GHSA-X45C-CVP8-Q4FM Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace

Capsule implements a multi-tenant and policy-based environment in a Kubernetes cluster. A ServiceAccount deployed in a Tenant Namespace, when granted with PATCH capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule Operato...

PT-2022-27391 · Apache · Camel-Ldap

Name of the Vulnerable Software and Affected Versions: camel-ldap versions prior to 3.14.6 camel-ldap versions prior to 3.18.4 Description: The camel-ldap component is affected by an LDAP Injection issue when using the filter option. This allows for potential security breaches. Users are advised ...

PT-2022-26932 · Fs020W +3 · Fs020W +3

Name of the Vulnerable Software and Affected Versions: +F FS040U versions v2.3.4 and earlier +F FS020W versions v4.0.0 and earlier +F FS030W versions v3.3.5 and earlier +F FS040W versions v1.4.1 and earlier Description: A cross-site request forgery CSRF issue allows an adjacent attacker to hijack...

PT-2022-25999 · Nadesiko3 · Nadesiko3

Name of the Vulnerable Software and Affected Versions: Nadesiko3 PC Version versions 3.3.61 and earlier Nadesiko3 PC Version versions 3.3.68 and earlier Description: The issue allows a remote attacker to execute an arbitrary OS command when processing compression and decompression on the product...

PT-2022-27780 · Nodebb · Nodebb

Name of the Vulnerable Software and Affected Versions: NodeBB versions prior to 2.6.1 Description: The issue arises from a plain object with a prototype being used in socket.io message handling, allowing a specially crafted payload to impersonate other users and takeover accounts. Recommendations...

PT-2022-27284 · Crowdstrike · Crowdstrike Falcon

Name of the Vulnerable Software and Affected Versions: CrowdStrike Falcon version 6.44.15806 Description: The issue allows an administrative attacker to uninstall Falcon Sensor, bypassing the intended protection mechanism that requires possessing a one-time token. The sensor is managed at the...

CVE-2022-46145

authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified...

CVE-2022-46145 authentik vulnerable to unauthorized user creation and potential account takeover

authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified...

CVE-2022-46145 authentik vulnerable to unauthorized user creation and potential account takeover

authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified...

PT-2022-27598 · Tenda · Tenda Ac6V1.0

Name of the Vulnerable Software and Affected Versions: Tenda AC6V1.0 version 15.03.05.19 Description: A buffer overflow issue was discovered via the time parameter in the fromSetSysTime function. This issue may be exploited, potentially leading to unintended consequences. Recommendations: For Ten...

PT-2022-27611 · Tenda · Tenda I22

Name of the Vulnerable Software and Affected Versions: Tenda i22 version 1.0.0.34687 Description: A buffer overflow issue was discovered via the index parameter in the formWifiMacFilterGet function. This allows for potential exploitation. Recommendations: For Tenda i22 version 1.0.0.34687, as a...

PT-2022-27195 · Tenda · Tenda I21

Name of the Vulnerable Software and Affected Versions: Tenda i21 version 1.0.0.144656 Description: The issue is related to a Buffer Overflow that can be triggered via the /goform/setSnmpInfo API endpoint. This allows for potential exploitation. Recommendations: For Tenda i21 version 1.0.0.144656,...

PT-2022-27359 · Webtareas · Webtareas

Name of the Vulnerable Software and Affected Versions: webtareas version 2.4p5 Description: A cross-site scripting XSS issue was found in the /general/search.php?searchtype=simple component. This allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the...

PT-2022-27610 · Tenda · Tenda I22

Name of the Vulnerable Software and Affected Versions: Tenda i22 version 1.0.0.34687 Description: The issue is related to Cross Site Request Forgery CSRF via the fromSysToolReboot function. This allows for unauthorized actions to be performed on the device. Recommendations: For Tenda i22 version...

PT-2022-27196 · Tenda · Tenda I21

Name of the Vulnerable Software and Affected Versions: Tenda i21 version 1.0.0.144656 Description: The issue is a stack overflow vulnerability. It can be exploited via the /goform/setSysPwd API endpoint. Recommendations: For Tenda i21 version 1.0.0.144656, as a temporary workaround, consider...

PT-2022-27198 · Tenda · Tenda I21

Name of the Vulnerable Software and Affected Versions: Tenda i21 version 1.0.0.144656 Description: The issue is related to a Buffer Overflow that can be triggered via the "/goform/setUplinkInfo" API endpoint. This allows for potential exploitation. Recommendations: For Tenda i21 version...

PT-2022-27762

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2022.11.2 authentik versions prior to 2022.10.2 Description authentik is an open-source identity provider. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that...

CVE-2022-41969 Nextcloud Server has no password length limit when creating a user as an administrator

Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator can cause a limited DoS attack against their own server. Versions 23.0.11, 24.0.7, and 25.0.0 conta...

PT-2022-23805 · Sophos · Sophos Firewall

Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 19.5 GA Description: A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard. Recommendations: For Sophos Firewall versions prior to 19.5 GA, update to...

PT-2022-19867 · Western Digital · Sandisk Ibi +1

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud Home affected versions not specified Western Digital My Cloud Home Duo affected versions not specified SanDisk ibi affected versions not specified Description: A path traversal issue was addressed in the mentioned...