PT-2022-19509 · Coreboot +1 · Coreboot +1

Name of the Vulnerable Software and Affected Versions: coreboot versions 4.13 through 4.16 Description: An issue in coreboot allows arbitrary code execution in SMM on APs. Recommendations: For coreboot versions 4.13 through 4.16, update to a version that fixes this issue. At the moment, there is ...

CVE-2022-23159

Dell PowerScale OneFS, 8.2.2 - 9.3.0.x, contain a missing release of memory after effective lifetime vulnerability. An authenticated user with ISIPRIVLOGINSSH and/or ISIPRIVLOGINCONSOLE and ISIPRIVAUTHPROVIDERS privileges could exploit this vulnerability, leading to a Denial-Of-Service. This can...

PT-2022-6760 · Adobe · Acrobat Reader

Name of the Vulnerable Software and Affected Versions: Acrobat Reader DC versions 17.012.30205 through 22.001.20085 Acrobat Reader DC versions 20.005.3031x and earlier Description: A use-after-free vulnerability in Adobe Acrobat and Reader could result in arbitrary code execution in the context o...

PT-2022-10565 · Wedevs · Wedevs Wp Project Manager

Name of the Vulnerable Software and Affected Versions: weDevs WP Project Manager plugin versions = 2.4.13 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with certain privileges, such as a subscriber or higher user...

PT-2022-13575 · Unknown · Calibre-Web

Name of the Vulnerable Software and Affected Versions: calibre-web versions prior to 0.6.18 Description: The issue is related to Server-Side Request Forgery SSRF in the GitHub repository janeczku/calibre-web. SSRF is a type of attack where an attacker can trick a server into making requests to...

PT-2022-10: Local Authentication Restriction Bypass in HPE OneView

The vulnerability was identified in HPE OneView versions before 6.6. The discovered vulnerability allows an attaker to bypass local authentication restriction. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 29.03.2022 Recommendations: Update to version 6.6 Additional...

PT-2022-13110 · Sophos · Sophos Firewall

Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to v18.5 MR3 Description: An information disclosure issue in Webadmin allows an unauthenticated remote attacker to read the device serial number. Recommendations: For Sophos Firewall versions prior to v18.5 MR3,...

PT-2022-18850 · Jenkins · Jenkins Job/Node Ownership Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Job and Node ownership Plugin versions 0.13.0 and earlier Description: A missing permission check in the plugin allows attackers with Item/Read permission to change the owners and item-specific permissions of a job. Recommendations: F...

PT-2022-13303 · WordPress · Database Peek

Name of the Vulnerable Software and Affected Versions: Database Peek WordPress plugin versions prior to 1.3 Description: The issue arises from the lack of proper sanitization and escaping of the match parameter, which is then outputted back in an admin page. This leads to a Reflected Cross-Site...

PT-2025-7996 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.17.0-rc8+ Description: A vulnerability in the Linux kernel has been resolved, related to the btrfs filesystem. The issue occurs when the btrfs get blocks direct write function reserves temporary outstanding...

PT-2022-15376 · Ibm · Ibm Spectrum Copy Data Management

Name of the Vulnerable Software and Affected Versions: IBM Spectrum Copy Data Management versions 2.2.0.0 through 2.2.14.3 Description: The issue is caused by improper validation of input by the HOST headers, leading to HTTP header injection. This could allow an attacker to conduct various attack...

HTML injection possibility in voucher code form in Shopware

Impact HTML injection possibility in voucher code form Patches Patched in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6...

PT-2022-17554 · Unknown · Watch Active Plugin

Name of the Vulnerable Software and Affected Versions: Watch Active Plugin versions prior to 2.2.07.22012751 Description: The issue allows an attacker to access password information of connected WiFiAp in the log. Recommendations: For versions prior to 2.2.07.22012751, update to version...

UBUNTU-CVE-2022-23648

containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to...

PT-2022-9543 · WordPress · Use Any Font | Custom Font Uploader

Name of the Vulnerable Software and Affected Versions: Use Any Font | Custom Font Uploader WordPress plugin versions prior to 6.2.1 Description: The issue allows unauthenticated users to send arbitrary CSS, which will be processed by the frontend for all users. This is due to the lack of...

CVE-2022-21654 Incorrect configuration handling allows TLS session re-use without re-validation in Envoy

Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised...

PT-2022-4806 · Libtiff +9 · Libtiff +9

Name of the Vulnerable Software and Affected Versions: libtiff library version 4.3.0 Description: A heap buffer overflow in the ExtractImageSection function in tiffcrop.c allows an attacker to trigger unsafe or out of bounds memory access via a crafted TIFF image file, which could result in an...

PT-2022-11: Remote Buffer Overflow in HPE iLO Amplifier Pack

The vulnerability was identified in HPE iLO Amplifier Pack versions prior to 2.12. These vulnerabilities could be exploited by a highly privileged user to remotely execute code that could lead to a loss of confidentiality, integrity, and availability. Vulnerability status: Confirmed by vendor Dat...

PT-2022-11669 · Splashtop · Splashtop Remote Client

Name of the Vulnerable Software and Affected Versions: Splashtop Remote Client Business Edition versions 3.4.8.3 and earlier Description: The issue is related to the creation of a temporary file in a directory with insecure permissions. This could potentially lead to security issues, but specific...

CVE-2022-21660

Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higher privilege users. Authentication is missing on the setUserInfo function. Users are advised to update as soon as possible. There are no known workarounds...