PT-2022-5951 · Microsoft · Windows Hyper-V +1

Name of the Vulnerable Software and Affected Versions: Windows Hyper-V affected versions not specified Description: The issue is related to insufficient access controls in the Hyper-V hardware virtualization system of Microsoft Windows, allowing an attacker to potentially elevate their privileges...

TYPO3 安全漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A security vulnerability exists in TYPO3 Core, which can be exploited by an attacker to read sensitive information by bypassing access restrictions to TYPO3 Core data via site configurati...

PT-2022-27446 · Dragino · Dragino Lora Lg01

Name of the Vulnerable Software and Affected Versions: Dragino Lora LG01 18ed40 IoT version 4.3.4 Description: The web portal of the affected device has a directory listing at the URL "https://10.10.20.74/lib/". This directory contains a backup file that can be downloaded without any...

PrePOMarket.sol : a sender who is not included in the account list can front run and mint prior to setting the _mintHook

Lines of code Vulnerability details Impact a sender who is not included in the account list can front run and mint prior to setting the mintHook. Proof of Concept The contract says, Minting will only be done by the team, and thus relies on the mintHook to enforce access controls. This is also why...

CVE-2022-38765

Canon Medical Informatics Vitrea Vision 7.7.76.1 does not adequately enforce access controls. An authenticated user is able to gain unauthorized access to imaging records by tampering with the vitrea-view/studies/search patientId parameter...

Implementing Security Restrictions and Owner Access Controls on LPDA Smart Contract.

Lines of code Vulnerability details Vulnerability details Impact The new changes to the contract add an additional layer of security and restrict access to certain privileged functions. The buy function now requires that only the owner can purchase tokens, which prevents malicious actors from...

CVE-2022-37916

Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network...

CVE-2022-37916

Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network...

Design/Logic Flaw

Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network...

CVE-2022-37917

CVE-2022-37917 affects Aruba AirWave Management Platform, exposing some web-based management URLs to broken access control. An attacker with limited privileges could access sensitive information or modify network configurations with higher-privilege effects. Impact is tied to AirWave versions 8.2...

PT-2022-24150 · Aruba · Aruba Airwave Management Platform

Name of the Vulnerable Software and Affected Versions: Aruba AirWave Management Platform versions 8.2.15.0 and below Description: Vulnerabilities in the AirWave Management Platform web-based management interface exist, exposing some URLs to a lack of proper access controls. These vulnerabilities...

CVE-2022-37916

The CVE-2022-37916 issue affects Aruba AirWave Management Platform web-based management interface. Vulnerabilities are described as broken/access-control flaws on certain URLs, allowing a remote attacker with limited privileges to access sensitive information and potentially alter network configu...

Aruba Networks AirWave Management Platform 安全漏洞

Aruba Networks AirWave Management Platform is the leading multi-vendor management platform designed for local campus environments, providing granular visibility into wired and wireless networks from Aruba Networks. A security vulnerability in Aruba Networks AirWave Management Platform version...

CVE-2022-37918 Broken Access Control for some Web-based Management URLs in AirWave Management Platform

Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network...

CVE-2022-38765

Canon Medical Informatics Vitrea Vision 7.7.76.1 does not adequately enforce access controls. An authenticated user is able to gain unauthorized access to imaging records by tampering with the vitrea-view/studies/search patientId parameter...

PrestaShop 信息泄露漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts and product image scaling. An information disclosure vulnerability exists in PrestaShop versions prior to 1.7.8.8. The vulnerability...

PT-2022-24148 · Aruba · Aruba Airwave Management Platform

Name of the Vulnerable Software and Affected Versions: Aruba AirWave Management Platform versions 8.2.15.0 and below Description: Vulnerabilities in the AirWave Management Platform web-based management interface exist, which expose some URLs to a lack of proper access controls. These...

USN-5731-1: multipath-tools vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Description It was discovered that multipath-tools incorrectly handled symlinks. A local attacker could possibly use this issue, in combination with other issues, to escalate privileges. This issue only affected Ubun...

Amazon Linux 2 : device-mapper-multipath (ALAS-2022-1883)

The version of device-mapper-multipath installed on the remote host is prior to 0.4.9-136. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1883 advisory. multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or ...

Important: device-mapper-multipath

Issue Overview: multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to loc...