MariaDB DoS Vulnerability (MDEV-28094) - Linux

MariaDB is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mariadb:mariadb"; if...

PT-2022-20268 · Samsung · Samsung Pass

Name of the Vulnerable Software and Affected Versions: Samsung Pass versions prior to 1.0.00.33 Description: The issue is related to improper authorization, allowing physical attackers to access the account list without authentication. This could potentially expose sensitive information...

PT-2022-20285 · Unknown · Smartthings

Name of the Vulnerable Software and Affected Versions: Smart Things versions prior to 1.7.85.12 Description: The issue is related to a missing caller check in Smart Things, allowing an attacker to access sensitive information remotely using the javascript interface API. Recommendations: For...

CVE-2022-24840 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in django-s3file

django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. If the AWSLOCATION setting was set, traversal was limited to that location only. The issue was...

CVE-2022-24840 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in django-s3file

django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. If the AWSLOCATION setting was set, traversal was limited to that location only. The issue was...

PT-2022-8726 · Dell · Dell Bsafe Micro Edition Suite

Name of the Vulnerable Software and Affected Versions: Dell BSAFE Micro Edition Suite versions prior to 4.5.1 Description: The issue is related to a Buffer Over-Read Vulnerability. No information is provided about the estimated number of potentially affected devices worldwide or real-world...

PT-2022-19826 · Onlyoffice · Onlyoffice Document Server +1

Name of the Vulnerable Software and Affected Versions: Onlyoffice Document Server versions 6.0.0 and below Onlyoffice Core versions 6.1.0.26 and below Description: A heap overflow issue was discovered in the component DesktopEditor/fontengine/fontconverter/FontFileBase.h. Recommendations: For...

WordPress Video Conferencing with Zoom plugin <= 3.9.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Video Conferencing with Zoom plugin versions = 3.9.2. Solution Update the WordPress Video Conferencing with Zoom plugin to the latest available version at least 3.9.3...

Moodle Multiple Vulnerabilities (MSA-22-0011, MSA-22-0012, MSA-22-0013, MSA-22-0014)

Moodle is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

LimeSurvey <= 5.3.10 XSS Vulnerability

LimeSurvey is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2022-14185 · Libmobi +2 · Libmobi +2

Name of the Vulnerable Software and Affected Versions: libmobi versions prior to 0.11 Description: The issue is a Buffer Over-read in the GitHub repository bfabiszewski/libmobi. Recommendations: For versions prior to 0.11, update to version 0.11 or later to resolve the issue...

PT-2022-18016 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 15.5 iPadOS versions prior to 15.5 Description: An authorization issue was addressed with improved state management, allowing a person with physical access to an iOS device to potentially access photos from the lock...

PT-2022-18074 · Apple · Itunes

Name of the Vulnerable Software and Affected Versions: iTunes versions prior to 12.12.4 Description: A logic issue was addressed with improved state management, which could allow a local attacker to elevate their privileges. Recommendations: For versions prior to 12.12.4, update to iTunes 12.12.4...

GHSA-97C3-W9CR-6QC2 Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins

The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary...

GHSA-7498-C9FM-G64P koji hub allows arbitrary upload destinations

The way that the hub code validates upload paths allows for an attacker to choose an arbitrary destination for the uploaded file. Uploading still requires login. However, an attacker with credentials could damage the integrity of the Koji system. Workaround There is no known workaround. All Koji...

com.redhat.rhevm.api:rhevm-api (>=0.1-milestone <=1.0-rc1.21), com.redhat.rhevm.api:rhevm-api-cli-actions (>=0.9-milestone1 <=0.9-milestone-4.4) +63 more potentially affected by CVE-2011-5245 via org.jboss.resteasy:resteasy-jaxb-provider (>=1.1.GA <=2.3.1.GA)

org.jboss.resteasy:resteasy-jaxb-provider MAVEN version =1.1.GA, =0.1-milestone, =0.9-milestone1, =0.1-milestone, =0.1-milestone, =0.9-milestone1, =0.1-milestone, =0.1-milestone, =0.9-milestone1, =0.9-milestone3, =0.9-milestone1, =0.9-milestone1, =0.9-milestone3, =0.9-milestone1, =0.1-milestone,...

PT-2022-16183 · Aruba · Aruba Clearpass Policy Manager

Name of the Vulnerable Software and Affected Versions: Aruba ClearPass Policy Manager versions 6.10.4 and below Aruba ClearPass Policy Manager versions 6.9.9 and below Aruba ClearPass Policy Manager versions 6.8.9-HF2 and below Aruba ClearPass Policy Manager versions 6.7.x and below Description: ...

KLA12539 Multiple vulnerabilities in Zoom

Multiple vulnerabilities were found in Zoom. Malicious users can exploit these vulnerabilities to gain privileges, bypass security restrictions, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Insufficient hostname validation vulnerability can be exploited remotely to gain...

Apache Tika < 1.28.2, 2.x < 2.4.0 Multiple Vulnerabilities

Apache Tika is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tika"; ifdescription...

PT-2022-6991 · Apple · Macos Monterey +4

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 8.6 macOS versions prior to 12.4 macOS Big Sur versions prior to 11.6.6 macOS Catalina versions prior to Security Update 2022-004 Description: The issue is related to insufficient access control in the TCC component ...