PT-2022-27252 · Rocket.Chat · Rocket.Chat-Desktop

Name of the Vulnerable Software and Affected Versions: Rocket.Chat-Desktop versions prior to 3.8.14 Description: A command injection issue exists that could allow an attacker to pass a malicious URL to shell.openExternal, potentially leading to remote code execution. This is because the...

PT-2022-28012 · Unknown · Usememos/Memos

Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.0 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input and later displays it without proper validation, allowing attackers to inject...

PT-2022-28071 · F Secure · F-Secure Safe Browser

Name of the Vulnerable Software and Affected Versions: F-Secure SAFE Browser versions 19.1 through 19.1 Description: The issue allows an IDN homograph attack. This type of attack involves using similar-looking characters from different alphabets to create fake domain names that appear legitimate,...

PT-2022-10530 · Baidu · Baidunetdisk

Name of the Vulnerable Software and Affected Versions: Baidunetdisk versions 7.4.3 and earlier Description: The issue allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. This is due to an untrusted search path vulnerability. Recommendations: For versions 7.4....

PT-2022-6374 · Dell · Dell Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 8.2.0 through 9.3.0 Description: The issue is related to a security problem with the user interface of Dell PowerScale OneFS. An unauthenticated remote user could unintentionally lead an administrator to enable...

CVE-2022-0843

Mozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety bugs present in Firefox 97. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabilit...

PT-2022-27800 · Unknown · Daloradius

Name of the Vulnerable Software and Affected Versions: daloradius versions prior to master Description: The issue concerns a sensitive cookie without the 'HttpOnly' flag in the GitHub repository lirantal/daloradius. This could potentially allow unauthorized access to sensitive information...

PT-2022-28077 · Isode · Isode M-Vault

Name of the Vulnerable Software and Affected Versions: Isode M-Vault versions 16.0v0 through 17.x before 17.0v24 Description: The issue causes Isode M-Vault to crash when it receives an LDAP v1 bind request. Recommendations: For versions 16.0v0 through 17.x before 17.0v24, update to version 17.0v...

CVE-2022-4632 Auto Upload Images cross site scripting

A vulnerability has been found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.3.1 is able to address this issue...

Citrix Endpoint Management (aka XenMobile Server) 10.14.0 Rolling Patch 9

Package name: xms10.14.0.10942.bin For: XenMobile Server 10.14.0 Deployment type: On-premises only Replaces: xms10.14.0.10813.bin, xms10.14.0.10742.bin, xms10.14.0.10628.bin, xms10.14.0.10521.bin, xms10.14.0.10424.bin, xms10.14.0.10303.bin, xms10.14.0.10206.bin, and xms10.14.0.10118.bin. Date:...

Corel Roxio Creator LJB starts a program with an unquoted file path

Overview Roxio Creator LJB provided by Corel Corporation starts another program with an unquoted file path CWE-428. Haruka Hino of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact Since a...

PT-2022-27798 · Unknown · Denshi Nyusatsu Core System

Name of the Vulnerable Software and Affected Versions: DENSHI NYUSATSU CORE SYSTEM versions prior to v6 R4 Description: A cross-site scripting issue allows a remote unauthenticated attacker to inject an arbitrary script. Recommendations: For versions prior to v6 R4, update to a version later than...

PT-2022-25427 · WordPress · Inpost Gallery

Name of the Vulnerable Software and Affected Versions: InPost Gallery WordPress plugin version 2.1.4 and earlier Description: The issue arises from the insecure use of PHP's extract function when rendering HTML views, allowing attackers to force the inclusion of malicious files and URLs. This cou...

PT-2022-25408 · WordPress · Joomsport

Name of the Vulnerable Software and Affected Versions: JoomSport WordPress plugin versions prior to 5.2.8 Description: The issue is related to a SQL injection that can be exploited by unauthenticated users due to improper sanitization and escaping of a parameter in a SQL statement. Recommendation...

JVN#13075438: Corel Roxio Creator LJB starts a program with an unquoted file path

Roxio Creator LJB provided by Corel Corporation starts another program with an unquoted file path CWE-428. Impact Since a registered Windows service path contains spaces and are unquoted, if a malicious executable is placed on a certain path, the executable may be executed with the privilege of t...

PT-2022-6470 · Abb · Abb Remote Monitoring/Control +2

Name of the Vulnerable Software and Affected Versions: ABB Relion protection relays - 611 series versions 1.0.0 through 2.0.3 ABB Relion protection relays - 615 series IEC 4.0 FP1 versions 4.1.0 through 4.1.9 ABB Relion protection relays - 615 series CN 4.0 FP1 versions 4.1.0 through 4.1.8 ABB...

PT-2022-25030 · WordPress · Fv Flowplayer Video Player

Name of the Vulnerable Software and Affected Versions: Flowplayer Video Player WordPress plugin versions prior to 1.0.5 Description: The issue is related to the Flowplayer Video Player WordPress plugin, which does not validate and escape some of its shortcode attributes before outputting them bac...

MGASA-2022-0479 Updated advancecomp packages fix security vulnerability

advancecomp has been updated to fix a number of bugs and security issues...

CVE-2022-46691

A memory consumption issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution...

CVE-2022-46700

A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution...