PT-2022-17601 · Google · Jib-Core

Name of the Vulnerable Software and Affected Versions: com.google.cloud.tools:jib-core versions prior to 0.22.0 Description: The issue allows for Remote Code Execution RCE via the isDockerInstalled function, due to attempting to execute input. Recommendations: For versions prior to 0.22.0, update...

DEBIAN-CVE-2022-36083

JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c PBES2 Count, which determine...

PT-2022-24362 · Tenda · Tenda Ac18

Name of the Vulnerable Software and Affected Versions: Tenda AC18 router versions 15.03.05.05 through 15.03.05.19 Description: A stack overflow issue was discovered via the time parameter at the "/goform/PowerSaveSet" API endpoint. Recommendations: For versions 15.03.05.05 through 15.03.05.19,...

PT-2022-23489 · Tenda · Tenda G3

Name of the Vulnerable Software and Affected Versions: Tenda G3 version US G3V3.0br V15.11.0.67663 EN TDE Description: The issue is caused by a buffer overflow in the addDhcpRule function due to sscanf in the httpd binary. Recommendations: For Tenda G3 version US G3V3.0br V15.11.0.67663 EN TDE, a...

PT-2022-24053 · Ftcms · Ftcms

Name of the Vulnerable Software and Affected Versions: ftcms version 2.1 Description: The issue allows an attacker to insert malicious JavaScript code into the web page, causing the user or administrator to trigger malicious code when accessing. This is a result of a XSS vulnerability in the...

PT-2022-4702 · Cognex · Cognex 3D-A1000 Dimensioning System

Name of the Vulnerable Software and Affected Versions: Cognex 3D-A1000 Dimensioning System versions 1.0.3 3354 and prior Description: The issue is related to the implementation of security functions on the client-side of the Cognex 3D-A1000 Dimensioning System. This could allow a remote attacker ...

PT-2022-23488 · Tenda · Tenda G3

Name of the Vulnerable Software and Affected Versions: Tenda G3 version US G3V3.0br V15.11.0.67663 EN TDE Description: The issue is caused by a buffer overflow in the getsinglepppuser function due to sscanf. Recommendations: For Tenda G3 version US G3V3.0br V15.11.0.67663 EN TDE, as a temporary...

PT-2022-24109 · Totolink · Totolink A860R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A860R version 4.1.2cu.5182 B20201027 Description: The issue is related to a buffer overflow vulnerability in the main function of the downloadfile.cgi. Recommendations: For TOTOLINK A860R version 4.1.2cu.5182 B20201027, consider...

PT-2022-6254 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux Kernel version 6.0-rc2 Description: The issue is related to the use of memory after it has been freed, specifically within the nft osf eval function. This can allow an attacker to disclose sensitive information on affected installations...

PowerCMS XMLRPC API vulnerable to command injection

Overview PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability CWE-74. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. According to the...

PT-2022-23527 · Unknown · Pkuvcl Davs2

Name of the Vulnerable Software and Affected Versions: PKUVCL davs2 version 1.6.205 Description: A global buffer overflow was discovered in the parse sequence header function at source/common/header.cc:269. This issue affects the specified version of PKUVCL davs2. Recommendations: For PKUVCL davs...

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium such as a flash disk could use this flaw to force a user into permanently disabling the encryption layer of that medium.

...

PT-2022-23861 · Unknown · Garage Management System

Name of the Vulnerable Software and Affected Versions: Garage Management System version 1.0 Description: The application manage website.php is vulnerable to Shell File Upload. An already authenticated malicious user can upload a dangerous Remote Code Execution RCE or Local Code Execution LCE...

Grafana Image Renderer leaking files

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome. An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized fil...

PT-2022-17431 · Npm · @Pendo324/Get-Process-By-Name

Name of the Vulnerable Software and Affected Versions: @pendo324/get-process-by-name versions all Description: The issue is related to Arbitrary Code Execution due to improper sanitization of the getProcessByName function. This allows for potential code execution without proper validation...

PT-2022-14032 · WordPress · Stop Comment Spam

Name of the Vulnerable Software and Affected Versions: Stop Spam Comments WordPress plugin versions 0.2.1.2 and earlier Description: The issue arises from the improper generation of the Javascript access token, which is intended to prevent abuse of the comment section. This allows threat authors ...

PT-2022-24456 · Tenda · Tenda M3

Name of the Vulnerable Software and Affected Versions: Tenda M3 version 1.0.0.124856 Description: A heap buffer overflow issue was found in the formSetFixTools function, allowing attackers to cause a Denial of Service DoS by exploiting the lan parameter. Recommendations: For Tenda M3 version...

PT-2022-24452 · Linksys · Linksys E1200

Name of the Vulnerable Software and Affected Versions: Linksys E1200 version 1.0.04 Description: The issue is related to a buffer overflow vulnerability. It can be triggered via the ej get web page name function. Recommendations: For Linksys E1200 version 1.0.04, as a temporary workaround, consid...

PT-2022-24464 · Tenda · Tenda M3

Name of the Vulnerable Software and Affected Versions: Tenda M3 version 1.0.0.124856 Description: A buffer overflow was discovered in the function formSetGuideListItem. Recommendations: For Tenda M3 version 1.0.0.124856, consider disabling the formSetGuideListItem function until a patch is...

PT-2022-24457 · Tenda · Tenda M3

Name of the Vulnerable Software and Affected Versions: Tenda M3 version 1.0.0.124856 Description: A heap buffer overflow issue was found in the function formSetFixTools, allowing attackers to cause a Denial of Service DoS via the MACAddr parameter. Recommendations: For Tenda M3 version...