PT-2022-3460 · Siemens · Desigo Pxc4 +3

Name of the Vulnerable Software and Affected Versions: Desigo DXR2 versions prior to V01.21.142.5-22 Desigo PXC3 versions prior to V01.21.142.4-18 Desigo PXC4 versions prior to V02.20.142.10-10884 Desigo PXC5 versions prior to V02.20.142.10-10884 Description: The issue is related to an error in...

Siemens Industrial Devices using libcurl

1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely Vendor: Siemens Equipment: Industrial devices using libcurl Vulnerabilities: Use After Free 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-22-132-13 Siemens Industrial Devices using...

Unbreakable Enterprise kernel-container security update

5.4.17-2136.307.3.1 - Revert 'rds/ib: recover rds connection from stuck tx path' Nagappan Ramasamy Palaniappan Orabug: 34124233 5.4.17-2136.307.3 - kvm: debugfs: fix memory leak in kvmcreatevmdebugfs Pavel Skripkin Orabug: 33099019 - KVM: debugfs: Reuse binary stats descriptors Jing Zhang Orabug:...

PT-2022-13287 · WordPress · Mapsvg Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: MapSVG WordPress plugin versions prior to 6.2.20 Description: The issue concerns a SQL Injection that can be exploited by unauthenticated users due to the lack of validation and escaping of a parameter used in a SQL statement via a REST...

PT-2022-13460 · WordPress · Sema Api Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: SEMA API WordPress plugin versions prior to 4.02 Description: The issue arises from the SEMA API WordPress plugin's failure to properly sanitise and escape certain parameters before using them in SQL statements via an AJAX action. This leads ...

SUSE-SU-2022:1545-1 Security Beta update for SUSE Manager Client Tools

This update fixes the following issues: golang-github-prometheus-alertmanager: - CVE-2022-21698: Denial of service using InstrumentHandlerCounter Update vendor tarball with prometheus/clientgolang 1.11.1 bsc1196338, jscSLE-24077 - Update to version 0.23.0: amtool: Detect version drift and warn...

PT-2022-13436 · WordPress · Woocommerce Shipping Multiple Addresses

Name of the Vulnerable Software and Affected Versions: Multiple Shipping Address Woocommerce WordPress plugin versions prior to 2.0 Description: The issue concerns the improper sanitization and escaping of numerous parameters in SQL statements via certain AJAX actions. These actions are available...

CVE-2022-24880 Potential Captcha Validate Bypass in flask-session-captcha

flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he captcha.validate function would return None if passed no value e.g. by submitting an having an empty form. If implementing users...

GSD-2022-1002457 llc: only change llc->dev when bind() succeeds

llc: only change llc-dev when bind succeeds This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.274 by commit...

GSD-2022-1001670 ata: sata_dwc_460ex: Fix crash due to OOB write

ata: satadwc460ex: Fix crash due to OOB write This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.34 by commit...

openSUSE: Security Advisory for nbd (SUSE-SU-2022:1276-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE-SU-2022:1277-1 Security update for dcraw

This update for dcraw fixes the following issues: - CVE-2017-13735: Fixed a denial of service issue due to a floating point exception bsc1056170. - CVE-2017-14608: Fixed an invalid memory access that could lead to information disclosure or denial of service bsc1063798. - CVE-2018-19655: Fixed a...

PT-2022-3558 · Hotdog · Hotdog

Name of the Vulnerable Software and Affected Versions: Hotdog versions prior to 1.0.1 Description: The issue is related to errors in access control, allowing a container to gain full privileges on the host and bypass restrictions set on the container. This could enable an attacker to elevate thei...

PT-2022-17995 · Tyler · Tyler Odyssey Portal

Name of the Vulnerable Software and Affected Versions: Tyler Odyssey Portal platform versions prior to 17.1.20 Description: An Insecure Direct Object Reference issue exists in the Tyler Odyssey Portal platform. This may allow an external party to access sensitive case records. Recommendations: Fo...

PT-2022-6700 · Juniper Networks · Junos Evolved

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS Evolved versions prior to 20.4R2-S3-EVO Description: An Improper Check for Unusual or Exceptional Conditions issue in the packetIO daemon allows an unauthenticated, network-based attacker to cause a Denial of Service...

CVE-2021-41119 DoS vulnerabiliity in wire-server json parser

Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of servic...

PT-2022-12957 · Palo Alto Networks · Pan-Os

Name of the Vulnerable Software and Affected Versions: PAN-OS versions prior to 8.1.22 PAN-OS versions prior to 9.0.16 PAN-OS versions prior to 9.1.13 PAN-OS versions prior to 10.0.10 PAN-OS versions prior to 10.1.5 Description: An improper handling of exceptional conditions issue exists in the D...

PT-2022-3913 · Adobe · Acrobat Reader

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat Reader versions 22.001.20085 and earlier Adobe Acrobat Reader versions 20.005.30314 and earlier Adobe Acrobat Reader versions 17.012.30205 and earlier Description: The issue is caused by an out-of-bounds read vulnerability when...

PT-2022-3689 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 100.0.4896.88 Description: The issue is related to a use after free in WebGPU, which can potentially allow a remote attacker to exploit heap corruption via a crafted HTML page. This could enable the attacker to...

PT-2022-2357

Name of the Vulnerable Software and Affected Versions Django versions 2.2 before 2.2.28 Django versions 3.2 before 3.2.13 Django versions 4.0 before 4.0.4 Description An issue was discovered in the QuerySet.annotate, aggregate, and extra methods, which are subject to SQL injection in column alias...