CVE-2022-39279 Discourse-chat plugin susceptible to XSS in channel name and description

discourse-chat is a plugin for the Discourse message board which adds chat functionality. In versions prior to 0.9 some places render a chat channel's name and description in an unsafe way, allowing staff members to cause an cross site scripting XSS attack by inserting unsafe HTML into them...

CVE-2022-39222 OAuth authorization code exposure in Dex

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients and by extension, clients accepting tokens issued by those Dex instances are affected by this vulnerability if they are running a version prior to 2.35.0. An attacker can...

PT-2022-24865 · Discourse · Discourse-Chat

Name of the Vulnerable Software and Affected Versions: discourse-chat versions prior to 0.9 Description: The discourse-chat plugin for the Discourse message board has an issue where it renders a chat channel's name and description in an unsafe way, allowing staff members to cause a cross-site...

SUSE-SU-2022:3473-1 Security update for python310

This update for python310 fixes the following issues: Updated to version 3.10.7: - CVE-2020-10735: Fixed DoS due to missing limit of amount of digits when converting text to int bsc1203125. - CVE-2021-28861: Fixed an open redirect in the http server when an URI path starts with // bsc1202624...

Command Injection

Overview snyk is an advanced tool that scans and monitors projects for security vulnerabilities. Affected versions of this package are vulnerable to Command Injection due to an incomplete fix for CVE-2022-40764. A successful exploit allows attackers to run arbitrary commands on the host system...

PT-2022-24845 · Unknown · Matrix-Rust-Sdk

Name of the Vulnerable Software and Affected Versions: matrix-rust-sdk versions prior to 0.6 Description: The issue arises when a user requests a room key from their devices. The software correctly remembers the request but fails to check the origin of the forwarded room key, allowing homeservers...

CVE-2022-39264 nheko vulnerable to secret poisoning using MITM on secret requests by the homeserver

nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply th...

AZL-13172 CVE-2022-1941 affecting package mysql for versions less than 8.0.40-1

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of...

Unbreakable Enterprise kernel-container security update

5.15.0-2.52.3.el8 - posix-cpu-timers: Cleanup CPU timers before freeing them during exec Thadeu Lima de Souza Cascardo Orabug: 34495548 CVE-2022-2585 - fix race between exititimers and /proc/pid/timers Oleg Nesterov Orabug: 34495548 - rds: ib: Add preemption control when using per-cpu variables...

PT-2022-24826 · Unknown · Fhir-Works-On-Aws-Authz-Smart

Name of the Vulnerable Software and Affected Versions: fhir-works-on-aws-authz-smart versions 3.1.1 through 3.1.2 Description: The issue allows a client of the API to retrieve more information than the client's OAuth scope permits when making "search-type" requests. However, this issue would not...

PT-2022-4850

Name of the Vulnerable Software and Affected Versions: Redis versions 7.0.0 through 7.0.4 Description: The issue is related to an integer overflow when handling the COUNT argument in the XAUTOCLAIM command on a stream key in a specific state. This may cause a subsequent heap overflow and...

PT-2022-25145 · Owasp +1 · Owasp Modsecurity Core Rule Set +1

Name of the Vulnerable Software and Affected Versions: OWASP ModSecurity Core Rule Set CRS versions 3.0.x through 3.3.2 Description: The issue allows for a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP Range header field...

CVE-2022-39956 Partial rule set bypass in OWASP ModSecurity Core Rule Set for HTTP multipart requests using character encoding in the Content-Type or Content-Transfer-Encoding header

The OWASP ModSecurity Core Rule Set CRS is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and...

CVE-2022-2816 affecting package vim 9.0.0181-1

CVE-2022-2816 affecting package vim 9.0.0181-1. An upgraded version of the package is available that resolves this issue...

PT-2022-33897 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 5.15.33 through 5.15.60 Description: A refcount leak was discovered in the meson encoder hdmi init function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

CVE-2022-39210 Access to internal files of the Nextcloud Android app

Nextcloud android is the official Android client for the Nextcloud home server platform. Internal paths to the Nextcloud Android app files are not properly protected. As a result access to internal files of the from within the Nextcloud Android app is possible. This may lead to a leak of sensitiv...

CVE-2022-2816 affecting package vim for versions less than 9.0.0325-1

CVE-2022-2816 affecting package vim for versions less than 9.0.0325-1. An upgraded version of the package is available that resolves this issue...

PT-2022-23104

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1 and earlier TensorFlow versions 2.8.1 and earlier TensorFlow versions 2.7.2 and earlier Description The issue occurs when tf.quantization.fake quant with min max vars gradient...

GHSA-QCQV-38JG-2R43 Pageflow vulnerable to insecure direct object reference in membership update endpoint

Impact Pageflow has a membership edit feature which allows users to edit the roles of user memberships associated with an account that they have the manager role to including their own. While the Entity dropdown select field is greyed out in the UI, an attacker can use tools which allow sending...

PT-2022-23163 · Nextcloud · Nextcloud Files Access Control App

Name of the Vulnerable Software and Affected Versions: Nextcloud Files Access Control app versions prior to 1.12.2 Nextcloud Files Access Control app versions prior to 1.13.1 Nextcloud Files Access Control app versions prior to 1.14.1 Description: The Nextcloud Files Access Control app has an iss...