PT-2022-5479 · Corel · Coreldraw Graphics Suite

Name of the Vulnerable Software and Affected Versions: Corel CorelDRAW Graphics Suite version 23.5.0.506 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a...

PT-2022-5474 · Corel · Coreldraw Graphics Suite

Name of the Vulnerable Software and Affected Versions: CorelDRAW Graphics Suite version 23.5.0.506 Description: The issue is related to a read past the end of an allocated object when parsing GIF images, which can allow an attacker to disclose sensitive information. This can be exploited by openi...

PT-2022-5416 · Corel · Coreldraw Graphics Suite

Name of the Vulnerable Software and Affected Versions: Corel CorelDRAW Graphics Suite version 23.5.0.506 Description: This issue allows remote attackers to disclose sensitive information on affected installations. User interaction is required to exploit this, where the target must visit a malicio...

PT-2022-15775 · Nginx · Nginx Controller Api Management

Name of the Vulnerable Software and Affected Versions: NGINX Controller API Management versions 3.18.0 through 3.19.0 Description: An authenticated attacker with access to the user or admin role can use undisclosed API endpoints on NGINX Controller API Management to inject JavaScript code that is...

CVE-2021-24906

The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users to disable the plugin and therefore the protection offered via a crafted request...

PT-2022-9502 · WordPress · Protect Wp Admin

Name of the Vulnerable Software and Affected Versions: Protect WP Admin WordPress plugin versions prior to 3.6.2 Description: The issue concerns a lack of authorization check in the lib/pwa-deactivate.php file, potentially allowing unauthenticated users to disable the plugin through a crafted...

WordPress plugin 访问控制错误漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. An access control error vulnerability exists in versions of Wordpress Plugin Protect WP Admin prior to...

PT-2022-7696 · Npm · @Marp-Team/Marp-Core

Name of the Vulnerable Software and Affected Versions: @marp-team/marp-core versions 3.0.2 through 3.9.0 @marp-team/marp-core version 4.0.0 Description: The issue is related to cross-site scripting XSS due to improper neutralization of HTML sanitization. This can allow an attacker to conduct...

PT-2022-4889 · Twisted +4 · Twisted +4

Name of the Vulnerable Software and Affected Versions: Twisted affected versions not specified Description: The issue is related to the exposure of cookies and authorization headers when following cross-origin redirects. This problem is present in the twisted.web.RedirectAgent and...

Authentication flaw

USBView 2.1 before 2.2 allows some local users e.g., ones logged in via SSH to execute arbitrary code as root because certain Polkit settings e.g., allowany=yes for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu,...

PT-2022-7549 · Hdf5 +2 · Hdf5 +2

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.13.1-1 Description: The issue is related to an untrusted pointer dereference vulnerability in the function H5O dtype decode helper at hdf5/src/H5Odtype.c in the HDF5 library. This vulnerability can lead to a Denial of Service D...

CVE-2022-22164

An Improper Initialization vulnerability in Juniper Networks Junos OS Evolved may cause a commit operation for disabling the telnet service to not take effect as expected, resulting in the telnet service staying enabled. When it is not intended to be operating on the device, an administrator can...

PYSEC-2022-13

Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that ...

CVE-2022-21683 Comment reply notifications sent to incorrect users in wagtail

Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that ...

PT-2022-12507 · Gnu +3 · Gnu Recutils +3

Name of the Vulnerable Software and Affected Versions: GNU Recutils version 1.8.90 Description: The issue is related to an Use-After-Free vulnerability in the rec record destroy function at rec-record.c. This vulnerability can lead to a segmentation fault or application crash. Recommendations: Fo...

PT-2022-12393 · Gpac · Gpac

Name of the Vulnerable Software and Affected Versions: GPAC version 1.1.0 Description: The issue is related to an invalid call in the gf node changed function, which can lead to a Denial of Service DoS. Recommendations: For GPAC version 1.1.0, consider disabling the gf node changed function as a...

PT-2022-12508 · Gnu +3 · Gnu Recutils +3

Name of the Vulnerable Software and Affected Versions: GNU Recutils version 1.8.90 Description: The issue is related to an Use-After-Free vulnerability in the rec mset elem destroy function at rec-mset.c. This vulnerability can lead to a segmentation fault or application crash. Recommendations: F...

Some Android users can disable 2G now and why that is a good thing

The Electronic Frontier Foundation EFF has happily informed people that Google has quietly pushed a new feature to its Android operating system allowing users to optionally disable 2G at the modem level in their phones. This is beneficial because 2G uses weak encryption between the tower and devi...

CVE-2021-4122

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that...

PT-2022-15861 · Jenkins · Jenkins Debian Package Builder Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Debian Package Builder Plugin versions 1.6.11 and earlier Description: The issue allows agents to invoke command-line git at an attacker-specified path on the controller. This enables attackers who can control agent processes to invok...