PT-2022-19658

Name of the Vulnerable Software and Affected Versions Sygnoos Popup Builder plugin versions = 4.1.11 Description A Cross-Site Request Forgery CSRF issue allows an attacker to update plugin settings. Recommendations For Sygnoos Popup Builder plugin versions = 4.1.11, update to a version higher tha...

PT-2022-19152

Name of the Vulnerable Software and Affected Versions YIKES Inc. Custom Product Tabs for WooCommerce plugin version 1.7.7 and earlier Description The issue is related to a Broken Access Control vulnerability, which allows for the update of the yikes-the-content-toggle option. This vulnerability...

CVE-2022-34169

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 o...

PT-2022-8920 · Dell · Dell Bsafe Crypto-C Micro Edition +1

Name of the Vulnerable Software and Affected Versions: Dell BSAFE Crypto-C Micro Edition versions prior to 4.1.5 Dell BSAFE Micro Edition Suite versions prior to 4.6 Description: The issue is related to an Observable Timing Discrepancy. This means that the time it takes for the software to respon...

PT-2022-11321 · Unknown · Validate-Data

Name of the Vulnerable Software and Affected Versions: validate-data version 0.1.1 Description: A Regular Expression Denial of Service ReDOS issue was found in the validation of crafted invalid emails. This occurs when the software attempts to validate specially crafted email addresses, leading t...

PT-2022-20535 · Rsshub · Rsshub

Name of the Vulnerable Software and Affected Versions: RSSHub versions prior to 5c4177441417 Description: The issue arises when special values are passed to the filter and filterout parameters, causing abnormally high CPU usage. This impacts the performance of servers and RSSHub services,...

PT-2022-22061 · Jenkins +1 · Jenkins +2

Name of the Vulnerable Software and Affected Versions: Jenkins ontrack Jenkins Plugin versions 4.0.0 and earlier Description: The issue is a stored cross-site scripting XSS vulnerability that occurs because the plugin does not escape the name of certain parameters on views displaying parameters...

PT-2022-3202 · Unknown · Igss Data Server

Name of the Vulnerable Software and Affected Versions: IGSS Data Server - IGSSdataServer.exe versions prior to V15.0.0.22170 Description: A buffer copy without checking the size of input vulnerability exists, potentially leading to a stack-based buffer overflow and remote code execution when an...

PT-2022-13310 · WordPress · Advanced Admin Search

Name of the Vulnerable Software and Affected Versions: Advanced Admin Search WordPress plugin versions prior to 1.1.6 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because some parameters are not properly sanitized and escaped before being outputted back...

PT-2022-20450 · Sofia-Sip +4 · Sofia-Sip +4

Name of the Vulnerable Software and Affected Versions: Sofia-SIP versions prior to 1.13.8 Description: Sofia-SIP is an open-source Session Initiation Protocol SIP User-Agent library. When parsing each line of a sdp message, rest = record + 2 will access the memory behind 0 and cause an...

PT-2022-14184 · Libmobi +2 · Libmobi +2

Name of the Vulnerable Software and Affected Versions: libmobi versions prior to 0.11 Description: The issue is a Buffer Over-read in the GitHub repository bfabiszewski/libmobi. Recommendations: For versions prior to 0.11, update to version 0.11 or later to resolve the issue...

CVE-2022-31648

Talend Administration Center is vulnerable to a reflected Cross-Site Scripting XSS issue in the SSO login endpoint. The issue is fixed for versions 8.0.x in TPS-5233, for versions 7.3.x in TPS-5324, and for versions 7.2.x in TPS-5235. Earlier versions of Talend Administration Center may also be...

GHSA-9F3P-WVJ7-Q82X Cargo prior to Rust 1.26.0 may download the wrong dependency

Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the package configuration key. Usage of the package key to rename dependencies in Cargo.toml is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency,...

PT-2022-20651 · Mastodon · Mastodon

Name of the Vulnerable Software and Affected Versions: Mastodon versions prior to 3.5.0 Description: The issue allows a bypass of e-mail restrictions in the app/models/user.rb file. Recommendations: For versions prior to 3.5.0, update to version 3.5.0 or later to resolve the issue...

WordPress JupiterX premium theme <= 2.0.6 - Insufficient Access Control leading to Authenticated Arbitrary Plugin Deactivation and Settings Modification

Insufficient Access Control leading to Authenticated Arbitrary Plugin Deactivation and Settings Modification discovered by Ramuel Gall Wordfence in WordPress JupiterX premium theme versions = 2.0.6. Solution Update the WordPress JupiterX premium theme to the latest available version at least 2.0....

PT-2022-20403 · Jenkins · Jenkins Repo Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins REPO Plugin versions 1.14.0 and earlier Description: The issue allows attackers who can configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs. This enables...

PT-2022-16184 · Aruba · Aruba Clearpass Policy Manager

Name of the Vulnerable Software and Affected Versions: Aruba ClearPass Policy Manager versions 6.10.4 and below Aruba ClearPass Policy Manager versions 6.9.9 and below Aruba ClearPass Policy Manager versions 6.8.9-HF2 and below Aruba ClearPass Policy Manager versions 6.7.x and below Description: ...

PT-2022-13847 · WordPress · Fusion Builder

Name of the Vulnerable Software and Affected Versions: Fusion Builder WordPress plugin versions prior to 3.6.2 Description: The issue concerns a lack of validation for a parameter in the plugin's forms, allowing for arbitrary HTTP requests. The returned data is reflected back in the application's...

PT-2022-20300 · Janet · Janet

Name of the Vulnerable Software and Affected Versions: Janet versions prior to 1.22.0 Description: The issue is related to the mishandling of arrays in Janet. Recommendations: For versions prior to 1.22.0, update to version 1.22.0 or later to resolve the issue...

CVE-2022-29943

Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity XXE processing to achieve read access as root on the remote filesystem. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201...