SUSE-SU-2022:3004-1 Security update for curl

This update for curl fixes the following issues: - CVE-2022-35252: Fixed a potential injection of control characters into cookies, which could be exploited by sister sites to cause a denial of service bsc1202593...

CVE-2022-28625

A local disclosure of sensitive information vulnerability was discovered in HPE OneView versions: Prior to 7.0 or 6.60.01. A low privileged user could locally exploit this vulnerability to disclose sensitive information resulting in a complete loss of confidentiality, integrity, and availability...

CVE-2022-28625

A local disclosure of sensitive information vulnerability was discovered in HPE OneView versions: Prior to 7.0 or 6.60.01. A low privileged user could locally exploit this vulnerability to disclose sensitive information resulting in a complete loss of confidentiality, integrity, and availability...

Design/Logic Flaw

A local disclosure of sensitive information vulnerability was discovered in HPE OneView versions: Prior to 7.0 or 6.60.01. A low privileged user could locally exploit this vulnerability to disclose sensitive information resulting in a complete loss of confidentiality, integrity, and availability...

CVE-2022-28625

A local disclosure of sensitive information vulnerability was discovered in HPE OneView versions: Prior to 7.0 or 6.60.01. A low privileged user could locally exploit this vulnerability to disclose sensitive information resulting in a complete loss of confidentiality, integrity, and availability...

PT-2022-23485 · Unknown · Online Ordering System

Name of the Vulnerable Software and Affected Versions: Online Ordering System version 2.3.2 Description: A SQL injection issue was found in the Online Ordering System via the user email parameter at the "/admin/login.php" API endpoint. Recommendations: For Online Ordering System version 2.3.2,...

PT-2022-13862 · Cncsoft · Cncsoft

Name of the Vulnerable Software and Affected Versions: CNCSoft versions prior to 1.01.32 Description: The issue arises from improper input sanitization when processing a specific project file, potentially leading to a stack-based buffer overflow condition. Recommendations: For versions prior to...

PT-2022-23141 · Unknown · Zulip Server

Name of the Vulnerable Software and Affected Versions: Zulip Server versions prior to 5.6 Description: The issue arises when displaying messages with embedded remote images. Normally, Zulip loads the image preview via a go-camo proxy server. However, an attacker who can send messages could includ...

PT-2022-4528 · Fuji Electric · Fuji Electric D300Win

Name of the Vulnerable Software and Affected Versions: Fuji Electric D300win versions prior to 3.7.1.17 Description: The issue is related to a buffer overflow operation. It may allow a remote attacker to impact data integrity by exploiting the vulnerability. The vulnerability could enable an...

PT-2022-4617 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 15.1.6 GitLab CE/EE version 15.2 prior to 15.2.4 GitLab CE/EE version 15.3 prior to 15.3.2 Description: The issue is related to insufficient input validation in GitLab, allowing a remote attacker to cause a deni...

SUSE-SU-2022:2936-1 Security update for open-vm-tools

This update for open-vm-tools fixes the following issues: - Updated to version 12.1.0 build 20219665 bsc1202733: - CVE-2022-31676: Fixed an issue that could allow unprivileged users inside a virtual machine to escalate privileges bsc1202657...

PT-2022-22497 · Unknown +4 · Advancecomp +4

Name of the Vulnerable Software and Affected Versions: Advancecomp version 2.3 Description: A segmentation fault was discovered in the software. The issue has been fixed in an update, which addresses several bugs and security issues. Recommendations: For Advancecomp version 2.3, update to a newer...

Security Bulletin: NVIDIA Data Plane Development Kit (MLNX_DPDK) - August 2022

NVIDIA has released a software update for MLNXDPDK to address a security issue that may lead to denial of service, and some impact to data integrity and confidentiality. To protect your system, contact your NVIDIA representative to obtain the MLNXDPDK version that contains the update and install...

PT-2022-4504 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: snipe-it versions prior to 6.0.11 Description: The issue is related to a Cross-site Scripting XSS - Stored vulnerability. It exists due to inadequate protection of the web page structure, allowing a remote attacker to conduct an inter-site...

SUSE-SU-2022:2915-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: - Update to version 2.36.5 bsc1201980: - Add support for PAC proxy in the WebDriver implementation. - Fix video playback when loaded through custom URIs, this fixes video playback in the Yelp documentation browser. - Fix...

MGASA-2022-0303 Updated unbound packages fix security vulnerability

Advisory text to describe the update. Wrap lines at 75 chars. Update to version 1.16.2 fixes many bugs along with versions 1.13.1, 1.13.2, 1.14.0, 1.15.0, 1.16.0 and 1.16.1, and protects against CVE-2022-306989...

Vulnerability fixed in Cisco ACI Multi-Site Orchestrator

Cisco has fixed a vulnerability in ACI Multi-Site Orchestrator. An authenticated malicious party can exploit the exploit the vulnerability to grant itself elevated privileges and execute commands under Administrator privileges. Cisco has released updates to fix the vulnerability in ACI Multi-Site...

DSA-5218-1 zlib - security update

Bulletin has no description...

WordPress Event Calendar – Calendar plugin <= 1.4.6 - Unauthenticated Event Deletion vulnerability

Unauthenticated Event Deletion vulnerability discovered by Nguy Minh Tuan Patchstack Alliance in WordPress Event Calendar – Calendar plugin versions = 1.4.6. Solution Update the WordPress Event Calendar – Calendar plugin to the latest available version at least 1.4.7...

Cisco ACI Multi-Site Orchestrator Privilege Escalation Vulnerability

A vulnerability in the API implementation of Cisco ACI Multi-Site Orchestrator MSO could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability is due to improper authorization on specific APIs. An attacker could exploit this vulnerability by sendi...