CVE-2022-20559

CVE-2022-20559 affects Android 13, describing a side-channel disclosure in revokeOwnPermissionsOnKill within PermissionManager.java that may allow an app to be detected as installed without query permissions. The issue results in local information disclosure with no additional execution privilege...

CVE-2022-46609: Undefined Security Weakness

Python3-RESTfulAPI commit d9907f14e9e25dcdb54f5b22252b0e9452e3970e and e772e0beee284c50946e94c54a1d43071ca78b74 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well ...

TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L/E:F/RL:O/RC:C 5.3 Problem Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messag...

Information disclosure

Affected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker to decrypt the contents of the file and retrieve debug information about the system...

CVE-2022-20471

In SendIncDecRestoreCmdPart2 of NxpMfcReader.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-...

PT-2022-5998 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.14 and earlier Description: The issue is related to a reflected Cross-Site Scripting XSS vulnerability. It can be exploited if an attacker convinces a victim to visit a URL referencing a vulnerable page,...

CVE-2022-3881

CVE-2022-3881 concerns the WordPress WPTools plugin, affected versions before 3.43. The issue is improper authorization and CSRF in an AJAX action, allowing any authenticated user (e.g., a subscriber) to install and activate arbitrary plugins from wordpress.org. Root cause: missing CSRF/authoriza...

CVE-2022-3881: Cross-Site Request Forgery (CSRF)

The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and...

PT-2022-27638 · Sens · Sens

Name of the Vulnerable Software and Affected Versions: SENS version 1.0 Description: The issue is related to a file upload vulnerability. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue wa...

GSD-2022-1008239 riscv: process: fix kernel info leakage

riscv: process: fix kernel info leakage This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.267 by commit...

GSD-2022-1008163 riscv: process: fix kernel info leakage

riscv: process: fix kernel info leakage This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.225 by commit...

GSD-2022-1007778 riscv: process: fix kernel info leakage

riscv: process: fix kernel info leakage This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.9 by commit 358a68f98304b40b201ba5afe94c20355aa3dc6...

GSD-2022-1007753 btrfs: zoned: initialize device's zone info for seeding

btrfs: zoned: initialize device's zone info for seeding This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.9 by commit...

CVE-2022-39906

Improper access control vulnerability in SecTelephonyProvider prior to SMR Dec-2022 Release 1 allows attackers to access message information...

PT-2022-36590 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 3.9 through 4.9.333 Description: The issue is related to an infoleak in the vmci host do receive datagram function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2022-36193 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.79 Description: The issue concerns a kernel info leakage in the Linux Kernel process. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...

PT-2022-36048 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.9 Description: The issue is related to an infoleak when sending struct ifaddrlblmsg to the network, specifically affecting the ipv6 addrlabel. The actual impact and attack plausibility have not yet been...

PT-2022-36325 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 4.15 through 5.10.154 Description: The issue concerns a kernel info leakage in the Linux Kernel process. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions 4.15...

PT-2022-36033 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.9 Description: The issue concerns a kernel info leakage in the Linux Kernel process. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...

PT-2022-36283 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 3.9 through 5.10.155 Description: The issue is related to an infoleak in the vmci host do receive datagram function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...