PT-2022-23285

Name of the Vulnerable Software and Affected Versions Airspan AirSpot 5410 versions 0.3.4.1-4 and under Description The issue concerns an unauthenticated remote command injection vulnerability. It allows the ping functionality to be called without user authentication by crafting a malicious HTTP...

kernel security and bug fix update

4.18.0-372.19.1.0.16.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32...

PT-2022-22864 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad version 5.2.0 Description: The issue allows an attacker to manipulate the rate limiting in the 'forgot password' feature, enabling them to send numerous requests for a known account. This can cause Denial Of Service due to the generati...

GHSA-6GJM-6WJ6-4PX5 Byobu user preference to prevent private discussions being started are not respected

Impact Users electing to prevent others starting private discussions with themselves. Please note that admins and others with appropriate permissions can always bypass this preference, as was the case before. Patches Users of Byobu should update the extension to version 1.1.7, where this has been...

PT-2022-23983 · Uniwill · Sparkio.Sys

Name of the Vulnerable Software and Affected Versions: Uniwill SparkIO.sys driver version 1.0 Description: The issue is related to a stack-based buffer overflow in the Uniwill SparkIO.sys driver. This overflow can be triggered via IOCTL 0x40002008. Recommendations: For Uniwill SparkIO.sys driver...

PT-2022-16420 · Tcl · Tcl Linkhub Mesh Wi-Fi

Name of the Vulnerable Software and Affected Versions: TCL LinkHub Mesh Wi-Fi MS1G 00 01.00 14 Description: A buffer overflow issue exists in the GetValue functionality. This can be triggered by a specially-crafted configuration value, allowing an attacker to modify the configuration and cause a...

PT-2022-14910 · Npm · @Acrontum/Filesystem-Template

Name of the Vulnerable Software and Affected Versions: @acrontum/filesystem-template versions prior to 0.0.2 Description: The issue is related to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input. This allows for potential command...

PT-2022-19150 · Unknown +1 · Freshtomato +1

Name of the Vulnerable Software and Affected Versions: FreshTomato version 2022.1 Description: A memory corruption issue exists in the httpd unescape functionality. This can be triggered by a specially-crafted HTTP request, leading to memory corruption. An attacker can exploit this by sending a...

CVE-2022-31118

Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares a-zA-Z0-9 ^ 15. It is recommended that the Nextcloud Server is upgraded t...

PT-2022-20541 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 22.2.9 Nextcloud Server versions prior to 23.0.6 Nextcloud Server versions prior to 24.0.2 Description: The issue affects Nextcloud server, an open source personal cloud solution. An attacker could brute for...

F5 BIG-IP iControl REST Session Expiration Time Insufficient Vulnerability Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A session expiration time insufficient vulnerability exists in F5 BIG-IP iControl REST, which stems from the fact that after...

F5 BIG-IP 代码问题漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A session expiration time insufficient vulnerability exists in F5 BIG-IP iControl REST, which stems from the fact that after...

PT-2022-4511 · Arm · Arm Mali Gpu Kernel Driver

Name of the Vulnerable Software and Affected Versions: Arm Mali GPU Kernel Driver versions Valhall r29p0 through r38p0 Description: A non-privileged user can make improper GPU processing operations to gain access to already freed memory. The issue is caused by a buffer overflow in memory, which c...

PT-2022-9062 · Unknown · Get-Npm-Package-Version

Name of the Vulnerable Software and Affected Versions: get-npm-package-version versions prior to 1.0.7 Description: The issue concerns Command Injection via the main function in index.js. Recommendations: For versions prior to 1.0.7, update to version 1.0.7 or later to resolve the issue. As a...

PT-2022-20601 · Dspace · Dspace

Name of the Vulnerable Software and Affected Versions: DSpace versions prior to 5.11 DSpace versions prior to 6.4 Description: The JSPUI "Request a Copy" feature does not properly escape values submitted and stored from the "Request a Copy" form, making item requests vulnerable to XSS attacks. Th...

Flarum 安全漏洞

Flarum is an open source forum system for the Flarum community. A security vulnerability exists in Flarum's Byobu extension prior to version 1.1.7, which stems from the fact that Byobu is a private discussion extension for the Flarum forums, and the affected version was found to not allow private...

PT-2022-4902 · NetGear · Netgear Nighthawk Ac1900 Smart Wifi Dual Band Gigabit Router

Name of the Vulnerable Software and Affected Versions: Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router version R7000-V1.0.11.134 10.2.119 Description: The issue is related to a buffer overflow vulnerability caused by the strncpy function in the wl binary of the firmware. This...

GSD-2022-1004310 netfs: gcc-12: temporarily disable '-Wattribute-warning' for now

netfs: gcc-12: temporarily disable '-Wattribute-warning' for now This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.6 by commit...

GSD-2022-1004247 mm/memory-failure: disable unpoison once hw error happens

mm/memory-failure: disable unpoison once hw error happens This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.8 by commit...

GHSA-G86G-CHM8-7R2P check-spelling workflow vulnerable to token leakage via symlink attack

Impact For a repository with the check-spelling action enabled that triggers on pullrequesttarget or schedule, an attacker can send a crafted Pull Request that causes a GITHUBTOKEN to be exposed. With the GITHUBTOKEN, it's possible to push commits to the repository bypassing standard approval...