PT-2022-23669 · Google · Android

Name of the Vulnerable Software and Affected Versions: Group Sharing versions prior to 13.0.6.15 Description: The issue is related to improper access control in Group Sharing, allowing attackers to access device information. This affects devices running Android S12 and earlier versions, with...

PT-2022-19497 · Appwrite · Appwrite

Name of the Vulnerable Software and Affected Versions: appwrite versions prior to 1.0.0-RC1 Description: The issue is related to stored Cross-site Scripting XSS in the appwrite repository. This type of attack occurs when an application stores user input data without proper validation, allowing an...

SUSE-SU-2022:3198-1 Security update for php8-pear

This update for php8-pear fixes the following issues: - Add php8-pear to SLE15-SP4 jscSLE-24728 - Update to 1.10.21 - PEAR 1.10.13 unsupported protocol - use --force to continue Add $this operator to determineIfPowerpc calls - Update to 1.10.20 - ArchiveTar 1.4.14 Properly fix symbolic link path...

PT-2022-23183 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.10.5 XWiki Platform versions prior to 14.2 Description: The issue allows user accounts to be created even when user registration is disabled by passing a template of the distribution wizard to the xpart...

PT-2022-24317 · Unknown · Tastyigniter

Name of the Vulnerable Software and Affected Versions: TastyIgniter version 3.5.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload, which is a result of a cross-site scripting XSS vulnerability. This means an attacker can inject malicious...

PT-2022-23184 · Xwiki · Xwiki +1

Name of the Vulnerable Software and Affected Versions: XWiki Platform Web Parent POM versions 1.0 through 13.10.5 XWiki Platform Web Parent POM versions 14.0-rc-1 through 14.3 Description: The issue allows storing JavaScript that will be executed by anyone viewing the history of an attachment...

PT-2022-23817 · Securonix +1 · Securonix Snypr +1

Name of the Vulnerable Software and Affected Versions: Securonix Snypr versions prior to 6.4 Jun 2022 R3 Description: An injection vulnerability in the syslog-ng configuration wizard allows an application user with the "Manage Ingesters" permission to execute arbitrary code on remote ingesters by...

CVE-2022-31020 Remote code execution in Indy's NODE_UPGRADE transaction

Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the pool-upgrade request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The pool-upgrade request...

PT-2022-20055 · Fortinet · Fortisoar

Name of the Vulnerable Software and Affected Versions: Fortinet FortiSOAR versions prior to 7.2.1 Description: The issue is related to improper privilege management, allowing a GUI user who has already found a way to modify system files to execute arbitrary Python commands as root. Recommendation...

PT-2022-21726 · WordPress · Wpdevelop/Oplugins Booking Calendar

Name of the Vulnerable Software and Affected Versions: WPdevelop/Oplugins Booking Calendar plugin versions prior to 9.2.1 Description: A Cross-Site Request Forgery CSRF issue exists, allowing unauthorized actions related to Translations Update. Recommendations: For WPdevelop/Oplugins Booking...

PT-2022-19364 · Chatwoot · Chatwoot

Name of the Vulnerable Software and Affected Versions: chatwoot/chatwoot versions prior to 2.8 Description: The issue is related to improper authorization in the GitHub repository chatwoot/chatwoot. Recommendations: For versions prior to 2.8, update to version 2.8 or later to resolve the issue...

PT-2022-16604 · Ecwid · Ecwid Ecommerce Shopping Cart

Name of the Vulnerable Software and Affected Versions: Ecwid Ecommerce Shopping Cart plugin for WordPress versions up to, and including, 6.10.23 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the ecwid update plugin params function...

PT-2022-23130 · Unknown · Reactphp Http

Name of the Vulnerable Software and Affected Versions: ReactPHP HTTP versions 0.7.0 through 1.7.0 Description: The issue arises when ReactPHP's HTTP server component processes incoming HTTP cookie values, url-decoding the cookie names. This can lead to confusion between cookies with prefixes like...

PT-2022-25815 · Kitty +4 · Kitty +4

Name of the Vulnerable Software and Affected Versions: Kitty versions prior to 0.26.2 Description: The issue is related to insufficient validation in the desktop notification escape sequence, which can lead to arbitrary code execution. This occurs when a user displays attacker-controlled content ...

PT-2022-23148 · Discourse · Discourse-Chat

Name of the Vulnerable Software and Affected Versions: Discourse-Chat versions prior to 0.9 Description: The issue affects users of Discourse Chat, an asynchronous messaging plugin for the Discourse open-source discussion platform. Admin users can insert HTML into chat titles and descriptions,...

PT-2022-18245 · Unknown · Rosariosis Student Information System +1

Name of the Vulnerable Software and Affected Versions: rosariosis versions prior to 10.0 RosarioSIS Student Information System versions prior to 10.1 Description: The issue is related to improper handling of length parameter inconsistency in the GitHub repository francoisjacquet/rosariosis...

PT-2022-25029 · Unknown · Cotonti Siena

Name of the Vulnerable Software and Affected Versions: Cotonti Siena version 0.9.20 Description: The issue allows admins to conduct stored XSS attacks via a forum post. Recommendations: For Cotonti Siena version 0.9.20, update to a version that fixes this issue, as using the current version may...

PT-2022-7694 · Drawio +1 · Drawio +1

Name of the Vulnerable Software and Affected Versions: drawio versions prior to 20.3.0 Description: The issue is related to the incorrect neutralization of special elements used in an OS command, which can allow a remote attacker to execute arbitrary commands. Recommendations: For versions prior ...

SUSE-SU-2022:3001-1 Security update for json-c

This update for json-c fixes the following issues: - CVE-2020-12762: Fixed an integer overflow that could lead to memory corruption via a large JSON file bsc1171479. Non-security fixes: - Updated to version 0.12.1 jscPED-1778...

Google Chrome Bug Lets Sites Silently Overwrite System Clipboard Content

A "major" security issue in the Google Chrome web browser, as well as Chromium-based alternatives, could allow malicious web pages to automatically overwrite clipboard content without requiring any user consent or interaction by simply visiting them. The clipboard poisoning attack is said to have...