PT-2022-27651 · WordPress · Easy Wp Smtp

Name of the Vulnerable Software and Affected Versions: Easy WP SMTP plugin versions 1.5.1 and earlier Description: The issue is related to an Authenticated Path Traversal vulnerability. There is no information provided about the estimated number of potentially affected devices worldwide or detail...

PT-2022-26644 · WordPress · Armember

Name of the Vulnerable Software and Affected Versions: ARMember premium plugin versions = 5.5.1 Description: The issue is related to an Unauth. Privilege Escalation vulnerability. It affects the ARMember premium plugin on WordPress. Recommendations: For ARMember premium plugin versions = 5.5.1,...

PT-2022-27650 · WordPress · Advanced Booking Calendar

Name of the Vulnerable Software and Affected Versions: Advanced Booking Calendar plugin version 1.7.1 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions ...

PT-2022-27012 · Unknown · Stackstorm

Name of the Vulnerable Software and Affected Versions: StackStorm versions prior to 3.8.0 Description: A cross-site scripting XSS issue in the Web UI allows logged-in users with write access to pack rules to inject arbitrary script or HTML, which may be executed in the Web UI for other logged-in...

CVE-2022-43556

Concrete CMS formerly concrete5 below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dashboard page output is not sanitized. The Concrete CMS security team has ranked this 4.2 with CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Thanks...

PT-2022-5775 · NetGear · Netgear Rax30 Ax2400

Name of the Vulnerable Software and Affected Versions: NETGEAR RAX30 AX2400 series of routers versions prior to 1.0.9.90 Description: A network misconfiguration is present in the affected devices, where IPv6 is enabled for the WAN interface by default. However, the firewall restrictions in place...

PT-2022-26194 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 24.0.7 Nextcloud Server versions prior to 25.0.1 Description: The issue affects Nextcloud Server, an open source personal cloud server, where disabled download shares still allow download through preview...

PT-2022-24014 · WordPress · Becustom

Name of the Vulnerable Software and Affected Versions: Becustom plugin for WordPress versions up to, and including, 1.0.5.2 Description: The issue is due to missing nonce validation when saving the plugin's settings, making it possible for unauthenticated attackers to update the plugin's settings...

PYSEC-2022-43175

Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. Versions prior to 3.0.0 are vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that has deployed the XBlock may be impacted. Version 3.0.0 contai...

PT-2022-19861 · WordPress · Salat Times

Name of the Vulnerable Software and Affected Versions: Salat Times WordPress plugin versions prior to 3.2.2 Description: The issue allows high-privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitize and escape its...

PT-2022-22426 · WordPress · Checkout Field Editor

Name of the Vulnerable Software and Affected Versions: The Checkout Field Editor Checkout Manager for WooCommerce WordPress plugin versions prior to 1.8.0 Description: The issue allows high privilege users, such as admins, to perform PHP Object Injection when a suitable gadget is present. This is...

PT-2022-24423 · WordPress · Wp User Merger

Name of the Vulnerable Software and Affected Versions: WP User Merger WordPress plugin versions prior to 1.5.3 Description: The issue arises from the plugin's failure to properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection. This can be exploited ...

PT-2022-24334 · WordPress · Video Thumbnails

Name of the Vulnerable Software and Affected Versions: Video Thumbnails WordPress plugin versions 2.12.3 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...

Security update for opera (important)

openSUSE Security Update: Security update for opera Announcement ID: openSUSE-SU-2022:10219-1 Rating: important References: Cross-References: CVE-2022-3723 CVSS scores: CVE-2022-3723 NVD : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.4:NonFree An update tha...

PT-2022-37625 · Opensuse +3 · Xtrabackup

This update for xtrabackup fixes the following issues: Update xtrabackup to version 2.4.26: - CVE-2020-10997: Information exposure via cmd line output and table history boo1170644 - CVE-2020-29488: Changes in how absolute paths are handled boo1205581...

Security update for tumbler (moderate)

openSUSE Security Update: Security update for tumbler Announcement ID: openSUSE-SU-2022:10206-1 Rating: moderate References: 1203644 1205210 Affected Products: openSUSE Backports SLE-15-SP3 An update that contains security fixes can now be installed. Description: This update for tumbler fixes the...

PT-2022-26170 · Unknown · Knative.Dev/Func

Name of the Vulnerable Software and Affected Versions: knative.dev/func versions prior to 1.8.1 Description: The issue affects developers using malicious or compromised third-party buildpacks, potentially exposing their registry credentials or local docker socket to a malicious lifecycle containe...

SUSE-SU-2022:4069-1 Security update for php7

This update for php7 fixes the following issues: - Version update to 7.4.33: - CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont bsc1204979. - CVE-2022-37454: Fixed buffer overflow in hashupdate on long parameter bsc1204577. - Version update to 7.4.32...

SUSE-SU-2022:4067-1 Security update for php7

This update for php7 fixes the following issues: - Version update to 7.2.34 jscSLE-23639 - CVE-2022-37454: Fixed SHA-3 buffer overflow bsc1204577. - Fix integer overflow in PHPSHA3bits bsc1204577c26...

PT-2022-26024 · Woocommerce · Viszt Péter'S Integration For Szamlazz.Hu & Woocommerce +1

Name of the Vulnerable Software and Affected Versions: Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin versions = 5.6.3.2 Csomagpontok és szállítási címkék WooCommerce-hez plugin versions = 1.9.0.2 Description: The issue concerns multiple Cross-Site Request Forgery CSRF...