CVE-2022-26513

Out-of-bounds write in some IntelR XMMTM 7560 Modem software before version M27560R01.2146.00 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access...

CVE-2022-26513

Out-of-bounds write in some IntelR XMMTM 7560 Modem software before version M27560R01.2146.00 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access...

CVE-2022-29486

Improper buffer restrictions in the Hyperscan library maintained by IntelR all versions downloaded before 04/29/2022 may allow an unauthenticated user to potentially enable escalation of privilege via network access...

CVE-2022-33942

Protection mechanism failure in the IntelR DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access...

CVE-2022-27497

Null pointer dereference in firmware for IntelR AMT before version 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow an unauthenticated user to potentially enable denial of service via network access...

CVE-2022-27497

The CVE-2022-27497 issue is a null pointer dereference in Intel® AMT firmware prior to versions 11.8.93, 11.12.93, 11.22.93, 12.0.92, 14.1.67, 15.0.42, and 16.1.25 that may allow an unauthenticated remote attacker to cause a denial of service via network access. Public sources (Intel IPU advisory...

CVE-2022-27497

Null pointer dereference in firmware for IntelR AMT before version 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow an unauthenticated user to potentially enable denial of service via network access...

OESA-2022-2056 three-eight-nine-ds-base security update

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration. Security Fixes: When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an...

PT-2022-6288 · Intel · Intel Proset/Wireless Wifi

Name of the Vulnerable Software and Affected Versions: IntelR PROSet/Wireless WiFi software versions prior to 22.140 Description: The issue is related to an out-of-bounds write in the IntelR PROSet/Wireless WiFi software, which may allow an unauthenticated user to potentially enable denial of...

CVE-2022-39328

Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patche...

CVE-2022-39328 Grafana vulnerable to race condition allowing privilege escalation

Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patche...

CVE-2022-40292

The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each account within the system...

CVE-2022-40292 Unauthenticated username enumeration in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.

The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each account within the system...

EUVD-2022-42743

The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is present, leadint to remote code execution RCE. To successfully exploit this vulnerability attackers...

PHP Point of Sale 跨站脚本漏洞

PHP Point of Sale is an online point of sale system for small retail businesses from PHP Point of Sale, Inc. A security vulnerability exists in PHP Point of Sale version 19.0, which stems from a barcode generation feature that allows an unauthenticated attacker to generate insecure links that cou...

CVE-2022-38198

There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory versions 10.9.1 and below that may allow a remote, unauthenticated attacker to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser...

tagDiv Composer < 3.5 - Unauthenticated Account Takeover

Description The plugin, required by the themes, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address Run the below command in the developer console of the web browser while being on the blog as an...

Siemens Devices Using Intel CPUs Improper Privilege Management (CVE-2020-8745)

Insufficient control flow management in subsystem for IntelR CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , IntelR TXE versions before 3.1.80 and 4.0.30 may allow an unauthenticated user to potentially enable escalation of privilege via physica...

CVE-2022-37968

Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, becaus...

EulerOS 2.0 SP8 : 389-ds-base (EulerOS-SA-2022-2453)

According to the versions of the 389-ds-base package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that...