PT-2022-3744 · Microsoft · Windows Internet Information Services +1

Name of the Vulnerable Software and Affected Versions: Windows Internet Information Services affected versions not specified Description: The issue is related to the Cachuri Module in Microsoft Internet Information Services IIS and involves incorrect clearance or release of resources. This can be...

PT-2022-3724 · Microsoft · Windows Boot Manager +1

Name of the Vulnerable Software and Affected Versions: Windows Boot Manager affected versions not specified Description: The issue is related to a security feature bypass in the Windows Boot Manager, which is associated with insufficient access control. This could allow an attacker to bypass...

PT-2022-4305 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows affected versions not specified Description: The issue is related to errors in security settings, allowing an attacker to bypass the authentication process. It is a security-feature bypass vulnerability that enables attacker...

PT-2022-3706 · Microsoft · Azure Site Recovery

Name of the Vulnerable Software and Affected Versions: Azure Site Recovery affected versions not specified Description: The issue is related to insufficient access controls in Azure Site Recovery, which can be exploited by a remote attacker to disclose protected information. Recommendations: At t...

PT-2022-3678 · Microsoft · Windows Fax Service +1

Name of the Vulnerable Software and Affected Versions: Windows Fax Service affected versions not specified Description: The issue is related to incorrect code generation management in the Windows Fax Service, which can be exploited by remote attackers to execute arbitrary code and affect the...

PT-2022-3795 · Microsoft · Internet Information Services +1

Name of the Vulnerable Software and Affected Versions: Internet Information Services IIS affected versions not specified Description: The issue is related to an uncontrolled consumption of resources in the Microsoft Internet Information Services IIS package, which can lead to a denial-of-service...

PT-2022-3717 · Microsoft · Windows Print Spooler +1

Name of the Vulnerable Software and Affected Versions: Windows Print Spooler affected versions not specified Description: The issue is related to insufficient access control in the Windows Print Spooler, which can be exploited to elevate privileges. This could allow a remote attacker to gain...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that no specific affected product had been identified. Notes: none...

CVE-2022-27168

Cross-site scripting vulnerability in LiteCart versions prior to 2.4.2 allows a remote attacker to inject an arbitrary script via unspecified vectors...

Synology Photo Station Session Fixation Vulnerability (CNVD-2022-67854)

Synology Photo Station is a solution for sharing pictures, videos and blogs over the Internet from Synology Inc. of Taiwan, China. A session fixation vulnerability exists in Synology Photo Station, which can be exploited by attackers to bypass security constraints via unspecified vectors...

Security Bulletin: Vulnerabilities in IBM Java Runtime affecting Tivoli Netcool/OMNIbus (Multiple CVEs)

Summary There are vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 8 that is used by Tivoli Netcool/OMNIbus. These were disclosed as part of the IBM Java SDK updates in July 2021, October 2021 and January 2022. Vulnerability Details CVEID:CVE-2021-35550 DESCRIPTION: A...

CVE-2022-22681

Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint via unspecified vectors...

PT-2022-16223 · Elastic · Endpoint Security

Name of the Vulnerable Software and Affected Versions: Elastic Endpoint Security for Windows affected versions not specified Description: A local privilege escalation issue was discovered in the ransomware canaries features, which could allow unprivileged users to elevate their privileges to thos...

CVE-2022-33075

A stored cross-site scripting XSS vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via unspecified vectors...

Debian DLA-3058-1 : libsndfile - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3058 advisory. Two issues have been found in libsndfile, a library for reading/writing audio files. CVE-2017-12562 Due to a possible heap buffer overflow attack in an attacker...

Improper access control

Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credentials, cryptographic keys and voicemails files via unspecified vectors...

PT-2022-10021 · Smg · Smg

Name of the Vulnerable Software and Affected Versions: SMG affected versions not specified Description: A malicious authenticated SMG administrator user can obtain passwords for external LDAP/Active Directory servers that they might not otherwise be authorized to access. Recommendations: At the...

UBUNTU-CVE-2022-33067

Lrzip v0.651 was discovered to contain multiple invalid arithmetic shifts via the functions getmagic in lrzip.c and Predictor::init in libzpaq/libzpaq.cpp. These vulnerabilities allow attackers to cause a Denial of Service via unspecified vectors...

CVE-2022-33068

An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service DoS via unspecified vectors...

CVE-2022-33070

Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parsetagandwiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service DoS via unspecified vectors...