CVE-2022-31118

Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares a-zA-Z0-9 ^ 15. It is recommended that the Nextcloud Server is upgraded t...

PT-2022-20541 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 22.2.9 Nextcloud Server versions prior to 23.0.6 Nextcloud Server versions prior to 24.0.2 Description: The issue affects Nextcloud server, an open source personal cloud solution. An attacker could brute for...

F5 BIG-IP iControl REST Session Expiration Time Insufficient Vulnerability Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A session expiration time insufficient vulnerability exists in F5 BIG-IP iControl REST, which stems from the fact that after...

F5 BIG-IP 代码问题漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A session expiration time insufficient vulnerability exists in F5 BIG-IP iControl REST, which stems from the fact that after...

PT-2022-9062 · Unknown · Get-Npm-Package-Version

Name of the Vulnerable Software and Affected Versions: get-npm-package-version versions prior to 1.0.7 Description: The issue concerns Command Injection via the main function in index.js. Recommendations: For versions prior to 1.0.7, update to version 1.0.7 or later to resolve the issue. As a...

PT-2022-4511 · Arm · Arm Mali Gpu Kernel Driver

Name of the Vulnerable Software and Affected Versions: Arm Mali GPU Kernel Driver versions Valhall r29p0 through r38p0 Description: A non-privileged user can make improper GPU processing operations to gain access to already freed memory. The issue is caused by a buffer overflow in memory, which c...

PT-2022-20601 · Dspace · Dspace

Name of the Vulnerable Software and Affected Versions: DSpace versions prior to 5.11 DSpace versions prior to 6.4 Description: The JSPUI "Request a Copy" feature does not properly escape values submitted and stored from the "Request a Copy" form, making item requests vulnerable to XSS attacks. Th...

Flarum 安全漏洞

Flarum is an open source forum system for the Flarum community. A security vulnerability exists in Flarum's Byobu extension prior to version 1.1.7, which stems from the fact that Byobu is a private discussion extension for the Flarum forums, and the affected version was found to not allow private...

PT-2022-4902 · NetGear · Netgear Nighthawk Ac1900 Smart Wifi Dual Band Gigabit Router

Name of the Vulnerable Software and Affected Versions: Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router version R7000-V1.0.11.134 10.2.119 Description: The issue is related to a buffer overflow vulnerability caused by the strncpy function in the wl binary of the firmware. This...

GSD-2022-1004310 netfs: gcc-12: temporarily disable '-Wattribute-warning' for now

netfs: gcc-12: temporarily disable '-Wattribute-warning' for now This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.6 by commit...

GSD-2022-1004247 mm/memory-failure: disable unpoison once hw error happens

mm/memory-failure: disable unpoison once hw error happens This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.8 by commit...

GHSA-G86G-CHM8-7R2P check-spelling workflow vulnerable to token leakage via symlink attack

Impact For a repository with the check-spelling action enabled that triggers on pullrequesttarget or schedule, an attacker can send a crafted Pull Request that causes a GITHUBTOKEN to be exposed. With the GITHUBTOKEN, it's possible to push commits to the repository bypassing standard approval...

PT-2022-23964 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader version 11.2.2.53575 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. Th...

PT-2022-23959 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader version 11.2.1.53537 Description: This issue allows remote attackers to disclose sensitive information on affected installations. User interaction is required to exploit this issue, where the target must visit a malicious pag...

PT-2022-22934 · Unknown · Velociraptor

Name of the Vulnerable Software and Affected Versions: Velociraptor versions prior to 0.6.5-2 Description: The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. This field was not properly sanitized and can lead to...

PT-2022-23605 · Png2Webp · Png2Webp

Name of the Vulnerable Software and Affected Versions: png2webp version 1.0.4 Description: The issue is related to an out-of-bounds write via the function w2p. This can be exploited through a crafted png file. Recommendations: For png2webp version 1.0.4, consider disabling the w2p function until ...

PT-2022-4008 · Jenkins · Jenkins Buckminster Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Buckminster Plugin versions 1.1.1 and earlier Description: The issue is related to insufficient authorization procedures in the Jenkins Buckminster Plugin, allowing remote attackers with Overall/Read permission to gain unauthorized...

PT-2022-4024 · Jenkins · Jenkins Coverity Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Coverity Plugin versions 1.11.4 and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturing credentials stor...

PT-2022-4012 · Jenkins · Jenkins Openstack Heat Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Openstack Heat Plugin versions 1.5 and earlier Description: The issue is related to insufficient authorization procedures in the Jenkins Openstack Heat Plugin, allowing a remote attacker to perform URL redirection. A missing permissio...

PT-2022-5099 · Jenkins · Jenkins Openshift Deployer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins OpenShift Deployer Plugin versions 1.2.0 and earlier Description: A missing permission check in the Jenkins OpenShift Deployer Plugin allows attackers with Overall/Read permission to check for the existence of an attacker-specified fi...