CVE-2022-39019 Broken access controls on PDFtron WebviewerUI in M-Files Hubshare

Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the application server...

PT-2022-24675 · M Files +1 · M-Files Hubshare +1

Name of the Vulnerable Software and Affected Versions: M-Files Hubshare versions prior to 3.3.11.3 Description: The issue concerns broken access controls on PDFtron WebviewerUI in M-Files Hubshare, allowing unauthenticated attackers to upload malicious files to the application server...

GLSA-202210-14 : Gitea: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202210-14 Gitea: Multiple Vulnerabilities - Cross-site Scripting XSS - Stored in GitHub repository go-gitea/gitea prior to 1.16.9. CVE-2022-1928 - An attacker may cause a denial of service by crafting an Accept-Language header whi...

DEBIAN-CVE-2022-41974

multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege...

Privilege escalation

multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege...

CVE-2022-3735

A vulnerability was found in seccome Ehoney. It has been rated as critical. This issue affects some unknown processing of the file /api/public/signup. The manipulation leads to improper access controls. The identifier VDB-212417 was assigned to this vulnerability...

CVE-2022-3735

Incident summary (CVE-2022-3735): A vulnerability in seccome Ehoney affects the file /api/public/signup, where improper access controls could enable privilege escalation. Multiple connected sources confirm the issue as critical with unknown product versions and incomplete details on affected rele...

SUSE SLES12 Security Update : multipath-tools (SUSE-SU-2022:3713-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3713-1 advisory. - CVE-2022-41974: Fixed an authorization bypass issue in multipathd. bsc1202739 - Avoid linking to libreadline to avoid licensing issue...

SUSE SLED15: kpartx / libdmmp-devel / libdmmp0_2_0 / libmpath0 / multipath-tools / etc (SUSE-SU-2022:3711-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3711-1 advisory. - CVE-2022-41973: Fixed a symlink attack in multipathd. bsc1202739 - CVE-2022-41974: Fixed an...

SUSE SLES15: kpartx / libdmmp-devel / libdmmp0_2_0 / multipath-tools / etc (SUSE-SU-2022:3709-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3709-1 advisory. - CVE-2022-41973: Fixed a symlink attack in multipathd. bsc1202739 - CVE-2022-41974: Fixed an authorization bypass issue in...

CVE-2022-41974

A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath...

CVE-2022-41974

multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege...

Cisco TelePresence CE Multiple Vulnerabilities (cisco-sa-roomos-trav-beFvCcyu)

According to its self-reported version, Cisco TelePresence Collaboration Endpoint Software is affected by multiple vulnerabilities: - A vulnerability in Cisco TelePresence CE could allow an authenticated, local attacker to view sensitive information on an affected device. This vulnerability exist...

ByteDance Lemon8 安全漏洞

ByteDance Lemon8 is a lifestyle messaging application for young people from China's ByteDance. A security vulnerability exists in ByteDance Lemon8 versions prior to 3.3.5. The vulnerability stems from the fact that it does not have reasonably restricted access privileges, which could allow a remo...

PT-2022-22456 · Sourcecodester · Sourcecodester Human Resource Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Human Resource Management System version 1.0 Description: A critical issue was found in the Admin Panel component, specifically in the file employeeadd.php, leading to improper access controls. This issue can be exploited...

CVE-2022-3496

CVE-2022-3496 concerns a vulnerability in SourceCodester Human Resource Management System 1.0, affecting the Admin Panel’s file employeeadd.php . The issue is described as an improper access control flaw that can be exploited remotely, with the attack vector labeled as network and low privileges ...

PT-2022-5517 · Microsoft · Windows Dwm Core Library +1

Name of the Vulnerable Software and Affected Versions: Windows DWM Core Library affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows DWM Core Library, which can be exploited to elevate privileges. This allows an attacker to affect th...

PT-2022-5495 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows Group Policy service, allowing a remote attacker to elevate their privileges. Recommendations: At the moment, there i...

PT-2022-5660 · Microsoft · Windows Mixed Reality Developer Tools +1

Name of the Vulnerable Software and Affected Versions: Windows Mixed Reality Developer Tools affected versions not specified Description: The issue is related to insufficient access controls in the system, allowing an attacker to gain unauthorized access to protected information. This can be...

PT-2022-5401 · Microsoft · Windows Workstation Service +1

Name of the Vulnerable Software and Affected Versions: Windows Workstation Service affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows Workstation Service, allowing a remote attacker to elevate their privileges. This can affect the...