Design/Logic Flaw

Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on the Jenkins controller file system...

Input validation

In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 memory can be read beyond the intended scope due to insufficient validation of input data. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these...

SUSE-SU-2022:3984-1 Security update for freerdp

This update for freerdp fixes the following issues: - CVE-2022-39282: Fix to init data read by /parallel command line switch. bsc1204258 - CVE-2022-39283: Fix to prevent video channel from reading uninitialized data. bsc1204257...

CVE-2022-45381

Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Configuration library that enable the 'file:' prefix interpolator by default, allowing attackers able to configure Pipelines to read arbitrary...

CVE-2022-45388

Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on the Jenkins controller file system...

GSD-2022-1007118 tracing: Fix reading strings from synthetic events

tracing: Fix reading strings from synthetic events This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.75 by commit...

PT-2022-6810

Name of the Vulnerable Software and Affected Versions OpenImageIO version 2.4.4.2 Description The issue is related to a component of the OpenImageIO library, specifically the IFFOutput channel interleaving functionality, which is vulnerable to a buffer data reading beyond valid boundaries. This c...

OESA-2022-2091 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

CVE-2022-31255 SUMA/UYUNI directory path traversal vulnerability in CobblerSnipperViewAction

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to read files...

CVE-2022-43319

An information disclosure vulnerability in the component vcs/downloadFiles.php?download=./search.php of Simple E-Learning System v1.0 allows attackers to read arbitrary files...

Adobe InDesign Buffer Overflow Info Disclosure

The vulnerability of Adobe InDesign’s computer layout automation tool is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to access confidential information through a specially crafted file...

linuxptp bug fix update

An update is available for linuxptp. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The linuxptp packages provide Precision Time Protocol PTP implementation for...

Gin-Vue-Admin code-related vulnerabilities

Gin-Vue-Admin is a full-stack pre-development infrastructure platform based on Vue and Gin development. A code issue exists in Gin-Vue-Admin versions prior to 2.5.4, which stems from a validation of the fileMd5 and fileName parameters, which could lead to reading arbitrary files...

PT-2022-6804

Name of the Vulnerable Software and Affected Versions OpenImageIO versions 2.3.19.0 through 2.4.4.2 Description A denial of service issue exists in the DDS native tile reading functionality. This can be triggered by a specially-crafted .dds file, allowing an attacker to cause a denial of service...

CVE-2022-43429

Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to read arbitrary files on the Jenkins controller file system...

CVE-2022-41477

A security issue was discovered in WeBid =1.2.2. A Server-Side Request Forgery SSRF vulnerability in the admin/theme.php file allows remote attackers to inject payloads via theme parameters to read files across directories...

CVE-2022-41477

A security issue was discovered in WeBid =1.2.2. A Server-Side Request Forgery SSRF vulnerability in the admin/theme.php file allows remote attackers to inject payloads via theme parameters to read files across directories...

Melis Platform path traversal vulnerability

Melis Platform is an open source cross-framework digital platform from Melis Platform Open Source. A path traversal vulnerability exists in Melis Platform MelisAssetManager. An attacker exploiting this vulnerability could read arbitrary files, which could lead to the disclosure of sensitive...

Veritas NetBackup DiscoveryService Service XML External Entity Injection Vulnerability

Veritas NetBackup is a storage service used by Veritas, Inc. to provide backup and recovery capabilities for enterprise environments. Veritas NetBackup 10.0.0.1 and previous versions are vulnerable to XML external entity injection, which stems from the fact that the DiscoveryService service does...

CVE-2022-39296 Path traversal in MelisAssetManager

MelisAssetManager provides deliveries of Melis Platform's assets located in every module's public folder. Attackers can read arbitrary files on affected versions of melisplatform/melis-asset-manager, leading to the disclosure of sensitive information. Conducting this attack does not require...