CVE-2022-39365

Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in Pimcore/Mail & ClassDefinition\Layout\Text is vulnerable to server-side template injection, which could lead to remote code execution. Version 10.5.9 contain...

Code injection

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server prior to versions 22.2.10, 23.0.10, and 24.0.6 are vulnerable to a logged-in attacker slowing down the system by...

PT-2022-25598 · Tenda · Tenda Ax1803

Name of the Vulnerable Software and Affected Versions: Tenda AX1803 version 1.0.0.1 Description: A heap overflow issue was found in the GetParentControlInfo function, allowing for a denial of service attack through a specially crafted HTTP request. Recommendations: For Tenda AX1803 version 1.0.0....

SUSE SLES15: dracut-saltboot / golang-github-lusitaniae-apache_exporter / etc (SUSE-SU-2022:3751-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3751-1 advisory. dracut-saltboot: - Update to version 0.1.1661440542.6cbe0da Use standard susemanager.conf Move image services to...

SUSE SLES12 Security Update : SUSE Manager Client Tools (SUSE-SU-2022:3747-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3747-1 advisory. golang-github-lusitaniae-apacheexporter: - Update to upstream release 0.11.0 jscSLE-24791 Add TLS support Switch to logger, please...

CVE-2022-39365 RCE vulnerability in Pimcore/Mail & Dynamic Text Layout

Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in Pimcore/Mail & ClassDefinition\Layout\Text is vulnerable to server-side template injection, which could lead to remote code execution. Version 10.5.9 contain...

CVE-2022-39364 Exception logging in Sharepoint app reveals clear-text connection details

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server prior to versions 22.2.10.5, 23.0.9, and 24.0.5 an attacker reading nextcloud.log may gain knowledge of...

CVE-2022-39330 Database resource exhaustion for logged-in users via sharee recommendations with circles

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server prior to versions 22.2.10, 23.0.10, and 24.0.6 are vulnerable to a logged-in attacker slowing down the system by...

CVE-2022-39364

CVE-2022-39364 affects Nextcloud Server and Enterprise Server: reading nextcloud.log can reveal credentials to connect to a SharePoint service. Affected versions include Nextcloud Server prior to 23.0.9 and prior to 24.0.5; Nextcloud Enterprise Server prior to 22.2.10.5, 23.0.9, and 24.0.5. Patch...

PT-2022-21869 · Horner Automation · Cscape

Name of the Vulnerable Software and Affected Versions: Horner Automation's Cscape versions 9.90 SP 6 and prior Description: The issue arises from improper validation of user-supplied data. If a user opens a maliciously formed FNT file, an attacker could execute arbitrary code within the current...

CVE-2022-39365 RCE vulnerability in Pimcore/Mail & Dynamic Text Layout

Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in Pimcore/Mail & ClassDefinition\Layout\Text is vulnerable to server-side template injection, which could lead to remote code execution. Version 10.5.9 contain...

PT-2022-23893 · Wireshark +3 · Wireshark +3

Name of the Vulnerable Software and Affected Versions: Wireshark versions 3.6.0 through 3.6.8 Description: The issue is related to a crash in the OPUS protocol dissector, which allows for denial of service via packet injection or crafted capture file. This can be exploited by injecting packets or...

CVE-2022-39364 Exception logging in Sharepoint app reveals clear-text connection details

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server prior to versions 22.2.10.5, 23.0.9, and 24.0.5 an attacker reading nextcloud.log may gain knowledge of...

CVE-2022-39355

Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper authentication vulnerability could be used to take control of a victim's forum account. This vulnerability is patched in commit number...

DEBIAN-CVE-2022-39286

Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupytercore that stems from jupytercore executing untrusted files in CWD. This vulnerability allows one user to run code as...

Authentication flaw

Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper authentication vulnerability could be used to take control of a victim's forum account. This vulnerability is patched in commit number...

PT-2022-5270 · D Link · D-Link Dir-816 A2

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.10 B05 Description: The issue is related to a stack overflow in the /goform/form2WizardStep4 component of the D-Link DIR-816 A2 router's firmware. This can be exploited via the wizardstep4 pskpwd parameter,...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-waitress (SUSE-SU-2022:3731-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3731-1 advisory. - CVE-2022-24761: Fixed a bug to avoid inconsistent interpretation of HTTP requests leading to request...

CVE-2022-39355 Discourse Patreon vulnerable to improper validation of email during Patreon authentication

Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper authentication vulnerability could be used to take control of a victim's forum account. This vulnerability is patched in commit number...

Inefficient Regular Expression Complexity in shescape

Impact This impacts users that use shescape to escape arguments: - for the Unix shell Bash, or any not-officially-supported Unix shell; - using the escape or escapeAll functions with the interpolation option set to true. An attacker can cause polynomial backtracking in terms of the input string...