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is caused by synchronization errors when using a shared resource in the Advanced Local Procedure Call ALPC handler of the Windows operating system. This can allow an attacker to...

PT-2022-23619 · Avdor Cis · Avdor Cis

Name of the Vulnerable Software and Affected Versions: Avdor CIS - crystal quality affected versions not specified Description: The issue concerns a credentials management error in a phone call recorder product, allowing an attacker to hear recorded calls without authenticating to the system. Thi...

DEBIAN-CVE-2022-3077

A buffer overflow vulnerability was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way it handled the I2CSMBUSBLOCKPROCCALL case via the ioctl I2CSMBUS with malicious input data. This flaw could allow a local user to crash the system...

DEBIAN-CVE-2022-2905

An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpftailcall function with a key larger than the maxentries of the map. This flaw allows a local user to gain unauthorized access to data...

AZL-10922 CVE-2022-2905 affecting package kernel for versions less than 5.15.70.1-1

An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpftailcall function with a key larger than the maxentries of the map. This flaw allows a local user to gain unauthorized access to data...

UBUNTU-CVE-2022-2905

An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpftailcall function with a key larger than the maxentries of the map. This flaw allows a local user to gain unauthorized access to data...

CVE-2022-36090

CVE-2022-36090 affects XWiki Platform Old Core. Prior to versions 13.1.0.5 and 14.3-rc-1, some resources, including the REST service, did not properly check for inactive (not yet activated or disabled) users, allowing a disabled user to enable themselves via REST and potentially perform actions o...

No validation on wcanto may lead into lock deposit because of arbitrary address in deposit call

Lines of code Vulnerability details No validation on wcanto may lead into lock deposit because of arbitrary address in deposit call Impact Address wcanto is not being validated. In case of wrong deployment, function swapExactCANTOForTokens will lock ether in a wrong contract. Consideration...

ManageEngine OpManager Plus getDNSResolveOption Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine OpManager Plus. Authentication is required to exploit this vulnerability. The specific flaw exists within the getDNSResolveOption function. The issue results from the lack of proper...

CVE-2022-36796 WordPress CallRail Phone Call Tracking plugin <= 0.4.9 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Stored Cross-Site Scripting XSS in CallRail, Inc. CallRail Phone Call Tracking plugin = 0.4.9 at WordPress...

CVE-2022-36796: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability leading to Stored Cross-Site Scripting XSS in CallRail, Inc. CallRail Phone Call Tracking plugin = 0.4.9 at WordPress...

WordPress plugin CallRail Phone Call Tracking has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress CallRail Phone Call Tracking plugin <= 0.4.9 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Stored Cross-Site Scripting XSS discovered by Rasi Afeef Patchstack Alliance in WordPress CallRail Phone Call Tracking plugin versions = 0.4.9. Solution Update the WordPress CallRail Phone Call Tracking plugin to the latest available versio...

ManageEngine OpManager getDNSResolveOption Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine OpManager. Authentication is required to exploit this vulnerability. The specific flaw exists within the getDNSResolveOption function. The issue results from the lack of proper validatio...

ManageEngine NetFlow Analyzer getNmapInitialOption Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine NetFlow Analyzer. Authentication is required to exploit this vulnerability. The specific flaw exists within the getNmapInitialOption function. The issue results from the lack of proper...

ManageEngine OpManager Plus getNmapInitialOption Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine OpManager Plus. Authentication is required to exploit this vulnerability. The specific flaw exists within the getNmapInitialOption function. The issue results from the lack of proper...

ManageEngine OpManager getNmapInitialOption Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine OpManager. Authentication is required to exploit this vulnerability. The specific flaw exists within the getNmapInitialOption function. The issue results from the lack of proper validati...

CallRail Phone Call Tracking < 0.4.10 - Stored XSS via CSRF

The plugin does not have CSRF check in place and it also lacking sanitisation as well as escaping in some parameters, which could allow attackers to make a logged in admin put Stored Cross-Site Scripting payloads in them...

PT-2022-23631 · Callrail · Callrail Phone Call Tracking Plugin

Name of the Vulnerable Software and Affected Versions: CallRail Phone Call Tracking plugin versions = 0.4.9 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that leads to Stored Cross-Site Scripting XSS. This means an attacker can trick a user into performing unintended...