Moodle Multiple Vulnerabilities (MSA-22-0011, MSA-22-0012, MSA-22-0013, MSA-22-0014)

Moodle is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

LimeSurvey <= 5.3.10 XSS Vulnerability

LimeSurvey is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2022-14185 · Libmobi +2 · Libmobi +2

Name of the Vulnerable Software and Affected Versions: libmobi versions prior to 0.11 Description: The issue is a Buffer Over-read in the GitHub repository bfabiszewski/libmobi. Recommendations: For versions prior to 0.11, update to version 0.11 or later to resolve the issue...

PT-2022-18016 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 15.5 iPadOS versions prior to 15.5 Description: An authorization issue was addressed with improved state management, allowing a person with physical access to an iOS device to potentially access photos from the lock...

PT-2022-18074 · Apple · Itunes

Name of the Vulnerable Software and Affected Versions: iTunes versions prior to 12.12.4 Description: A logic issue was addressed with improved state management, which could allow a local attacker to elevate their privileges. Recommendations: For versions prior to 12.12.4, update to iTunes 12.12.4...

GHSA-97C3-W9CR-6QC2 Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins

The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary...

GHSA-7498-C9FM-G64P koji hub allows arbitrary upload destinations

The way that the hub code validates upload paths allows for an attacker to choose an arbitrary destination for the uploaded file. Uploading still requires login. However, an attacker with credentials could damage the integrity of the Koji system. Workaround There is no known workaround. All Koji...

KLA12539 Multiple vulnerabilities in Zoom

Multiple vulnerabilities were found in Zoom. Malicious users can exploit these vulnerabilities to gain privileges, bypass security restrictions, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Insufficient hostname validation vulnerability can be exploited remotely to gain...

PT-2022-16183 · Aruba · Aruba Clearpass Policy Manager

Name of the Vulnerable Software and Affected Versions: Aruba ClearPass Policy Manager versions 6.10.4 and below Aruba ClearPass Policy Manager versions 6.9.9 and below Aruba ClearPass Policy Manager versions 6.8.9-HF2 and below Aruba ClearPass Policy Manager versions 6.7.x and below Description: ...

Apache Tika < 1.28.2, 2.x < 2.4.0 Multiple Vulnerabilities

Apache Tika is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tika"; ifdescription...

PT-2022-6991 · Apple · Macos Monterey +4

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 8.6 macOS versions prior to 12.4 macOS Big Sur versions prior to 11.6.6 macOS Catalina versions prior to Security Update 2022-004 Description: The issue is related to insufficient access control in the TCC component ...

MikroTik RouterOS < 6.48.2 Multiple DoS Vulnerabilities

MikroTik RouterOS is prone to multiple denial of service DoS vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2022-2828 · Laravel · Laravel

Name of the Vulnerable Software and Affected Versions: Laravel version 9.1.8 Description: The issue is related to the implementation of the destruct function and the dispatch$command method in the Laravel PHP framework, which is connected to weaknesses in the deserialization mechanism. This can...

PT-2022-13916 · WordPress · All-In-One Wp Migration

Name of the Vulnerable Software and Affected Versions: All-in-One WP Migration plugin for WordPress versions up to, and including, 7.58 Description: The issue arises from insufficient file validation via the /lib/model/class-ai1wm-backups.php file, allowing for arbitrary file deletion via directo...

CVE-2022-23166

Sysaid – Sysaid Local File Inclusion LFI – An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/examples/index.html" path. in the "Insert/Edit Embedded Media" window Choose Type : iFrame and File/URL : here is the LFI Solution: Update to 22.2.20 cloud version, or to...

PT-2022-19662 · Schedmd +2 · Schedmd Slurm +2

Name of the Vulnerable Software and Affected Versions: SchedMD Slurm versions 20.11.x through 21.08.x Description: The issue is related to Incorrect Access Control, which can lead to Escalation of Privileges. Recommendations: For SchedMD Slurm versions 20.11.x through 21.08.x, update to a version...

OpenLDAP SQLi Vulnerability (May 2022)

OpenLDAP is prone to an SQL injection SQLi vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

PT-2022-7667 · Realtek · Realtek Rtsuer Driver For Usb Card Reader +1

Name of the Vulnerable Software and Affected Versions: Realtek RtsPer driver for PCIe Card Reader versions prior to 10.0.22000.21355 Realtek RtsUer driver for USB Card Reader versions prior to 10.0.22000.31274 Description: The issue is related to a buffer overflow in memory, allowing an attacker ...

PT-2022-16949

Name of the Vulnerable Software and Affected Versions kustomize-controller versions prior to 0.24.0 flux2 versions prior to 0.29.0 Description The issue concerns a Path Traversal vulnerability in the kustomize-controller via a malicious kustomization.yaml file, allowing an attacker to expose...

PT-2022-5037 · Hitachi Energy · Hitachi Energy Microscada X Sys600

Name of the Vulnerable Software and Affected Versions: Hitachi Energy MicroSCADA Pro SYS600 versions 9.4 FP2 Hotfix 4 and earlier Hitachi Energy MicroSCADA X SYS600 versions 10 through 10.3.1 Description: The issue is related to an Improper Input Validation vulnerability in the handling of a...