CVE-2022-43457

SQL Injection in HandlerPageKID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network...

CVE-2022-3578

The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

PYSEC-2022-42981

A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed for example when they were depending on past and previous instances of the task failed. This issue affects Apache Airflow prior to 2.3.1...

PT-2022-35851 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.296 Description: A refcount leak bug was found in the qcom smsm probe function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...

PT-2022-35496 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.150 Description: A use-after-free bug was found in the brcmf netdev start xmit function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior...

PT-2022-35436 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.153 Description: A potential issue exists that could cause a kernel panic when removing a non-standard SDIO card. The actual impact and attack plausibility have not yet been proven. Recommendations: For...

PT-2022-35104 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to the eth: alx component, where a lock is not properly taken on resume, potentially leading to security vulnerabilities. The actual impact and attack plausibility have n...

Atlassian Confluence 安全漏洞

Atlassian Confluence is a suite of specialized enterprise knowledge management and collaboration software from Atlassian Australia, which can also be used to build enterprise WiKi. A security vulnerability exists in Atlassian Confluence versions prior to 1.3.5 that stems from improper handling of...

PT-2022-6288 · Intel · Intel Proset/Wireless Wifi

Name of the Vulnerable Software and Affected Versions: IntelR PROSet/Wireless WiFi software versions prior to 22.140 Description: The issue is related to an out-of-bounds write in the IntelR PROSet/Wireless WiFi software, which may allow an unauthenticated user to potentially enable denial of...

Intel NUC Kit 代码问题漏洞

Intel NUC Kit is a small desktop computer from Intel Corporation USA. A security vulnerability exists in Intel NUC Kit Wireless Adapter versions prior to 22.40. An attacker could exploit the vulnerability to escalate privileges...

CVE-2022-3885

Use after free in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

PT-2022-25083 · Samsung · Samsung Billing

Name of the Vulnerable Software and Affected Versions: Samsung Billing versions prior to 5.0.56.0 Description: The issue is related to improper authorization, allowing an attacker to obtain sensitive information. Recommendations: For versions prior to 5.0.56.0, update to version 5.0.56.0 or later...

SAMSUNG Editor Lite 缓冲区错误漏洞

SAMSUNG Editor Lite is a video editor from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Editor Lite versions prior to 4.0.41.3, which is caused by a heap overflow in the parsepce function in libsavsaudio.so, which can be exploited by an attacker to obtain...

CVE-2022-44646

In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings...

PT-2022-27268 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2022.10 Description: The issue concerns the exposure of password parameters in the build log when these parameters contain special characters. Recommendations: For versions prior to 2022.10, consider...

Apache Sling CMS 跨站脚本漏洞

Apache Sling CMS is a content management system CMS from the Apache Foundation USA. A cross-site scripting vulnerability exists in Apache Sling CMS version 1.1.0 and prior versions, which stems from incorrect neutralization of inputs during web page generation, and could allow an authenticated,...

CVE-2022-3654

Use after free in Layout in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2022-3443

Insufficient data validation in File System API in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass File System restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2022-3440

The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape an URL before outputting it back in an attribute when a specific widget is present on a page, leading to a Reflected Cross-Site Scripting...

AZL-11373 CVE-2022-41974 affecting package device-mapper-multipath for versions less than 0.8.6-4

multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege...