Cisco IOS and IOS XE Software Common Industrial Protocol Request Denial of Service Vulnerability

A vulnerability in the processing of malformed Common Industrial Protocol CIP packets that are sent to Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to unexpectedly reload, resulting in a denial of service DoS condition...

Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family DHCP Processing Denial of Service Vulnerability

A vulnerability in the DHCP processing functionality of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. This vulnerability is due to the improper processing of DHCP messages. An...

Cisco IOS XE Software for Catalyst Switches MPLS Denial of Service Vulnerability

A vulnerability in the egress MPLS packet processing function of Cisco IOS XE Software for Cisco Catalyst 3650, Catalyst 3850, and Catalyst 9000 Family Switches could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS...

Cisco IOS XE Software for Catalyst 9200 Series Switches Arbitrary Code Execution Vulnerability

A vulnerability in the software image verification functionality of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches could allow an unauthenticated, physical attacker to execute unsigned code at system boot time. This vulnerability is due to an improper check in the code function tha...

Cisco IOS XE Software DNS NAT Protocol Application Layer Gateway Denial of Service Vulnerability

A vulnerability in the DNS application layer gateway ALG functionality that is used by Network Address Translation NAT in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability is due to a logic error that occurs when an...

Vulnerabilities fixed in IBM WebSphere Application Server and QRadar

IBM has fixed vulnerabilities in WebSphere Application Server and QRadar User Behavior Analytics. The vulnerabilities allow a malicious party able to gain access to system data or execute a Server-Side Request Forgery. Both vulnerabilities require that a malicious party already has access to the...

PT-2022-6174 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points affected versions not specified Description: A vulnerability in the self-healing functionality could allow an authenticated, local attacker to escape the...

PT-2022-6312 · Cisco · Cisco Ios Xe Rom Monitor (Rommon) +1

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE ROM Monitor ROMMON Software for Cisco Catalyst Switches affected versions not specified Description: A problem with file and boot variable permissions in ROMMON could allow an unauthenticated, local attacker to recover the...

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics Installed WebSphere Application Server is vulnerable to Cross-site Scripting (CVE-2022-22477)

Summary The security issue described in CVE-2022-22477 has been identified in the WebSphere Application Server included as part of IBM Tivoli Composite Application Manager for Application Diagnostics Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

CVE-2022-40817

Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some operations on such tickets, like adding and removing links, tags. and related answers. This issue has been fixed in 5.2.2...

PT-2022-25980 · Check Point · Zonealarm Extreme Security

Name of the Vulnerable Software and Affected Versions: Check Point ZoneAlarm Extreme Security versions prior to 15.8.211.19229 Description: The issue allows local users to escalate privileges due to weak permissions for the %PROGRAMDATA%CheckPointZoneAlarmDataUpdates directory and a self-protecti...

hoek subject to prototype pollution via the clone function.

hoek versions prior to 8.5.1, and 9.x prior to 9.0.3 are vulnerable to prototype pollution in the clone function. If an object with the proto key is passed to clone the key is converted to a prototype. This issue has been patched in version 9.0.3, and backported to 8.5.1...

PT-2022-24413 · Kraken.Io · Kraken.Io Image Optimizer

Name of the Vulnerable Software and Affected Versions: Kraken.io Image Optimizer plugin versions = 2.6.5 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web...

PT-2022-25470 · WordPress · Cpo Shortcodes

Name of the Vulnerable Software and Affected Versions: CPO Shortcodes plugin versions prior to 1.5.0 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin or higher privileges can inject malicious scripts into t...

PT-2022-25287 · Tabs · Tabs

Name of the Vulnerable Software and Affected Versions: Tabs plugin versions 3.7.1 and earlier Description: The issue concerns multiple authenticated stored Cross-Site Scripting XSS vulnerabilities. This means that an attacker can inject malicious scripts into the website, which will be executed b...

PT-2022-21797 · Apache · Apache Pulsar Java Client

Name of the Vulnerable Software and Affected Versions: Apache Pulsar Java Client versions 2.6.4 and earlier Apache Pulsar Java Client versions 2.7.0 through 2.7.4 Apache Pulsar Java Client versions 2.8.0 through 2.8.3 Apache Pulsar Java Client versions 2.9.0 through 2.9.2 Apache Pulsar Java Clien...

PT-2022-25274 · WordPress · Awesome-Filterable-Portfolio

Name of the Vulnerable Software and Affected Versions: Awesome Filterable Portfolio plugin version 1.9.7 and earlier Description: The issue is an Unauthenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the website without needin...

WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to sending of test emails discovered by Muhammad Daffa Patchstack Alliance in WordPress Customer Reviews for WooCommerce plugin versions = 5.3.5. Solution Update the WordPress Customer Reviews for WooCommerce plugin to the latest available...

PT-2022-6388 · Adobe · Bridge

Name of the Vulnerable Software and Affected Versions: Adobe Bridge versions 12.0.3 and earlier Adobe Bridge versions 13.0.1 and earlier Description: The issue is related to an out-of-bounds read vulnerability in Adobe Bridge, specifically when parsing embedded fonts. This could lead to the...

PT-2022-24405 · Apache +5 · Apache Xml Graphics Batik +5

Name of the Vulnerable Software and Affected Versions: Apache XML Graphics Batik version 1.14 Description: A Server-Side Request Forgery SSRF vulnerability in Apache XML Graphics Batik allows an attacker to load a URL through the jar protocol. This issue enables information disclosure...