PT-2022-9015 · Unknown +2 · Multimon-Ng +2

Name of the Vulnerable Software and Affected Versions: multimon-ng versions prior to 1.2.0 Description: A critical issue affects the function add ch of the file demod flex.c. The manipulation of the argument ch leads to a format string issue. Recommendations: For versions prior to 1.2.0, upgrade ...

DEBIAN-CVE-2021-4249

A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack...

PT-2022-27633 · Unknown · Ubi Reader

Name of the Vulnerable Software and Affected Versions: UBI Reader versions up to 0.8.0 Description: A vulnerability has been found in the UBIFS File Handler component, specifically affecting the ubireader extract files function of the file ubireader/ubifs/output.py. This issue leads to path...

DEBIAN-CVE-2022-4558

A vulnerability was found in Alinto SOGo up to 5.7.1. It has been classified as problematic. This affects an unknown part of the file SoObjects/SOGo/NSString+Utilities.m of the component Folder/Mail Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack...

CVE-2022-4444 ipti br.tag cross site scripting

A vulnerability was found in ipti br.tag. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.13.0 is able to address this issue. The name of th...

PT-2022-16031 · Typo3 · Typo3/Html-Sanitizer

Name of the Vulnerable Software and Affected Versions: typo3/html-sanitizer versions prior to 1.5.0 or 2.1.1 Description: The HTML sanitizer is written in PHP and aims to provide XSS-safe markup based on explicitly allowed tags, attributes, and values. However, due to a parsing issue in the...

CVE-2022-23496 A crafted list can trigger a ArrayIndexOutOfBoundsException in Yauaa

Yet Another UserAgent Analyzer Yauaa is a java library that tries to parse and analyze the useragent string and extract as many relevant attributes as possible. Applications using the Client Hints analysis feature introduced with 7.0.0 can crash because the Yauaa library throws an...

PT-2022-36527 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.300 Description: The issue is related to an out-of-bounds read in the ntfs attr find function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2022-27773 · Grafana · Synthetic Monitoring Agent For Grafana

Name of the Vulnerable Software and Affected Versions: Synthetic Monitoring Agent for Grafana versions prior to 0.12.0 Description: The Synthetic Monitoring Agent for Grafana's Synthetic Monitoring application provides probe functionality and executes network checks for monitoring remote targets...

HPESBNW04391 rev.2 - AirWave Management Platform, Multiple Vulnerabilities

Potential Security Impact: Remote: Access Restriction Bypass, Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba AirWave Management Platform - 8.2.15.0 and below CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2022-37916 |...

DEBIAN-CVE-2022-39332

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for...

PT-2022-26156 · Nextcloud · Nextcloud Talk Android

Name of the Vulnerable Software and Affected Versions: Nextcloud Talk Android versions prior to 14.1.0 Description: The issue affects the Nextcloud Talk Android, which is the Android OS implementation of the Nextcloud Talk chat system. In affected versions, the receiver is not protected by...

PT-2022-25647 · Pilz · Pasvisu Server

Name of the Vulnerable Software and Affected Versions: Pilz PASvisu Server versions prior to 1.12.0 Description: A path traversal vulnerability was discovered, allowing an unauthenticated remote attacker to use a zipped, malicious configuration file to trigger arbitrary file writes, also known as...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the host parameter on the /list-gitolite endpoint. An attacker can inject commands by sending local requests to the vulnerable endpoint. Remediation Upgrade...

PT-2022-24800 · Immudb · Immudb

Name of the Vulnerable Software and Affected Versions: immudb versions prior to 1.4.1 Description: immudb is a database with built-in cryptographic proof and verification. immudb client SDKs use the server's UUID to distinguish between different server instances, allowing the client to connect to...

Buffer Overflow

Overview Affected versions of this package are vulnerable to Buffer Overflow via tf.rawops.ImageProjectiveTransformV2 when a large output shape is given. Remediation Upgrade tensorflow-lite to version 2.12.0 or higher. References - GitHub Commit - Vulnerable Code Credit: Neophytos Christou from S...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS because the conversions from char to bool are undefined if the char is not 0 or 1. This can happen when printing a tensor: the data is got as a const char array and then it is typecasted to the element type. Detail...

Reachable Assertion

Overview Affected versions of this package are vulnerable to Reachable Assertion when tf.rawops.TensorListResize is given a nonscalar value for input size. It will results in a CHECK fail which can be used to trigger a denial of service attack. Remediation Upgrade tensorflow-lite to version 2.12....

PT-2022-6249

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.0.9 Description The issue is related to a race condition in the Linux kernel's DVB driver, specifically in the dvb frontend.c file. This condition can cause a use-after-free error when a device is disconnected,...

PT-2022-27493 · Jenkins · Jenkins Ns-Nd Integration Performance Publisher Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins NS-ND Integration Performance Publisher Plugin versions 4.8.0.143 and earlier Description: The issue concerns the global and unconditional disabling of SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM...