SUSE-SU-2022:4639-1 Security update for polkit-default-privs

This update for polkit-default-privs fixes the following issues: Update to version 13.2+20221216.a0c29e6: - backport usbguard actions bsc1206414...

PT-2022-37541 · Unknown · Polkit-Default-Privs

Name of the Vulnerable Software and Affected Versions: polkit-default-privs versions prior to 13.2+20221216.a0c29e6 Description: The issue is related to the polkit-default-privs package, where an update to version 13.2+20221216.a0c29e6 includes backporting usbguard actions. Recommendations: Updat...

K000130414: Samba vulnerability CVE-2022-38023

Security Advisory Description Netlogon RPC Elevation of Privilege Vulnerability. CVE-2022-38023 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Product Development has evaluated the currently supported releases for potential vulnerability...

LiuOS 安全漏洞

LiuOS is a small Python project designed to mimic the functionality of a regular operating system. A security vulnerability exists in versions of LiuOS prior to 0.1.1, which stems from a vulnerability that allows an attacker to set the GITHUBACTIONS environment variable to any value other than nu...

PT-2022-27790 · Liuos · Liuos

Name of the Vulnerable Software and Affected Versions: LiuOS versions 0.1.0 and prior Description: LiuOS is a small Python project that imitates the functions of a regular operating system. The issue allows an attacker to set the GITHUB ACTIONS environment variable to anything other than null or...

Improper Access Control

github.com/usememos/memos is vulnerable to improper access control. The vulnerability exists in multiple functions due to insecure direct object references which allows an attacker to perform actions on a user's behalf via Change Password feature...

CVE-2022-38757 CVE-2022-38757 ZENworks

A vulnerability has been identified in Micro Focus ZENworks 2020 Update 3a and prior versions. This vulnerability allows administrators with rights to perform actions e.g., install a bundle on a set of managed devices, to be able to exercise these rights on managed devices in the ZENworks zone bu...

Micro Focus ZENworks 安全漏洞

Micro Focus ZENworks is a suite of software products for computer systems management from Micro Focus UK. Designed to manage the entire lifecycle of servers, desktop PCs Windows, Linux, or Mac, laptops, and handheld devices such as Android and iOS phones and tablets. A security vulnerability exis...

PT-2022-24555 · Micro Focus · Micro Focus Zenworks

Name of the Vulnerable Software and Affected Versions: Micro Focus ZENworks versions 2020 Update 3a and prior Description: A vulnerability has been identified that allows administrators with rights to perform actions, such as installing a bundle, on a set of managed devices, to exercise these...

CVE-2022-3794

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not...

CVE-2022-3794

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not...

Authorization

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not...

CVE-2022-3794 Jeg Elementor Kit <= 2.5.6 - Authorization Bypass

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not...

CVE-2022-3794

Summary: CVE-2022-3794 affects the WordPress plugin Jeg Elementor Kit up to version 2.5.6. The issue is an authorization bypass in various AJAX actions where an authenticated user can exploit an easily available nonce value due to missing capability checks. What is affected: Jeg Elementor Kit plu...

CVE-2022-22758

When clicking on a tel: link, USSD codes, specified after a \ character, would be included in the phone number. On certain phones, or on certain carriers, if the number was dialed this could perform actions on a user's account, similar to a cross-site request forgery attack.This bug only affects...

Cross site request forgery (csrf)

When clicking on a tel: link, USSD codes, specified after a \ character, would be included in the phone number. On certain phones, or on certain carriers, if the number was dialed this could perform actions on a user's account, similar to a cross-site request forgery attack.This bug only affects...

PT-2022-24165 · WordPress · Jeg Elementor Kit

Name of the Vulnerable Software and Affected Versions: Jeg Elementor Kit plugin for WordPress versions up to, and including, 2.5.6 Description: The issue concerns an authorization bypass in various AJAX actions. Authenticated users can exploit an easily available nonce value to create header...

CVE-2022-22758

When clicking on a tel: link, USSD codes, specified after a \ character, would be included in the phone number. On certain phones, or on certain carriers, if the number was dialed this could perform actions on a user's account, similar to a cross-site request forgery attack.This bug only affects...

CVE-2022-22758

When clicking on a tel: link, USSD codes, specified after a \ character, would be included in the phone number. On certain phones, or on certain carriers, if the number was dialed this could perform actions on a user's account, similar to a cross-site request forgery attack.This bug only affects...

CVE-2022-3188

Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where unauthenticated users could open PHP index pages without authentication and download the history file from the device; the history file includes the latest actions completed by specific users...