CVE-2022-46174 Race condition during concurrent TLS mounts in efs-utils

efs-utils is a set of Utilities for Amazon Elastic File System EFS. A potential race condition issue exists within the Amazon EFS mount helper in efs-utils versions v1.34.3 and below. When using TLS to mount file systems, the mount helper allocates a local port for stunnel to receive NFS...

PT-2022-26190 · Dragonfly · Dragonfly

Name of the Vulnerable Software and Affected Versions: Dragonfly version 0.3.0-SNAPSHOT Description: The issue concerns a Java runtime dependency management library that does not configure DocumentBuilderFactory to prevent XML external entity XXE attacks. This can be avoided by not trying to...

PT-2022-26341 · WordPress · Simple Basic Contact Form

Name of the Vulnerable Software and Affected Versions: Simple Basic Contact Form WordPress plugin versions prior to 20221201 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed,...

PT-2022-25906 · WordPress · Contest Gallery Pro +1

Name of the Vulnerable Software and Affected Versions: Contest Gallery WordPress plugin versions prior to 19.1.5 Contest Gallery Pro WordPress plugin versions prior to 19.1.5 Description: The issue allows malicious users with at least author privilege to leak sensitive information from the site's...

PT-2022-27077 · Unknown · Simmeth Lieferantenmanager

Name of the Vulnerable Software and Affected Versions: Simmeth Lieferantenmanager versions prior to 5.6 Description: An issue in the design of the API allows a user to fetch arbitrary SQL tables, leaking all user passwords and MSSQL hashes via the "/DS/LM API/api/SelectionService/GetPaggedTab" AP...

PT-2022-27203 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: Snipe-IT versions prior to 6.0.14 Description: The issue is related to Cross Site Scripting XSS for View Assigned Assets. This means an attacker could potentially inject malicious scripts into the website, which would then be executed by the...

PT-2022-27674 · Unknown · Planet Estream

Name of the Vulnerable Software and Affected Versions: Planet eStream versions prior to 6.72.10.07 Description: The issue discloses sensitive information related to the ON cookie, which can be found in the HTML source code for "Default.aspx" in certain situations, and the "WhoAmI" endpoint, which...

PT-2022-28047 · Openemr · Openemr

Name of the Vulnerable Software and Affected Versions: openemr versions prior to 7.0.0.2 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input without proper validation and then displays it to other users, allowing an attacker t...

PT-2022-20963 · Dataprobe · Dataprobe Iboot Pdu

Name of the Vulnerable Software and Affected Versions: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 Description: The issue arises from certain PHP pages only validating when a valid connection is established with the database, but not verifying the validity of a user. This lack of...

PT-2022-27873 · Tp Link · Tp-Link Tl-Wa7510N

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WA7510N version 3.12.6 and earlier Description: An issue in the firmware update process allows attackers to execute arbitrary code or cause a Denial of Service DoS via uploading a crafted firmware image. Recommendations: For TP-Lin...

PT-2022-27865

Name of the Vulnerable Software and Affected Versions Apache Airflow Hive Provider versions prior to 5.0.0 Description The issue is related to an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Airflow Hive Provider. This vulnerability...

PT-2022-25656 · WordPress · Wholesale Market For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Wholesale Market for WooCommerce WordPress plugin versions prior to 1.0.7 Description: The issue allows unauthenticated attackers to download arbitrary files from the server due to the lack of authorization checks and validation of user...

PT-2022-16064 · Unknown · Silverware Games

Name of the Vulnerable Software and Affected Versions: Silverware Games versions prior to 1.1.34 Description: The issue concerns a social network where users can play games online and attach URLs to YouTube videos. When a post is published, the site generates a related . Although the handler has...

PT-2022-24982 · WordPress · Directorist

Name of the Vulnerable Software and Affected Versions: Directorist WordPress plugin versions prior to 7.4.4 Description: The issue allows users with low privileges, such as subscribers, to access sensitive system information. This is due to the lack of proper access controls in the Directorist...

PT-2022-26673 · Autodesk · Autodesk Maya

Name of the Vulnerable Software and Affected Versions: Autodesk Maya versions 2022 through 2023 Description: Parsing a maliciously crafted X B and PRT file can force Autodesk Maya to read beyond allocated buffer. This issue, in conjunction with other vulnerabilities, could lead to code execution ...

nodejs:16 security, bug fix, and enhancement update

An update is available for nodejs-nodemon, nodejs, nodejs-packaging. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a software development platform f...

PT-2022-26622 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 16.2 iPadOS versions prior to 16.2 Description: The issue was addressed with improved memory handling. An app may be able to break out of its sandbox. Recommendations: For iOS versions prior to 16.2, update to iOS 16.2 o...

CVE-2022-23527 Open Redirect in oidc_validate_redirect_url()

modauthopenidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidcvalidateredirecturl does not properly check fo...

SUSE-SU-2022:4442-1 Security update for SUSE Manager Server 4.2

This update fixes the following issues: spacewalk-java: - Version 4.2.44-1 Do not disclose Proxy password in browser console log. bsc1205339 spacewalk-web: - Version 4.2.31-1 Do not log Proxy password in browser console log. bsc1205339 susemanager-sync-data: - Version 4.2.14-1 Add SUSE Linux...

SUSE-SU-2022:4439-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: golang-github-boynux-squidexporter: - Exclude s390 architecture - Enhanced to build on Enterprise Linux 8 grafana: - Version update from 8.3.10 to 8.5.13 jscPED-2145 - Security fixes: CVE-2022-36062: bsc1203596 CVE-2022-35957: bsc1203597 CVE-2022-31107:...