PT-2022-16977 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader version 11.1.0.52543 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. Th...

PT-2022-16154 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.8.1 Discourse version 2.9.0.beta2 Description: The issue allows users to trigger a Denial of Service attack by posting a streaming URL. Parsing Oneboxes in the background job triggers an infinite loop, which caus...

PT-2022-17145 · Jenkins · Jenkins Dbcharts Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins dbCharts Plugin versions 0.5.2 and earlier Description: A missing check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified database via JDBC using attacker-specified credentials...

PT-2022-1945

Name of the Vulnerable Software and Affected Versions TP-LINK TL-WR840NES version V6.20 180709 Description The issue is related to a remote code execution vulnerability via the function oal wan6 setIpAddr. This vulnerability is associated with the lack of neutralization of special elements when...

PT-2022-2569

Name of the Vulnerable Software and Affected Versions: Apache APISIX versions 2.12.1 Description: The issue concerns an authentication bypass vulnerability in Apache APISIX, where an attacker can exploit the batch-requests plugin to send requests and bypass the IP restriction of the Admin API. Th...

PT-2022-5106 · Moxa · Moxa Mxview

Name of the Vulnerable Software and Affected Versions: Moxa MXView version 3.2.4 Description: The issue is related to the use of hardcoded credentials in the web interface of Moxa MXView, allowing a remote attacker to gain full access to the device by sending a specially crafted HTTP request. Thi...

UBUNTU-CVE-2022-23630

Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This occurs when dependency verification is disabled ...

PT-2022-15929 · Xmpie · Xmpie Ustore

Name of the Vulnerable Software and Affected Versions: XMPie UStore version 12.3.7244.0 Description: A persistent cross-site scripting XSS issue exists in the administrative panel when editing users, specifically affecting two input fields. Recommendations: For version 12.3.7244.0, consider...

DoS vulnerability in bundled XStream library

Jenkins 2.333 and earlier, LTS 2.319.2 and earlier is affected by the XStream library's vulnerability https://x-stream.github.io/CVE-2021-43859.htmlCVE-2021-43859. This library is used by Jenkins to serialize and deserialize various XML files, like global and job config.xml, build.xml, and numero...

SQLRecon - A C# MS SQL Toolkit Designed For Offensive Reconnaissance And Post-Exploitation

A C MS-SQL toolkit designed for offensive reconnaissance and post-exploitation. For detailed usage information on each technique, refer to the wiki. Usage You can grab a copy of SQLRecon from the releases page. Alternatively, feel free to compile the solution yourself This should be as straight...

PT-2022-2575 · Twig +3 · Twig +3

Name of the Vulnerable Software and Affected Versions: Twig versions prior to the patched version Description: The issue arises from the lack of proper enforcement of the constraint that the arrow parameter of the sort filter must be a closure when in sandbox mode. This could lead to code injecti...

PT-2022-12382 · Totolink · Totolink A720R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A720R version 4.1.5cu.470 B20200911 Description: A stack overflow was discovered in the setWiFiWpsStart function, allowing attackers to cause a Denial of Service DoS via the pin parameter. Recommendations: For TOTOLINK A720R version...

CLSA-2022-1643918500 Fix of CVE: CVE-2022-23305

CVE-2022-23305: disable JDBCAppender by default. Add optional parameter for enabling it...

CLSA-2022-1643918279 Fixed CVE-2022-23305 in log4j

CVE-2022-23305: disable JDBCAppender by default. Add optional parameter for enabling it...

cryptsetup: disable encryption via header rewrite

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that...

PT-2022-16546

Name of the Vulnerable Software and Affected Versions AtomCMS version 2.0 Description A SQL injection issue was discovered in AtomCMS via the /admin/login.php endpoint. This allows for potential exploitation. Recommendations For AtomCMS version 2.0, consider disabling access to the /admin/login.p...

PT-2022-16536 · Itext · Itext

Name of the Vulnerable Software and Affected Versions: iText version 7.1.17 Description: The issue allows attackers to cause a Denial of Service DoS via a crafted PDF file, exploiting an out-of-bounds exception in the ARCFOUREncryption.encryptARCFOUR component. The vendor does not view this as a...

UBUNTU-CVE-2022-21720

GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the Entities update right prevents exploitation...

PT-2022-12752 · Jsish · Jsish

Name of the Vulnerable Software and Affected Versions: Jsish version 3.5.0 Description: A stack overflow issue was discovered in Jsish via the Jsi LogMsg function at src/jsiUtils.c. Recommendations: For Jsish version 3.5.0, consider disabling the Jsi LogMsg function as a temporary workaround unti...

PT-2022-1462 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 9.5.7 Description: The issue is related to a lack of protection against SQL query structure exploitation, allowing a remote attacker to execute arbitrary SQL queries. An entity administrator can retrieve normally...