PT-2022-23198 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 10.4.32 TYPO3 versions prior to 11.5.16 Description: The f:asset.css view helper in TYPO3 is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Recommendations: Update to TYPO3 versio...

PT-2022-23756 · Mendix · Mendix Saml

Name of the Vulnerable Software and Affected Versions: Mendix SAML Mendix 7 compatible versions prior to V1.17.0 Mendix SAML Mendix 8 compatible versions prior to V2.3.0 Mendix SAML Mendix 9 compatible, New Track versions prior to V3.3.1 Mendix SAML Mendix 9 compatible, Upgrade Track versions pri...

PT-2022-24344 · Unknown · Slims Senayan Library Management System

Name of the Vulnerable Software and Affected Versions: SLiMS Senayan Library Management System version 9.4.2 Description: The issue concerns multiple Server-Side Request Forgeries in the SLiMS Senayan Library Management System. The components /bibliography/marcsru.php and /bibliography/z3950sru.p...

PT-2022-24496 · Unknown · Markdown-Nice

Name of the Vulnerable Software and Affected Versions: Markdown-Nice version 1.8.22 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Community Posting field. Recommendations: For Markdown-Nice version...

PT-2022-6098 · Pdfkit · Pdfkit

Name of the Vulnerable Software and Affected Versions: pdfkit versions 0.0.0 through 0.8.7.2 Description: The issue is related to insufficient argument checking in the pdfkit library, which can be exploited by a remote attacker to execute arbitrary commands. This is a Command Injection...

How to Disable Oracle Processing Without Disabling Application-Aware Processing

Purpose This article documents how to disable the processing of Oracle instances by Application-Aware Processing without disabling Application-Aware Processing processing for other applications running on the same machine. Solution Disable Oracle Processing for a VM Protected by Veeam Backup &...

PT-2022-23667 · Samsung · Libsdkrecognitiontext.Spensdk.Samsung.So

Name of the Vulnerable Software and Affected Versions: libSDKRecognitionText.spensdk.samsung.so library versions prior to SMR Sep-2022 Release 1 Description: A heap-based overflow vulnerability in the GetCorrectDbLanguageTypeEsPKc function allows an attacker to cause a memory access fault...

PT-2022-24322 · Unknown · School Activity Updates With Sms Notification

Name of the Vulnerable Software and Affected Versions: School Activity Updates with SMS Notification version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the /modules/user/index.php?view=edit&id= component. The id parameter is...

PT-2022-17601 · Google · Jib-Core

Name of the Vulnerable Software and Affected Versions: com.google.cloud.tools:jib-core versions prior to 0.22.0 Description: The issue allows for Remote Code Execution RCE via the isDockerInstalled function, due to attempting to execute input. Recommendations: For versions prior to 0.22.0, update...

DEBIAN-CVE-2022-36083

JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c PBES2 Count, which determine...

PT-2022-24362 · Tenda · Tenda Ac18

Name of the Vulnerable Software and Affected Versions: Tenda AC18 router versions 15.03.05.05 through 15.03.05.19 Description: A stack overflow issue was discovered via the time parameter at the "/goform/PowerSaveSet" API endpoint. Recommendations: For versions 15.03.05.05 through 15.03.05.19,...

PT-2022-23489 · Tenda · Tenda G3

Name of the Vulnerable Software and Affected Versions: Tenda G3 version US G3V3.0br V15.11.0.67663 EN TDE Description: The issue is caused by a buffer overflow in the addDhcpRule function due to sscanf in the httpd binary. Recommendations: For Tenda G3 version US G3V3.0br V15.11.0.67663 EN TDE, a...

PT-2022-24053 · Ftcms · Ftcms

Name of the Vulnerable Software and Affected Versions: ftcms version 2.1 Description: The issue allows an attacker to insert malicious JavaScript code into the web page, causing the user or administrator to trigger malicious code when accessing. This is a result of a XSS vulnerability in the...

PT-2022-4702 · Cognex · Cognex 3D-A1000 Dimensioning System

Name of the Vulnerable Software and Affected Versions: Cognex 3D-A1000 Dimensioning System versions 1.0.3 3354 and prior Description: The issue is related to the implementation of security functions on the client-side of the Cognex 3D-A1000 Dimensioning System. This could allow a remote attacker ...

PT-2022-23488 · Tenda · Tenda G3

Name of the Vulnerable Software and Affected Versions: Tenda G3 version US G3V3.0br V15.11.0.67663 EN TDE Description: The issue is caused by a buffer overflow in the getsinglepppuser function due to sscanf. Recommendations: For Tenda G3 version US G3V3.0br V15.11.0.67663 EN TDE, as a temporary...

PT-2022-24109 · Totolink · Totolink A860R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A860R version 4.1.2cu.5182 B20201027 Description: The issue is related to a buffer overflow vulnerability in the main function of the downloadfile.cgi. Recommendations: For TOTOLINK A860R version 4.1.2cu.5182 B20201027, consider...

PT-2022-6254 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux Kernel version 6.0-rc2 Description: The issue is related to the use of memory after it has been freed, specifically within the nft osf eval function. This can allow an attacker to disclose sensitive information on affected installations...

PowerCMS XMLRPC API vulnerable to command injection

Overview PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability CWE-74. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. According to the...

PT-2022-23527 · Unknown · Pkuvcl Davs2

Name of the Vulnerable Software and Affected Versions: PKUVCL davs2 version 1.6.205 Description: A global buffer overflow was discovered in the parse sequence header function at source/common/header.cc:269. This issue affects the specified version of PKUVCL davs2. Recommendations: For PKUVCL davs...

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium such as a flash disk could use this flaw to force a user into permanently disabling the encryption layer of that medium.

...