PT-2022-19321 · Unknown · Fisco-Bcos

Name of the Vulnerable Software and Affected Versions: FISCO-BCOS version release-3.0.0-rc2 Description: The issue allows a malicious node to cause normal nodes to stop producing new blocks and processing new clients' requests by sending an invalid proposal with an invalid header. Recommendations...

GHSA-VWP5-W4RQ-G4CC Koji blacklisted paths workaround

Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission...

GHSA-Q4Q2-93PW-QWGF Issuer validation regression in Spring Cloud SSO Connector

Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of...

PT-2022-11758 · Anaconda3 · Anaconda3

Name of the Vulnerable Software and Affected Versions: Anaconda3 version 2021.05 Description: The issue concerns OS command injection. When a user installs Anaconda, an attacker can create a new file and write something in usercustomize.py. This allows the execution of commands when the user open...

PT-2022-17575 · Unknown · Workspace-Tools

Name of the Vulnerable Software and Affected Versions: workspace-tools versions prior to 0.18.4 Description: The issue concerns Command Injection via git argument injection. When the fetchRemoteBranchremote: string, remoteBranch: string, cwd: string function is called, both the remote and...

PT-2022-19525 · Unknown · Solarview Compact

Name of the Vulnerable Software and Affected Versions: SolarView Compact version 6.00 Description: The issue allows attackers to access sensitive files via directory traversal. Recommendations: For SolarView Compact version 6.00, consider restricting access to sensitive files as a temporary...

PT-2022-19960 · Unknown · Insurance Management System

Name of the Vulnerable Software and Affected Versions: Insurance Management System version 1.0 Description: The issue concerns SQL Injection via the /insurance/editPayment.php endpoint, specifically through the recipt no parameter. This allows for potential manipulation of database queries...

Intel Memory Bug Poses Risk for Hundreds of Products

Chipmaker Intel is reporting a memory bug impacting microprocessor firmware used in “hundreds” of products. According to an advisory issued by the company on Tuesday, the bug is firmware-based and rated as “high” risk with a Common Vulnerability Scoring System CVSS score of 7. The vulnerability...

PT-2022-19873 · Ipswitch · Ipswitch Whatsup Gold

Name of the Vulnerable Software and Affected Versions: Ipswitch WhatsUp Gold versions 21.0.0 through 21.1.1 Ipswitch WhatsUp Gold version 22.0.0 Description: The issue allows an unauthenticated attacker to invoke an API transaction, enabling them to relay encrypted user credentials to an arbitrar...

PT-2022-19302 · Totolink · Totolink N600R

Name of the Vulnerable Software and Affected Versions: TOTOLink N600R version 5.3c.7159 B20190425 Description: A command injection issue was discovered via the hosttime function in the "/setting/NTPSyncWithHost" API endpoint. This allows for potential command injection attacks. Recommendations: F...

PT-2022-19303 · Totolink · Totolink N600R

Name of the Vulnerable Software and Affected Versions: TOTOLink N600R version V5.3c.7159 B20190425 Description: A command injection issue was discovered via the ipdoamin parameter in the "/setting/setDiagnosisCfg" API endpoint. Recommendations: For TOTOLink N600R version V5.3c.7159 B20190425, as ...

NewStart CGSL CORE 5.05 / MAIN 5.05 : flatpak Vulnerability (NS-SA-2022-0043)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has flatpak packages installed that are affected by a vulnerability: - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10...

PT-2022-19308 · Totolink · Totolink N600R

Name of the Vulnerable Software and Affected Versions: TOTOLink N600R version V5.3c.7159 B20190425 Description: A command injection issue was found via the filename parameter in the "/setting/setUploadSetting" API endpoint. This allows for potential command execution. No information is provided...

PT-2022-19309 · D Link · D-Link Dir-816 A2

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.10CNB04 Description: A command injection issue was discovered via the admuser and admpass parameters in the "/goform/setSysAdm" API endpoint. Recommendations: For D-Link DIR-816 A2 version 1.10CNB04, as a temporary...

PT-2022-2627 · Adobe · Indesign

Name of the Vulnerable Software and Affected Versions: Adobe InDesign versions 17.1 and earlier Adobe InDesign versions 16.4.1 and earlier Description: The issue is related to an out-of-bounds write vulnerability in Adobe InDesign that could result in arbitrary code execution in the context of th...

Active Exploitation of F5 BIG-IP iControl REST CVE-2022-1388

On May 4, 2022, F5 released an advisory listing several vulnerabilities, including CVE-2022-1388, a critical authentication bypass that leads to remote code execution in iControl REST with a CVSSv3 base score of 9.8. The vulnerability affects several different versions of BIG-IP prior to 17.0.0,...

Multiple vulnerabilities in multiple MEIKYO ELECTRIC products

Overview Multiple MEIKYO ELECTRIC products provided by MEIKYO ELECTRIC CO.,LTD. contain multiple vulnerabilities listed below. Cross-site request forgery CWE-352 - CVE-2022-27632 Cross-site scripting CWE-79 - CVE-2022-28717 Takayuki Sasaki of Yokohama National University reported these...

JVN#50337155: KOYO Electronics Screen Creator Advance2 vulnerable to authentication bypass

Screen Creator Advance2 provided by KOYO ELECTRONICS INDUSTRIES CO., LTD. is a screen development tool for KOYO ELECTRONICS's HMI. Screen Creator Advance2 contains an authentication bypass vulnerability CWE-807 due to the improper check for the Remote control setting's account names. Impact An...

JVN#96561229: Multiple vulnerabilities in Operation management interface of FUJITSU Network IPCOM

FUJITSU Network IPCOM provided by FUJITSU LIMITED is an integrated network appliance. Operation management interface used to operate FUJITSU Network IPCOM contains multiple vulnerabilities listed below. OS command injection in the web console CWE-78 - CVE-2022-29516 Version| Vector| Score...

Craft CMS 3.7.36 Password Reset Poisoning Attack Vulnerability

Craft CMS version 3.7.36 suffers from a password reset poisoning vulnerability. An unauthenticated attacker who knows valid email addresses or account names of Craft CMS backend users is able to manipulate the password reset functionality in a way that the registered users of the CMS receive...