AZL-37011 CVE-2022-2031 affecting package samba for versions less than 4.18.3-1

A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other...

ALPINE-CVE-2022-2923

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240...

CVE-2022-2593

The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before inserting it into a SQL query, which could allow high privilege users to perform SQL Injection attacks...

CVE-2022-2889

Use After Free in GitHub repository vim/vim prior to 9.0.0225...

CVE-2022-27500

Incorrect default permissions for the IntelR Support Android application before 21.07.40 may allow an authenticated user to potentially enable information disclosure via local access...

CVE-2022-22730

Improper authentication in the IntelR Edge Insights for Industrial software before version 2.6.1 may allow an unauthenticated user to potentially enable escalation of privilege via network access...

CVE-2021-23179

Out of bounds read in firmware for some IntelR Wireless BluetoothR and KillerTM BluetoothR products before version 22.120 may allow a privileged user to potentially enable information disclosure via local access...

UBUNTU-CVE-2022-2874

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224...

Vite path traversal vulnerability

Vite is a new front-end build tool open-sourced by Vite. A security vulnerability exists in versions prior to Vite v2.9.13 that stems from a vulnerability that allows an attacker to perform directory traversal of a victim's service via a crafted URL...

DEBIAN-CVE-2022-2845

Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218...

EFM Networks ipTIME NAS1dual, NAS2dual, NAS4dual have vulnerabilities related to cross-site request forgery attacks.

EFM Networks ipTIME NAS1dual and others are a network attached storage from EFM Networks, Korea. A security vulnerability exists in EFM Networks ipTIME NAS1dual, NAS2dual, and NAS4dual versions prior to 1.4.86, which can be exploited by remote attackers to steal root privileges via a POST request...

CVE-2020-21641

Out-of-Band XML External Entity OOB-XXE vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files, enumerate folders and scan internal ports via crafted XML license file...

CVE-2022-2819

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211...

CVE-2022-36803

The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permission to use the MasterUserEdit API to modify any users role to Super Admin. This vulnerability was reported by Jacob Shafer from Bishop Fox...

Esri Portal For ArcGis Cross-site Scripting Vulnerability

Esri Portal For ArcGIS is a component from Environmental Systems Research Institute Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. A cross-site scripting vulnerability exists in Esri Portal For ArcGis versions prior t...

WordPress plugin Digital Publications by Supsystic: Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

DEBIAN-CVE-2022-2608

Use after free in Overview Mode in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions...

JetBrains Ktor framework authorization issue vulnerability

JetBrains Ktor framework is a web application framework from the Czech company JetBrains. A security vulnerability exists in JetBrains Ktor framework versions prior to 2.1.0, which stems from the possibility that a user may select the wrong authentication under certain circumstances...

WeForms WordPress plugin has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Grommunio Gromox security vulnerabilities

Grommunio Gromox is a groupware server from Grommunio that replaces Microsoft Exchange. A security vulnerability exists in Grommunio Gromox versions prior to 1.28, which stems from weak permissions in the configuration file in the PAM module, and can be exploited by an attacker to allow the PAM...