CVE-2022-4261 Rapid7 Nexpose Update Validation Issue

Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the functionality of Rapid7 Nexpose. The attacker would need some pre-existing mechanism to provide ...

PT-2022-24217 · Secomea · Secomea Gatemanager

Name of the Vulnerable Software and Affected Versions: Secomea GateManager versions prior to 10.0 Description: The issue is related to improper input validation of plugin files in the Administrator Interface of Secomea GateManager, allowing a server administrator to inject code into the GateManag...

CVE-2022-32634

In ccci, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07138646; Issue ID: ALPS07138646...

CVE-2022-4218

The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the listquizzes function. This makes it possible for unauthenticated attackers to delete quizzes and copy quizzes via a forged...

WordPress plugin Chained Quiz 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PUB-A-224545390

In getView of AddAppNetworksFragment.java, there is a possible way to mislead the user about network add requests due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2022-24635 · WordPress · Wp-Affiliate-Platform

Name of the Vulnerable Software and Affected Versions: WP Affiliate Platform plugin for WordPress versions up to, and including, 6.3.9 Description: The issue is due to missing or incorrect nonce validation on various functions, including the affiliates menu method. This allows unauthenticated...

GHSA-G389-RF5P-FG56 Badaso vulnerable to Remote Code Execution (RCE)

Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users...

CVE-2022-41705

Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users...

Denial Of Service (DoS)

freerdp is vulnerable vulnerable to denial of service. The vulnerability exists due to missing input validation in urbdrc channel which allows an attacker to cause an application crash with division by zero...

PT-2022-21881 · Unknown · Microscada X Sys600 +1

Name of the Vulnerable Software and Affected Versions: MicroSCADA Pro affected versions not specified MicroSCADA X SYS600 affected versions not specified Description: An input validation issue exists in the Monitor Pro interface, allowing an authenticated user to perform administrator-level remot...

Hoosk CMS Arbitrary File Upload Vulnerability

Hoosk CMS is a lightweight content management system. Hoosk CMS v1.8.0 suffers from an arbitrary file upload vulnerability that stems from its /attachments component failing to validate uploaded files. An attacker can exploit the vulnerability to remotely execute code...

SUSE-SU-2022:4005-1 Security update for php8

This update for php8 fixes the following issues: - CVE-2022-37454: Fixed buffer overflow in hashupdate on long parameter bug81738 bsc1204577. - CVE-2022-31630: Fixed OOB read due to insufficient input validation in imageloadfont bug81739 bsc1204979. - version update to 8.0.25 27 Oct 2022 Session:...

PT-2022-34991 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue concerns a validation termination record after EXTRA CONTEXT in the kselftest/arm64 component. The actual impact and attack plausibility have not yet been proven. Recommendations: F...

JVN#54728399: TERASOLUNA Global Framework and TERASOLUNA Server Framework for Java (Rich) vulnerable to ClassLoader manipulation

The past versions of TERASOLUNA Global Framework and TERASOLUNA Server Framework for Java Rich are vulnerable to a ClassLoader manipulation vulnerability due to using the old version of Spring Framework which contains the vulnerability. According to the developer, this vulnerability is caused by ...

CVE-2022-30542

Improper input validation in the firmware for some IntelR Server Board S2600WF, IntelR Server System R1000WF and IntelR Server System R2000WF families before version R02.01.0014 may allow a privileged user to potentially enable an escalation of privilege via local access...

CVE-2022-28611

Improper input validation in some IntelR XMMTM 7560 Modem software before version M27560R01.2146.00 may allow a privileged user to potentially enable escalation of privilege via physical access...

SUSE-SU-2022:3954-1 Security update for python-numpy

This update for python-numpy fixes the following issues: - CVE-2017-12852: Fixed missing input validation leading to infinite loops bsc1053963. Bugfixes: - Use update-alternatives for /usr/bin/f2py bsc1199500...

PT-2022-5468 · Microsoft · Windows Graphics +1

Name of the Vulnerable Software and Affected Versions: Windows Graphics Component affected versions not specified Description: The issue is related to insufficient input validation in the Windows Graphics Component, which can be exploited by remote attackers to execute arbitrary code. This can be...

CVE-2022-20445

In processservicesearchrsp of sdpdiscovery.cc, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...