PT-2022-23290 · Storeapps · Storeapps Affiliate For Woocommerce

Name of the Vulnerable Software and Affected Versions: StoreApps Affiliate For WooCommerce premium plugin versions = 4.7.0 Description: The issue allows an attacker to change the PayPal email due to an authenticated IDOR vulnerability. This can be exploited when the WooCommerce PayPal Payments...

PT-2022-23635 · Samsung · Samsung Notes

Name of the Vulnerable Software and Affected Versions: Samsung Notes versions prior to 4.3.14.39 Description: The issue is related to a path traversal vulnerability in the UriFileUtils component of Samsung Notes. This vulnerability allows an attacker to access certain files with the permissions o...

SUSE-SU-2022:2671-1 Security update for go1.17

This update for go1.17 fixes the following issues: Update to go version 1.17.13 bsc1190649: - CVE-2022-32189: encoding/gob, math/big: decoding big.Float and big.Rat can panic bsc1202035. - CVE-2022-30635: encoding/gob: stack exhaustion in Decoder.Decode bsc1201444. - CVE-2022-30631: compress/gzip...

CVE-2022-35925 Missing rate limit in Authentication in bookwyrm

BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force attacks. This issue has been patched in version 0.4.5. Admins with existing instances will need to update their nginx.conf file that was...

PT-2022-23714 · Ipswitch · Ws Ftp Server

Name of the Vulnerable Software and Affected Versions: In Progress WS FTP Server versions prior to 8.7.3 Description: The issue concerns forms within the administrative interface that did not include a nonce, which is used to mitigate the risk of cross-site request forgery CSRF attacks. CSRF...

CVE-2022-31173 Juniper is vulnerable to @DOS GraphQL Nested Fragments overflow

Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program crash. This issue has been addressed in version 0.15.10. Users are advised to upgrade. Users unable to upgrade should limit the recursion depth manually...

PT-2022-16200 · WordPress · Yaysmtp

Name of the Vulnerable Software and Affected Versions: YaySMTP WordPress plugin versions prior to 2.2.1 Description: The issue allows any logged-in users, such as subscribers, to view the logs of the plugin due to a lack of capability check in an AJAX action. Recommendations: For YaySMTP WordPres...

PT-2022-15896 · WordPress · Simple Membership

Name of the Vulnerable Software and Affected Versions: Simple Membership WordPress plugin versions prior to 4.1.3 Description: The issue allows a user to change their membership at the registration stage due to insufficient checking of a user-supplied parameter. Recommendations: For versions prio...

PT-2022-20569 · Sourcegraph · Sourcegraph

Name of the Vulnerable Software and Affected Versions: Sourcegraph versions prior to 3.42 Description: The issue allows an authenticated Sourcegraph user to edit Code Monitors owned by any other Sourcegraph user, including editing the trigger and action of the monitor. However, an attacker cannot...

PT-2022-13961 · Unknown +1 · Krakend-Ce +2

Name of the Vulnerable Software and Affected Versions: Lura versions prior to 2.0.2 KrakenD-CE versions prior to 2.0.2 KrakenD-EE versions prior to 2.0.0 Description: The issue arises from incorrect sanitization of URL parameters, allowing malicious users to alter the backend URL defined for a pi...

PT-2022-17587 · Fava +1 · Fava +1

Name of the Vulnerable Software and Affected Versions: Fava versions prior to 1.22.3 Description: The issue is related to Cross-site Scripting XSS - Reflected, which occurs due to improper validation on filter conversion. This allows for malicious scripts to be injected into the website,...

PT-2022-15439 · WordPress · Counter Box

Name of the Vulnerable Software and Affected Versions: The Counter Box WordPress plugin versions prior to 1.2.1 Description: The issue is related to a lack of CSRF check when activating and deactivating counters. This could allow attackers to make a logged-in admin perform such actions via CSRF...

PT-2022-14210 · WordPress · Youzify

Name of the Vulnerable Software and Affected Versions: Youzify WordPress plugin versions prior to 1.2.0 Description: The issue concerns an unauthenticated SQL injection due to a parameter not being sanitized and escaped before use in a SQL statement. This occurs via an AJAX action that is availab...

PT-2022-4923 · Dell Emc · Dell Emc Cloudlink

Name of the Vulnerable Software and Affected Versions: Dell EMC CloudLink versions prior to 7.1.2 Description: The issue is related to weaknesses in the authentication procedure, allowing a remote attacker with knowledge of active directory usernames to potentially gain unauthorized access to the...

MGASA-2022-0268 Updated chromium-browser-stable packages fix security vulnerability

The chromium-browser-stable package has been updated to version 103.0.5060.134 branch, fixing many bugs and 11 CVE. Some of them are listed below. Use after free in Guest View. CVE-2022-2477 Use after free in PDF. CVE-2022-2478 Insufficient validation of untrusted input in File. CVE-2022-2479 Use...

"Hulu" App for iOS vulnerable to improper server certificate verification

Overview "Hulu" App for iOS provided by HJ Holdings, Inc. is vulnerable to improper server certificate verification CWE-295. Shungo Kumasaka of GMO Cyber Security by IERAE reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

PT-2022-23755 · Jetbrains · Intellij Idea

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2022.2 Description: The issue concerns a missing email address validation in the "Git User Name Is Not Defined" dialog. This problem affects JetBrains IntelliJ IDEA. Recommendations: For versions prio...

PT-2022-7864 · Zulip · Zulip

Name of the Vulnerable Software and Affected Versions: Zulip versions prior to 1.3.12 Description: The issue allows deactivated users to access messages when Single Sign-On SSO is enabled. Recommendations: For versions prior to 1.3.12, update to version 1.3.12 or later to resolve the issue...

PT-2022-7855 · Unknown · Kippo-Graph

Name of the Vulnerable Software and Affected Versions: kippo-graph versions prior to 1.5.1 Description: The issue is related to a cross-site scripting vulnerability in the xss clean function within class/KippoInput.class.php. Recommendations: For versions prior to 1.5.1, update to version 1.5.1 o...

SUSE-SU-2022:2568-1 Security update for SUSE Manager Server 4.2

This update fixes the following issues: apache-commons-csv: - Fix the URL for the package - Declare the LICENSE file as license and not doc apache-commons-math3: - Fix the URL for the package - Declare the LICENSE file as license and not doc drools: - Declare the LICENSE file as license and not d...