CVE-2022-39267

Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for production environments. Versions prior to 1.8.8-release are subject to authentication bypass in the admin and monitor user groups by deleting the X-Requested-With:...

CVE-2022-39404

Vulnerability in the MySQL Installer product of Oracle MySQL component: Installer: General. Supported versions that are affected are 1.6.3 and prior. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Installer executes to compromise MyS...

CVE-2022-22239 Junos OS Evolved: The ssh CLI command always runs as root which can lead to privilege escalation

An Execution with Unnecessary Privileges vulnerability in Management Daemon mgd of Juniper Networks Junos OS Evolved allows a locally authenticated attacker with low privileges to escalate their privileges on the device and potentially remote systems. This vulnerability allows a locally...

Facebook Detects 400 Android and iOS Apps Stealing Users Log-in Credentials

Meta Platforms on Friday disclosed that it had identified over 400 malicious apps on Android and iOS that it said targeted online users with the goal of stealing their Facebook login information. "These apps were listed on the Google Play Store and Apple's App Store and disguised as photo editors...

dpro-bourgenbresse.fr Cross Site Scripting vulnerability OBB-2933273

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-40757

A Buffer Access with Incorrect Length Value vulnerablity in the TEEMACComputeFinal function in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service DoS by invoking the function TEEMACComputeFinal with an excessive size value of messageLen...

CVE-2022-38832: Improper Neutralization of Special Elements used in an SQL Command

School Activity Updates with SMS Notification v1.0 is vulnerable to SQL Injection via /activity/admin/modules/department/index.php?view=edit&id=...

CVE-2022-38878: Improper Neutralization of Special Elements used in an SQL Command

School Activity Updates with SMS Notification v1.0 is vulnerable to SQL Injection via /activity/admin/modules/event/index.php?view=edit&id=...

CVE-2022-38833: Improper Neutralization of Special Elements used in an SQL Command

School Activity Updates with SMS Notification v1.0 is vulnerable to SQL Injection via /activity/admin/modules/modstudent/index.php?view=view&id=...

CVE-2022-40760: Improper Restriction of Operations within the Bounds of a Memory Buffer

A Buffer Access with Incorrect Length Value vulnerablity in the TEEMACUpdate function in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service DoS by invoking the function TEEMACUpdate with an excessive size value of chunkSize...

PT-2022-25517

Name of the Vulnerable Software and Affected Versions Samsung mTower versions 0.3.0 and earlier Description A Buffer Access with Incorrect Length Value issue in the TEE MACComputeFinal function allows a trusted application to trigger a Denial of Service DoS by invoking the function TEE...

PT-2022-23903 · Stealjs · Stealjs

Name of the Vulnerable Software and Affected Versions: stealjs steal version 2.2.4 Description: A Regular Expression Denial of Service ReDoS flaw was found in the source and sourceWithComments variables in main.js. This issue can cause a denial of service. Recommendations: For version 2.2.4,...

PT-2022-28288 · Ransack +2 · Ransack +2

Name of the Vulnerable Software and Affected Versions: pageflow versions prior to 14.5.2 pageflow versions prior to 15.7.1 Description: The issue allows attackers to extract sensitive properties of database objects associated with users or entries belonging to an account they have access to. This...

CVE-2022-35947: Improper Neutralization of Special Elements used in an SQL Command

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions have been found to be vulnerable to a SQL injection attack which an attacker could...

Malicious code in pkg_with_bin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e6344dd060632869845f44769fb6ef861c6d3c687ea297cff8c6a21c642acd4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-43090

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw was discovered in the Linux kernel related to block I/O throttling. A potential integer overflow exists within the tg with in bps limit function, specifically in the calculation o...

CVE-2022-36085

A flaw was found in open-policy-agent. The Rego compiler provides a deprecated WithUnsafeBuiltins function, allowing users to provide a set of built-in functions that should be deemed unsafe and rejected by the compiler if encountered in the policy compilation stage. A bypass of this protection c...

CVE-2022-38268: Improper Neutralization of Special Elements used in an SQL Command

School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/autonumber/index.php?view=edit&id=...

CVE-2022-38269: Improper Neutralization of Special Elements used in an SQL Command

School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/modstudent/index.php?view=edit&id=...

PT-2022-23174 · Unknown · Open Policy Agent

Name of the Vulnerable Software and Affected Versions: Open Policy Agent OPA versions prior to 0.43.1 Description: The Rego compiler in Open Policy Agent OPA has a deprecated WithUnsafeBuiltins function that allows users to specify built-in functions to be rejected by the compiler. However, a...