PT-2022-6254 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux Kernel version 6.0-rc2 Description: The issue is related to the use of memory after it has been freed, specifically within the nft osf eval function. This can allow an attacker to disclose sensitive information on affected installations...

PT-2022-25023 · Pspp +1 · Pspp +1

Name of the Vulnerable Software and Affected Versions: PSPP version 1.6.2 Description: An issue was discovered that allows attackers to cause a denial of service or possibly have other unspecified impacts due to a heap-based buffer overflow at the read string function in utilities/pspp-dump-sav.c...

JVN#34205166: SYNCK GRAPHICA Mailform Pro CGI vulnerable to information disclosure

Mailform Pro CGI provided by SYNCK GRAPHICA contains an information disclosure vulnerability CWE-200. Thanks module of this product saves user input data for a certain period of time. The time is set to 30 seconds by default in configs/thanks.cgi file. To exploit this vulnerability, it is require...

Design/Logic Flaw

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome. An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized fil...

Authorization

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including...

CVE-2022-31152

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including...

CVE-2022-31152 Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rules

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including...

CVE-2022-31152

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including...

CVE-2022-36078 Slice Memory Allocation with Excessive Size Value in binary

Binary provides encoding/decoding in Borsh and other formats. The vulnerability is a memory allocation vulnerability that can be exploited to allocate slices in memory with arbitrary excessive size value, which can either exhaust available memory or crash the whole program. When using...

CVE-2022-31176

CVE-2022-31176 concerns Grafana Image Renderer, a Grafana backend plugin that renders panels to PNGs via a headless browser. An internal security review identified an unauthorized file disclosure vulnerability: a malicious user could retrieve unauthorized files under certain network conditions or...

PT-2022-4809 · Unknown +2 · Libconfuse +2

Name of the Vulnerable Software and Affected Versions: libConfuse version 3.3 Description: The issue is related to a heap-based buffer over-read in the cfg tilde expand function of the libConfuse library. This can be exploited by a remote attacker using a specially crafted file, potentially leadi...

PT-2022-23606 · Unknown · Expense Management System

Name of the Vulnerable Software and Affected Versions: Expense Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the id parameter at the "/Home/debit credit p" API endpoint. Recommendations: For Expense Management System...

CVE-2022-31176

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome. An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized fil...

PT-2022-23995 · Apache · Apache Shenyu

Name of the Vulnerable Software and Affected Versions: Apache ShenYu versions 2.4.2 through 2.4.3 Description: The issue is related to insecure permissions in Apache ShenYu Admin, which may allow low-privilege administrators to modify high-privilege administrator's passwords. Recommendations: For...

PT-2022-23860 · Piwigo · Piwigo

Name of the Vulnerable Software and Affected Versions: Piwigo version 12.3.0 Description: The issue is related to Cross Site Scripting XSS and can be exploited via the "/search/1940/created-monthly-list" API endpoint. This allows for malicious scripts to be injected into the website...

Cleartext Transmission of Sensitive Information in moment-timezone

Impact if Alice uses grunt data or grunt release to prepare a custom-build, moment-timezone with the latest tzdata from IANA's website and Mallory intercepts the request to IANA's unencrypted ftp server, Mallory can serve data which might exploit further stages of the moment-timezone tzdata...

PT-2022-23595 · Unknown · Library Management System

Name of the Vulnerable Software and Affected Versions: Library Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the bookId parameter at the "/admin/delete.php" API endpoint. Recommendations: For Library...

PT-2022-4614 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: Gitlab CE/EE versions 10.7 through 15.1.5 Gitlab CE/EE versions 15.2 through 15.2.3 Gitlab CE/EE versions 15.3 through 15.3.1 Description: A potential DoS issue was discovered, allowing an attacker to trigger high CPU usage via a specially...

PT-2022-28282 · Unknown · Moment-Timezone

Name of the Vulnerable Software and Affected Versions: moment-timezone versions prior to 0.5.35 Description: The issue arises when using grunt data or grunt release to prepare a custom build of moment-timezone with the latest tzdata from IANA's website. If an attacker intercepts the request to...

PT-2022-23592 · Unknown · Library Management System

Name of the Vulnerable Software and Affected Versions: Library Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/librarian/dele.php" API endpoint. Recommendations: For Library...