PT-2022-17427 · Wolfssl +1 · Wolfssl +1

Name of the Vulnerable Software and Affected Versions: wolfSSL versions prior to 5.2.0 Description: The issue concerns a TLS 1.3 server that cannot properly enforce mutual authentication. A client can omit the certificate verify message from the handshake and never present a certificate...

Arbitrary Code Execution

Overview Affected versions of this package are vulnerable to Arbitrary Code Execution due to improper validation of the snap-confine binary location. A local attacker could possibly use this issue to execute other arbitrary binaries and escalate privileges. Remediation Upgrade...

Allocation of Resources Without Limits or Throttling

Overview std/archive/zip is a Go standard library package std/archive/zip Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Go Vulnerability Report: via the NewReader or OpenReader functions. An attacker can cause a panic or trigger an...

Race Condition

Overview std/net/http/httputil is a Go standard library package std/net/http/httputil Affected versions of this package are vulnerable to Race Condition. Go Vulnerability Report: ReverseProxy can panic after encountering a problem copying a proxied response body. Remediation Upgrade...

Open Redirect

Overview github.com/gophish/gophish/controllers is a package middleware is responsible for the definition/​implementation of middleware functionality. Affected versions of this package are vulnerable to Open Redirect. The Open Redirect vulnerability exists in the next query parameter. The...

PT-2022-11591 · Noise · Noise

Name of the Vulnerable Software and Affected Versions: github.com/flynn/noise versions prior to v1.0.0 Description: The Noise protocol implementation has weakened cryptographic security after encrypting 2^64 messages and is vulnerable to a potential denial of service attack. After 2^64 messages a...

PT-2022-16471 · Kiteworks · Kiteworks Mft

Name of the Vulnerable Software and Affected Versions: Kiteworks MFT version 7.5 Description: The issue allows an unauthorized user to reset other users' passwords. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents...

PT-2022-15626 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 7.0.1-42218-2 Description: The issue allows remote attackers to obtain sensitive information via unspecified vectors, resulting in the exposure of sensitive information to unauthorized actors...

PT-2023-2333

Name of the Vulnerable Software and Affected Versions Minio versions prior to RELEASE.2023-03-20T20-16-18Z Minio version 2022.02.01-alt1 Minio version 2022.12.07-alt1 Minio version 2023.05.18-alt1 Minio version 2023.10.16-alt1 Minio version 2023.03.24-alt1 Description MinIO is a Multi-Cloud Objec...

PT-2022-16084 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1 and earlier TensorFlow versions 2.6.3 and earlier TensorFlow versions 2.5.3 and earlier Description: The implementation of AddManySparseToTensorsMap is vulnerable to an integer...

CVE-2022-21659 Observable Response Discrepancy in Flask-AppBuilder

Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server...

Exposed Dangerous Method or Function

Overview guake is a Guake Terminal Affected versions of this package are vulnerable to Exposed Dangerous Method or Function due to the exposure of executecommand and executecommandbyuuid methods via the d-bus interface, which makes it possible for a malicious user to run an arbitrary command via...

PT-2022-15870 · Teslamate +1 · Teslamate +1

Name of the Vulnerable Software and Affected Versions: TeslaMate versions prior to 1.25.1 Description: The issue allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere with vehicle operation en route. This occurs because an attacker can leverage Grafana login acces...

PT-2022-1938 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.27 and prior Description: The issue is related to insufficient input validation in the Server: Optimizer component of the MySQL Server product. It allows a low-privileged attacker with network access via multiple...

PT-2022-13014 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: snipe-it versions prior to 5.3.8 Description: The issue affects snipe-it due to a Missing Authorization vulnerability, which is also described as an Improper Access Control vulnerability. This allows users with no system permissions to see an...

GHSA-6VFC-QV3F-VR6C Uncontrolled Resource Consumption in markdown-it

Impact Special patterns with length 50K chars can slow down parser significantly. js const md = require'markdown-it'; md.renderx $' '.repeat150000 x \nx; Patches Upgrade to v12.3.2+ Workarounds No. References Fix + test sample:...

PT-2022-12304 · Cobbler +2 · Cobbler +2

Name of the Vulnerable Software and Affected Versions: Cobbler versions prior to 3.3.1 Description: An issue was discovered where files in /etc/cobbler are world readable, exposing sensitive information to local users with non-privileged access. The users.digest file contains the sha2-512 digest ...

Smarty 输入验证错误漏洞

Smarty is Smarty is a template engine for PHP that facilitates the separation of representation HTML/CSS from application logic. A security vulnerability exists in Smarty that stems from Smarty is a template engine for PHP that facilitates the separation of representation HTML CSS from applicatio...

Cleartext Transmission of Sensitive Information

Overview std/net/smtp is a Go standard library package std/net/smtp Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information. Go Vulnerability Report:SMTP clients using net/smtp can use the PLAIN authentication scheme on network connections not secured...

Information Exposure

Overview std/math/big is a Go standard library package std/math/big Affected versions of this package are vulnerable to Information Exposure. Go Vulnerability Report: Int.Exp Montgomery mishandled carry propagation and produced an incorrect output, which makes it easier for attackers to obtain...