PT-2022-13170 · WordPress · Five Star Restaurant Reservations

Name of the Vulnerable Software and Affected Versions: Five Star Restaurant Reservations WordPress plugin versions prior to 2.4.12 Description: The issue allows unauthenticated users to change the payment status of arbitrary bookings due to a lack of authorization. Additionally, it enables...

PT-2022-26170 · Unknown · Knative.Dev/Func

Name of the Vulnerable Software and Affected Versions: knative.dev/func versions prior to 1.8.1 Description: The issue affects developers using malicious or compromised third-party buildpacks, potentially exposing their registry credentials or local docker socket to a malicious lifecycle containe...

PT-2022-24630 · WordPress · Wpml Multilingual Cms

Name of the Vulnerable Software and Affected Versions: WPML Multilingual CMS premium plugin versions = 4.5.10 Description: The issue allows users with subscriber or higher user roles to change the status of the translation jobs due to a Broken Access Control vulnerability in the WPML Multilingual...

PT-2022-25473 · Unknown · Creative Mail

Name of the Vulnerable Software and Affected Versions: Creative Mail plugin versions = 1.5.4 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is authenticated to...

PT-2022-26073 · WordPress · Soledad

Name of the Vulnerable Software and Affected Versions: Soledad premium theme version 8.2.5 and earlier Description: A Cross-Site Scripting XSS issue affects the Soledad premium theme on WordPress, specifically for users with subscriber or higher authentication. This issue allows for malicious...

JVN#13927745: WordPress Plugin "WordPress Popular Posts" accepts untrusted external inputs to update certain internal variables

WordPress Plugin "WordPress Popular Posts" provided by Hector Cabrera accepts untrusted external inputs to update certain internal variables CWE-454. Impact The number of views for an article may be manipulated through a crafted input. Solution Update the plugin Update the plugin according to the...

Discourse < 2.8.11 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

PT-2022-25811 · Ezoic · Ezoic

Name of the Vulnerable Software and Affected Versions: Ezoic plugin versions = 2.8.8 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, which can then be...

PT-2022-20368 · Red Lion Controls · Crimson 3.2 +2

Name of the Vulnerable Software and Affected Versions: Red Lion Controls Crimson 3.0 versions 707.000 and prior Red Lion Controls Crimson 3.1 versions 3126.001 and prior Red Lion Controls Crimson 3.2 versions 3.2.0044.0 and prior Description: The issue allows an attacker to obtain user credential...

PT-2022-26749 · Media5 · Mediatrix 4102

Name of the Vulnerable Software and Affected Versions: Mediatrix 4102 versions prior to 48.5.2718 Description: The issue allows local attackers to gain root access via the UART port. Recommendations: For versions prior to 48.5.2718, update to version 48.5.2718 or later to resolve the issue...

PT-2022-27400 · WordPress · Wpml Multilingual Cms

Name of the Vulnerable Software and Affected Versions: WPML Multilingual CMS premium plugin versions = 4.5.13 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is...

AlmaLinux 9 : java-17-openjdk (ALSA-2022:1729)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:1729 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C...

PT-2022-26272 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.5 through 7.4.3.28 Liferay DXP 7.3 before update 8 Liferay DXP 7.4 before update 29 Description: The Asset Libraries module does not properly check permissions of asset libraries, allowing remote authenticated user...

PT-2022-26269

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.3 through 7.4.3.18 Liferay DXP versions 7.3 before update 6 Liferay DXP versions 7.4 before update 19 Description A Zip slip vulnerability in the Elasticsearch Connector allows attackers to create or overwrite...

Cross site scripting

Concrete CMS formerly concrete5 below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting XSS in icons since the Microsoft application tile color is not sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+...

PT-2022-35229 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.76 Description: A race condition exists in the qdisc graft function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to v5.15.76, update...

PT-2022-35305 · Marvell · Marvell Octeontx

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.75 Description: The issue is related to preventing integer overflows in the crypto module of the Marvell OcteonTX driver. The actual impact and attack plausibility have not yet been proven. Recommendations...

PT-2022-35896 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.9.331 Description: The issue is related to a user-after-free problem in the Bluetooth L2CAP protocol. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2022-35166 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to the thunderbolt net functionality in the Linux Kernel, where DMA paths are enabled before rings are enabled. This could potentially lead to security vulnerabilities,...

PT-2022-35101 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to the Linux Kernel's rds tcp reset callbacks function, where the sock lock is held when cancelling work. This could potentially lead to security vulnerabilities, althoug...