PT-2022-6310 · Ibm · Ibm Cloud Pak For Multicloud Management Monitoring

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak for Multicloud Management Monitoring versions 2.0 through 2.3 Description: The issue is related to incorrect restriction of a directory path with limited access. Exploitation of this issue may allow a remote attacker to elevate...

CVE-2022-31008

RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker link state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions...

CVE-2022-39270 Arbitrary HTML injection in table-of-contents theme component in DiscoTOC

DiscoTOC is a Discourse theme component that generates a table of contents for topics. Users that can create topics in TOC-enabled categories and have sufficient trust level - configured in component's settings are able to inject arbitrary HTML on that topic's page. The issue has been fixed on th...

PT-2022-25910 · Totolink · Totolink Nr1800X

Name of the Vulnerable Software and Affected Versions: TOTOLINK NR1800X version 9.1.0u.6279 B20210910 Description: The issue is an authenticated stack overflow that occurs via the command parameter in the setTracerouteCfg function. This allows for potential exploitation. No information is provide...

phpIPAM <= 1.5.2 SSRF Vulnerability

phpIPAM is prone to a server-side request forgery SSRF vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2022-24822 · Dex · Dex

Name of the Vulnerable Software and Affected Versions: Dex versions prior to 2.35.0 Description: Dex is an identity service that uses OpenID Connect to drive authentication for other apps. An attacker can exploit this issue by making a victim navigate to a malicious website and guiding them throu...

How to disable the static object cache for specific page of VPN Vserver

...

PT-2022-25870 · Unknown · Billing System Project

Name of the Vulnerable Software and Affected Versions: Billing System Project version 1.0 Description: The Billing System Project contains a remote code execution RCE issue via the /php action/createProduct.php component. This allows for potential code execution from a remote location...

CVE-2022-20864

A vulnerability in the password-recovery disable feature of Cisco IOS XE ROM Monitor ROMMON Software for Cisco Catalyst Switches could allow an unauthenticated, local attacker to recover the configuration or reset the enable password. This vulnerability is due to a problem with the file and boot...

PT-2022-6981 · D Link · D-Link Dap-1325

Name of the Vulnerable Software and Affected Versions: D-Link DAP-1325 affected versions not specified Description: The issue is related to a stack-based buffer overflow in the SetAPLanSettings function of the D-Link DAP-1325 wireless signal amplifier's firmware when handling XML data. This can...

The vulnerabilities of Mozilla Firefox, Mozilla Firefox ESR, and the email client Thunderbird are related to authentication process errors, which allow a perpetrator to disable the installed extensions.

The vulnerabilities of Mozilla Firefox, Mozilla Firefox ESR, and the email client Thunderbird are related to errors in the certificate validation process. Exploiting these vulnerabilities can allow an attacker to disable the installed extensions remotely...

PT-2022-25623 · Unknown · Zoo Management System

Name of the Vulnerable Software and Affected Versions: Zoo Management System version 1.0 Description: The issue is related to an arbitrary file upload vulnerability in the picture upload point of the "save event" file of the "Events" module in the background management system. This vulnerability ...

PT-2022-6973 · D Link · D-Link Dap-1325

Name of the Vulnerable Software and Affected Versions: D-Link DAP-1325 affected versions not specified Description: The issue is related to the SetHostIPv6Settings function of the D-Link DAP-1325 wireless signal amplifier's firmware, which does not properly neutralize special elements. This allow...

PT-2022-21159 · Unknown · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions prior to 5 Description: An information disclosure issue exists due to the getUserMentionsByChannel meteor server method, which discloses messages from private channels and direct messages regardless of the user's access...

PT-2022-22568 · Swftools · Swftools

Name of the Vulnerable Software and Affected Versions: SWFTools version 772e55a2 Description: A stack overflow issue was discovered in SWFTools via the ImageStream::getPixelunsigned char function at /xpdf/Stream.cc. This issue may be exploited, but details about the estimated number of potentiall...

PT-2022-24623 · Pbc · Pbc

Name of the Vulnerable Software and Affected Versions: PBC through 2022-8-27 Description: A SEGV issue was detected in the function pbc wmessage integer in src/wmessage.c:137. This issue affects PBC. Recommendations: For PBC through 2022-8-27, as a temporary workaround, consider disabling the pbc...

PT-2022-22560 · Swftools · Swftools

Name of the Vulnerable Software and Affected Versions: SWFTools version 772e55a2 Description: A floating point exception FPE was discovered in SWFTools via the DCTStream::readMCURow function at /xpdf/Stream.cc. This issue may be related to a problem in the readMCURow function. Recommendations: Fo...

PT-2022-25591 · Tenda · Tenda W20E

Name of the Vulnerable Software and Affected Versions: Tenda W20E router version 15.11.0.6 Description: The issue is a stack overflow vulnerability in the formSetDebugCfg function, which is triggered by the request "/goform/setDebugCfg/". This vulnerability can be exploited, but details about the...

PT-2022-23001 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O versions 5.0 through 5.5 Description: An issue in the FvbServicesRuntimeDxe driver allows an attacker to write fixed or predictable data to SMRAM, potentially leading to escalating privileges to SMM. This is due to an SMM...

PT-2022-22662 · Node.Js +6 · Node.Js +6

Name of the Vulnerable Software and Affected Versions: Node.js version 18 Description: A weak randomness issue exists in the WebCrypto keygen due to a change with EntropySource in SecretKeyGenTraits::DoKeyGen in src/crypto/crypto keygen.cc. There are two main problems: 1. The return value of...