CVE-2022-4438

Use after free in Blink Frames in Google Chrome prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

PT-2022-27224 · Tsolucio · Corebos

Name of the Vulnerable Software and Affected Versions: corebos versions prior to 8.0 Description: The issue is related to PHP Remote File Inclusion in the GitHub repository tsolucio/corebos. Recommendations: For versions prior to 8.0, update to version 8.0 or later to resolve the issue...

IFM Moneo Appliance Authorization Issue Vulnerability

The IFM Moneo Appliance QHA200 and the IFM Moneo Appliance QHA210 are both pieces of hardware from IFM Germany that are used to operate Moneo in the production process. An authorization issue vulnerability exists in IFM Moneo Appliance versions prior to 1.9.3. An attacker could exploit this...

PT-2022-24773

Name of the Vulnerable Software and Affected Versions Dokan WordPress plugin versions prior to 3.7.6 Description The issue is related to a SQL injection that can be exploited by unauthenticated users due to improper sanitization and escaping of a parameter in a SQL statement. Recommendations For...

xrdp security vulnerabilities

xrdp is an open source remote desktop protocol server from Neutrinolabs Labs. A security vulnerability exists in xrdp versions prior to v0.9.21, which stems from the inclusion of a buffer overflow in the xrdpmmchandatain function...

ZKTeco ZKBio Time Cross-site Scripting Vulnerability

ZKTeco ZKBio Time is a powerful web-based time and attendance management software from ZKTeco, China. A security vulnerability exists in ZKTeco ZKBio Time prior to version 3.1-164, which originates from a vulnerability that allows users to embed malicious code in the Web UI...

PT-2022-27986 · Jetbrains · Jetbrains Gateway

Name of the Vulnerable Software and Affected Versions: JetBrains Gateway versions prior to 2022.3 Description: The issue allows a client to connect without a valid token if the host consents. This could potentially lead to unauthorized access. Recommendations: For versions prior to 2022.3, update...

PT-2022-36101 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.8 Description: The issue is related to a potential security vulnerability in the btrfs filesystem, specifically in the find parent nodes function during backref walking, which may cause an inode list leak...

CVE-2022-44942

Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function...

PT-2022-23692 · WordPress · Syncee

Name of the Vulnerable Software and Affected Versions: Syncee WordPress plugin versions prior to 1.0.10 Description: The issue allows the leakage of the administrator token, which can be used to take over the administrator's account. Recommendations: For versions prior to 1.0.10, update to versio...

thisAAY Lazy Mouse Access Control Vulnerability

thisAAY Lazy Mouse is a mouse application from thisAAY. A security vulnerability exists in versions prior to thisAAY Lazy Mouse 2.0.1, which stems from a default configuration that does not require a password and allows an unauthenticated remote user to execute arbitrary code without prior...

Student Information System SQL Injection Vulnerability

Student Information System is a web-based application platform by Carlo Montero, a personal developer. It can help a university or college to manage student information and academic records. A SQL injection vulnerability exists in Student Information System versions prior to 2.1.11. No informatio...

CVE-2022-4182

Inappropriate implementation in Fenced Frames in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass fenced frame restrictions via a crafted HTML page. Chromium security severity: Medium...

PT-2022-6758 · Hitachi · Hitachi Replication Manager

Name of the Vulnerable Software and Affected Versions: Hitachi Replication Manager versions prior to 8.8.5-02 Description: The issue affects Hitachi Replication Manager and is related to an Expression Language Injection vulnerability, allowing code injection. This vulnerability can be exploited b...

SAML authorization vulnerabilities

SAML is a library for Ross Kinder individual developers that contains a partial implementation of the saml standard in golang. That is, it allows third parties to authenticate your users, or allows third parties to rely on us to authenticate their users. There is an authorization issue...

CVE-2022-45931

A SQL injection issue was discovered in AAA in OpenDaylight ODL before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/UserStore.java deleteUser function is affected when the API interface /auth/v1/users/ is used...

NextCloud security vulnerabilities

Nextcloud is a suite of open source, self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in versions prior to Nextcloud useroidc 1.2.1, which stems from the fact that sensitive information such as OIDC client...

CVE-2022-40772

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report module...

SolarWinds Security Event Manager environmental issues vulnerability

SolarWinds Security Event Manager SolarWinds SEM is an American SolarWinds Inc. for forensics and troubleshooting, as well as a tool to help you manage log data. A cross-site scripting vulnerability exists in SolarWinds Security Event Manager versions prior to 2022.4. The vulnerability stems from...

immudb data falsification vulnerability

immudb is a CodeNotary open source immutable database based on zero-trust, SQL and key-value, tamper-resistant, data change history . immudb version 1.4.1 before there is a data forgery problem vulnerability , the vulnerability stems from a malicious server can provide false proof , the client SD...