PT-2023-12729 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse version 2.9.0.beta14 Description: The issue in Discourse, an open-source discussion platform, involves maliciously embedded URLs that can leak an admin's digest of recent topics, potentially exposing private information. A patch is...

Autodesk DWG TrueView 2023 < 2023.1.1 RCE

The remote host has an install of Autodesk DWG TrueView version 2023 prior to 2023.1.1. It is, therefore, affected by a remote code execution vulnerability due to DLL search order hijacking. Note that Nessus has not tested for this issue but has instead relied only on the application's...

PT-2023-12404 · Unknown · Ghostlander Halcyon

Name of the Vulnerable Software and Affected Versions: ghostlander Halcyon versions prior to 1.1.1.0-hal Description: A critical vulnerability has been found in ghostlander Halcyon, affecting the function CBlock::AddToBlockIndex of the file src/main.cpp in the component Block Verification. This...

PT-2023-14233 · Aruba · Aruba Edgeconnect Enterprise Orchestrator

Name of the Vulnerable Software and Affected Versions: Aruba EdgeConnect Enterprise Orchestrator versions 9.2.1.40179 and below Aruba EdgeConnect Enterprise Orchestrator versions 9.1.4.40436 and below Aruba EdgeConnect Enterprise Orchestrator versions 9.0.7.40110 and below Aruba EdgeConnect...

CVE-2022-4818 Talend Open Studio for MDM SystemStorageWrapper.java xml external entity reference

A vulnerability was found in Talend Open Studio for MDM. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file org.talend.mdm.core/src/com/amalto/core/storage/SystemStorageWrapper.java. The manipulation leads to xml external entity reference...

PT-2022-7110 · Sangoma · Freepbx

Name of the Vulnerable Software and Affected Versions: FreePBX cdr versions 14.0 through 14.0.5.20 Description: The issue is related to the ajaxHandler function in the ucp/Cdr.class.php file of the FreePBX web interface, which fails to protect against SQL query structure attacks. This can allow a...

CVE-2022-46170 CodeIgniter is vulnerable to improper authentication via Session Handlers

CodeIgniter is a PHP full-stack web framework. When an application uses 1 multiple session cookies e.g., one for user pages and one for admin pages and 2 a session handler is set to DatabaseHandler, MemcachedHandler, or RedisHandler, then if an attacker gets one session cookie e.g., one for user...

CVE-2022-40145 Apache Karaf: JDBC JAAS LDAP injection

This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtilsdoCreateDatasource use InitialContext.lookupjndiName without filtering. An us...

PT-2022-11663 · Unknown · Simplerisk

Name of the Vulnerable Software and Affected Versions: SimpleRisk versions prior to 20220306-001 Description: A vulnerability has been found in SimpleRisk, classified as problematic. It affects the function checkAndSetValidation of the file simplerisk/js/common.js. The manipulation of the argumen...

CVE-2022-4640 Mingsoft MCMS Article save cross site scripting

A vulnerability has been found in Mingsoft MCMS 5.2.9 and classified as problematic. Affected by this vulnerability is the function save of the component Article Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2021-4269 SimpleRisk common.js checkAndSetValidation cross site scripting

A vulnerability has been found in SimpleRisk and classified as problematic. This vulnerability affects the function checkAndSetValidation of the file simplerisk/js/common.js. The manipulation of the argument title leads to cross site scripting. The attack can be initiated remotely. Upgrading to...

CVE-2022-47500 Apache Helix: Open redirect

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4. Solution: removed the the forward component since it was improper designed for UI embedding. User please upgrad...

CVE-2022-4613

CVE-2022-4613 affects Click Studios Passwordstate and Passwordstate Browser Extension for Chrome, due to a vulnerability in the Browser Extension Provisioning component that leads to improper authorization. The issue can be exploited remotely and has been publicly disclosed. Affected users are ad...

CVE-2022-4612 Click Studios Passwordstate insufficiently protected credentials

A vulnerability has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as problematic. This vulnerability affects unknown code. The manipulation leads to insufficiently protected credentials. The attack can be initiated remotely. The exploit has be...

PT-2022-23969 · Apache · Apache Traffic Server

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 8.0.0 through 9.1.2 Description: The issue is related to an Improper Check for Unusual or Exceptional Conditions vulnerability in handling requests to Apache Traffic Server. Recommendations: For Apache Traffic...

CVE-2022-4513 European Environment Agency eionet.contreg cross site scripting

A vulnerability, which was classified as problematic, has been found in European Environment Agency eionet.contreg. This issue affects some unknown processing. The manipulation of the argument searchTag/resourceUri leads to cross site scripting. The attack may be initiated remotely. Upgrading to...

UBUNTU-CVE-2022-23515

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah = 2.1.0, 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1...

PT-2022-16039 · Unknown · Tendermint

Name of the Vulnerable Software and Affected Versions: Tendermint versions prior to 0.28.0 Description: The issue concerns a potential attack via improper verification of cryptographic signatures, affecting users of the tendermint-light-client and related packages for light client verification. T...

UBUNTU-CVE-2022-23468

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol RDP. xrdp v0.9.21 contain a buffer over flow in xrdploginwndcreate function. There are no known workarounds for this issue. Users are advised to upgrade...

UBUNTU-CVE-2022-23479

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol RDP. xrdp v0.9.21 contain a buffer over flow in xrdpmmchandatain function. There are no known workarounds for this issue. Users are advised to upgrade...