CVE-2022-39301

CVE-2022-39301 concerns sra-admin, a front/back-end separated rights management system. The issue affects version 1.1.1, where a storage cross-site scripting (XSS) vulnerability lies in the Profile Picture Upload under Personal Center. An attacker who logs in could upload an HTML page containing ...

CVE-2022-43044

Removed by vendor...

info-potsdam.de Cross Site Scripting vulnerability OBB-2999954

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GHSA-W596-4WVX-J9J6 Withdrawn Advisory: ReDoS in py library when used with subversion

Withdrawn Advisory This advisory has been withdrawn because evidence does not suggest that CVE-2022-42969 is a valid, reproducible vulnerability. This link is maintained to preserve external references. Original Description The py library through 1.11.0 for Python allows remote attackers to condu...

PYSEC-2022-43183

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS Regular expression Denial of Service attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not bein...

PYSEC-2022-43183

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS Regular expression Denial of Service attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not bein...

UBUNTU-CVE-2022-42969

DISPUTED The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS Regular expression Denial of Service attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as...

DEBIAN-CVE-2022-41674

An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211bssinfoupdate function in net/mac80211/scan.c...

UBUNTU-CVE-2022-41674

An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211bssinfoupdate function in net/mac80211/scan.c...

CVE-2022-38689

In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

[ASA-202210-2] linux: multiple issues

Arch Linux Security Advisory ASA-202210-2 ========================================= Severity: Critical Date : 2022-10-14 CVE-ID : CVE-2022-41674 CVE-2022-42719 CVE-2022-42720 CVE-2022-42721 CVE-2022-42722 Package : linux Type : multiple issues Remote : Yes Link :...

[20221001] - Core - Disclosure of critical information in debug mode

Joomla 4 sites with publicly enabled debug mode exposed data of previous requests...

com.enonic.xp:lib-auth vulnerable to Session Fixation

Impact All id-providers using lib-auth login method. Patches https://github.com/enonic/xp/commit/0189975691e9e6407a9fee87006f730e84f734ff https://github.com/enonic/xp/commit/2abac31cec8679074debc4f1fb69c25930e40842 https://github.com/enonic/xp/commit/1f44674eb9ab3fbab7103e8d08067846e88bace4...

PT-2022-5371 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insufficient access control in the Windows operating system kernel, which can be exploited to elevate privileges in the system. This allows an attacker to affect the...

PT-2022-6515 · Dell · Dell Supportassist For Business Pcs +1

Name of the Vulnerable Software and Affected Versions: Dell SupportAssist for Home PCs versions 3.11.4 and prior Dell SupportAssist for Business PCs versions 3.2.0 and prior Description: The issue is related to an information disclosure vulnerability. A local malicious user with low privileges...

CVE-2022-41043

CVE-2022-41043 is a Microsoft Office Information Disclosure vulnerability. The vulnerability is described with CVSS v3.1 base 3.3 (LOW), attack vector LOCAL, no user interaction, and affects Microsoft Office components (including macOS variants). Connected sources note potential access to authent...

CVE-2022-37996

CVE-2022-37996 is documented as a Windows kernel memory information disclosure vulnerability with a CVSSv3.1 base score of 5.5 (LOCAL attack vector, LOW attack complexity, LOW privileges required, HIGH confidentiality impact). The linked NCSC advisory lists CVE-2022-37996 under Windows NTFS with ...

PT-2022-5444 · Microsoft · Windows Portable Device Enumerator Service +1

Name of the Vulnerable Software and Affected Versions: Windows Portable Device Enumerator Service affected versions not specified Description: The issue is related to the use of a hardcoded cryptographic key in the Windows Portable Device Enumerator Service. This could allow an attacker to bypass...

PT-2022-1379

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.19.16 Description An issue in the Linux kernel allows attackers who can inject WLAN frames to cause a buffer overflow in the ieee80211 bss info update function in net/mac80211/scan.c. This could lead to remote...

PT-2022-20205 · Ibm · Ibm Qradar Siem

Name of the Vulnerable Software and Affected Versions: IBM QRadar SIEM versions 7.4 through 7.5 Description: The issue could disclose sensitive information via a local service to a privileged user. Recommendations: For IBM QRadar SIEM versions 7.4 through 7.5, at the moment, there is no informati...