PT-2022-27656 · WordPress · Contest Gallery

Name of the Vulnerable Software and Affected Versions: Contest Gallery plugin versions = 13.1.0.9 Description: The issue is related to an Unauth. Stored Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be stored on the website, potentially affecting user sessions...

PT-2022-27466 · Kwoksys · Kwok Information Server

Name of the Vulnerable Software and Affected Versions: Kwoksys Kwok Information Server versions prior to 2.9.5.SP31 Description: An XML external entity XXE injection issue allows remote authenticated users to conduct server-side request forgery SSRF attacks. This enables attackers to manipulate t...

PT-2022-25284 · Xylus Themes · Xylus Themes Wp Smart Import

Name of the Vulnerable Software and Affected Versions: Xylus Themes WP Smart Import plugin versions 1.0.2 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability affects the Xylus Themes WP Smart Import plugin on WordPress,...

CVE-2022-46169 Unauthenticated Command Injection

Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data...

PT-2022-27862 · Veritas · Veritas Netbackup Access Appliance +1

Name of the Vulnerable Software and Affected Versions: Veritas NetBackup Flex Scale versions 1.0 through 3.0 Veritas NetBackup Access Appliance versions 1.0 through 8.0.100 Description: An issue was discovered that allows authenticated remote command execution via the management portal...

PT-2022-25644 · WordPress · 2Kb Amazon Affiliates Store Plugin

Name of the Vulnerable Software and Affected Versions: 2kb Amazon Affiliates Store plugin versions =2.1.5 Description: The issue is a Reflected Cross-Site Scripting XSS vulnerability. This means an attacker can inject malicious scripts into a website, potentially stealing user data or taking...

ConnectWise Quietly Patches Flaw That Helps Phishers

ConnectWise, which offers a self-hosted, remote desktop software application that is widely used by Managed Service Providers MSPs, is warning about an unusually sophisticated phishing attack that can let attackers take remote control over user systems when recipients click the included link. The...

PT-2022-19784 · Delta Industrial Automation · Dialink

Name of the Vulnerable Software and Affected Versions: Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 Description: The issue arises from the software's failure to properly neutralize special elements within a pathname constructed from external input. This pathname is intend...

PT-2022-26957 · Aruba · Aruba Edgeconnect Enterprise

Name of the Vulnerable Software and Affected Versions: Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.2.1.1 Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.1.3.1 Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.0.7.1 Aruba EdgeConnect Enterprise Softwa...

PT-2022-24151 · Aruba · Aruba Edgeconnect Enterprise

Name of the Vulnerable Software and Affected Versions: Aruba EdgeConnect Enterprise versions 9.2.1.0 and below Aruba EdgeConnect Enterprise versions 9.1.3.0 and below Aruba EdgeConnect Enterprise versions 9.0.7.0 and below Aruba EdgeConnect Enterprise versions 8.3.7.1 and below Description: A...

PT-2022-8170 · Digital Alert Systems · Dasdec

Name of the Vulnerable Software and Affected Versions: Digital Alert Systems' DASDEC software versions prior to 4.1 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the SSH username, username field of the login page, or via the HTTP host header. The inject...

Intel® AMT SDK, Intel® EMA and Intel® MC Advisory

Summary: A potential security vulnerability in the Intel® Active Management Technology AMT SDK, Intel® Endpoint Management Assistant EMA and Intel® Manageability Commander MC may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability...

PT-2022-24152 · Aruba · Aruba Edgeconnect Enterprise

Name of the Vulnerable Software and Affected Versions: Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.2.1.0 Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.1.3.0 Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.0.7.0 Aruba EdgeConnect Enterprise Softwa...

PT-2022-25943 · Line · Line Client For Ios

Name of the Vulnerable Software and Affected Versions: LINE client for iOS versions prior to 12.17.0 Description: The issue is related to the LINE client for iOS, where sharing an invalid shared key of end-to-end encryption e2ee in a group chat might cause the application to crash. Recommendation...

PT-2022-5972 · 3S Smart Software Solutions · Codesys Development System V3

Name of the Vulnerable Software and Affected Versions: CODESYS Development System V3 versions prior to V3.5.18.40 Description: The issue is related to inadequate encryption strength, allowing an unauthenticated local attacker to access and manipulate the code of the encrypted boot application. It...

CVE-2022-41965 Opencast Authenticated OpenRedirect Vulnerability

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to...

DLA-3209-1 ini4j - security update

Bulletin has no description...

MGASA-2022-0441 Updated xterm packages fix security vulnerability

xterm before patch 375 can enable an RCE under certain conditions...

Cybozu Remote Service vulnerable to Uncontrolled Resource Consumption

Overview Cybozu Remote Service provided by Cybozu, Inc. is vulnerable to uncontrolled resource consumption CWE-400. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of the solution through JVN. Impact A logged-in user may consume huge storage space, resulting to a...

CVE-2022-44748 Uploading workflows to KNIME Server may override arbitrary file system contents

A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. This vulnerability is also known as 'Zip-Slip'. An attacker can create a KNIME workflow that, when being uploaded, ca...