CVE-2022-36051 Broken Authorization in ZITADEL Actions

ZITADEL combines the ease of Auth0 and the versatility of Keycloak.Actions, introduced in ZITADEL 1.42.0 on the API and 1.56.0 for Console, is a feature, where users with role.ORGOWNER are able to create Javascript Code, which is invoked by the system at certain points during the login. Actions,...

PT-2022-23598 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: LibreNMS version 22.6.0 Description: The issue is a cross-site scripting XSS vulnerability. It was discovered in the component print-customoid.php. Recommendations: For LibreNMS version 22.6.0, update to a version that fixes the XSS...

PT-2022-21923 · Dell Emc · Dell Emc Data Protection Advisor

Name of the Vulnerable Software and Affected Versions: Dell EMC Data Protection Advisor versions 19.6 and earlier Description: The issue is a Stored Cross Site Scripting, where an attacker could potentially exploit this to store malicious HTML or JavaScript codes in a trusted application data...

PT-2022-4607 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.10 through 15.1.6 GitLab versions 15.2 through 15.2.4 GitLab versions 15.3 through 15.3.2 Description: The issue is related to incorrect authentication with some Package Registries when IP address restrictions are configure...

PT-2022-4616 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 10.0 through 15.1.5 GitLab CE/EE versions 15.2 through 15.2.3 GitLab CE/EE versions 15.3 through 15.3.1 Description: A business logic issue in the handling of large repositories allowed an authenticated and authorized us...

PT-2022-22496 · Unknown +4 · Advancecomp +4

Name of the Vulnerable Software and Affected Versions: Advancecomp version 2.3 Description: A segmentation fault was discovered in Advancecomp. The issue is related to bugs and security issues that have been fixed in an update. Recommendations: For Advancecomp version 2.3, update to a newer versi...

PT-2022-22494 · Unknown +4 · Advancecomp +4

Name of the Vulnerable Software and Affected Versions: Advancecomp version 2.3 Description: A heap buffer overflow issue was discovered in Advancecomp. The software has been updated to fix several bugs and security issues. Recommendations: For Advancecomp version 2.3, update to a newer version th...

Ubuntu: Security Advisory (USN-5322-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-11547 · Mupdf +2 · Mupdf +2

Name of the Vulnerable Software and Affected Versions: Mupdf versions prior to 1.20.0-rc1 Description: A Floating point exception division-by-zero flaw was found in Mupdf for zero width pages in muraster.c. Recommendations: For versions prior to 1.20.0-rc1, update to Mupdf-1.20.0-rc1 or later to...

PT-2022-19205 · Gosecure · Gosecure Titan Inbox Detection & Response

Name of the Vulnerable Software and Affected Versions: GoSecure Titan Inbox Detection & Response IDR versions prior to 2022-04-05 Description: The issue allows for remote code execution due to key reuse. An attacker must craft and sign a serialized payload to exploit this. Recommendations: For...

KLA15726 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. Memory safety vulnerability can be...

PT-2022-8929 · Pngcheck +2 · Pngcheck +2

Name of the Vulnerable Software and Affected Versions: pngcheck version 2.4.0 Description: A global buffer overflow was discovered in the pngcheck function via a crafted png file. Recommendations: For pngcheck version 2.4.0, update to a version that includes a fix for the buffer overflow issue in...

OpenWRT < 18.06.8, 19.x < 19.07.2 ppp Vulnerability

OpenWRT is prone to a buffer overflow vulnerability in ppp. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

PT-2022-23324 · Pukiwiki · Pukiwiki

Name of the Vulnerable Software and Affected Versions: PukiWiki versions 1.3.1 through 1.5.3 Description: A stored cross-site scripting issue allows a remote attacker to inject an arbitrary script via unspecified vectors. Recommendations: For PukiWiki versions 1.3.1 through 1.5.3, update to a...

OpenWRT < 19.07.7 DoS Vulnerability

OpenWRT is prone to a denial of service DoS vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...

PT-2022-21922 · Dell · Dell Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 9.0.0 up to and including 9.1.0.19 Dell PowerScale OneFS version 9.2.1.12 Dell PowerScale OneFS version 9.3.0.6 Dell PowerScale OneFS version 9.4.0.2 Description: The issue is related to an unprotected primary...

WordPress Better Messages plugin <= 1.9.10.57 - Denial Of Service (DoS) vulnerability

Denial Of Service DoS vulnerability was discovered by Dhakal Ananda Patchstack Alliance in the WordPress Better Messages plugin versions = 1.9.10.57. Solution Update the WordPress BP Better Messages plugin to the latest available version at least 1.9.10.58...

Jenkins < 1.482, < 1.466.2 LTS Multiple Vulnerabilities - Linux

Jenkins is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2022-35975 Improper object validation allows for arbitrary code execution in GitOps Tools Extension for VSCode

The GitOps Tools Extension for VSCode can make it easier to manage Flux objects. A specially crafted Flux object may allow for remote code execution in the machine running the extension, in the context of the user that is running VSCode. Users using the VSCode extension to manage clusters that ar...

PT-2022-22603 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX version 5.0.1 Description: A command injection issue was found in FusionPBX via the /fax/fax send.php endpoint. This allows for potential command execution. Recommendations: For FusionPBX version 5.0.1, update to a version that...