PT-2025-8010

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.17.0-rc8+ Description A use-after-free issue has been identified in the Linux kernel, specifically in the mpt3sas driver. The function mpt3sas transport port remove frees the port field of the sas expander...

CVE-2022-26980

Teampass 2.1.26 allows reflected XSS via the index.php PATHINFO...

PT-2022-18159

Name of the Vulnerable Software and Affected Versions Teampass version 2.1.26 Description The issue allows for reflected XSS via the "index.php" PATH INFO. This can be exploited when someone opens a link to the Teampass Password Manager index page that contains a malicious payload. Recommendation...

Teampass Cross-Site Script Vulnerability

TeamPass is an open source password manager from the individual developer NILS LAUMAILLÉ Nils Laumaillé. A security vulnerability exists in Teampass 2.1.26, which can be exploited by an attacker via index.php PATHINFO...

CVE-2021-4203

A use-after-free read flaw was found in sockgetsockopt in net/core/sock.c due to SOPEERCRED and SOPEERGROUPS race with listen and connect in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information...

VulnCheck KEV: CVE-2015-3035

Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. dot dot in the PATHINFO to login/...

Jenkins Matrix Project Plugin Remote Code Execution Vulnerability

Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution...

CVE-2022-26249

Survey King v0.3.0 does not filter data properly when exporting excel files, allowing attackers to execute arbitrary code or access sensitive information via a CSV injection attack...

CVE-2022-27081

Tenda M3 1.10 V1.0.0.124856 was discovered to contain a command injection vulnerability via the component /goform/SetLanInfo...

CVE-2022-27082

Tenda M3 1.10 V1.0.0.124856 was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo...

CVE-2022-27082

Tenda M3 1.10 V1.0.0.124856 was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo...

CVE-2022-24291

CVE-2022-24291 affects Certain HP Print devices, enabling potential information disclosure, denial of service, or remote code execution. Public sources in the connected set confirm HP printer families and models are affected and note a firmware remediation path. HP’s advisory HPSBPI03781 document...

CVE-2022-0861

creationtimestamp| type| source ---|---|--- 2022-03-23 17:28:41+00:00| seen| https://t.me/cibsecurity/39411...

xml-security: XPath Transform abuse allows for information disclosure

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any...

Unconstrained Delegation

Microsoft to support scenarios where users authenticate via Kerberos to one system and information needs to be updated on another system implemented unconstrained delegation. This… Continue reading - Unconstrained Delegation...

Rocket.Chat: Rocket.chat user info security issue

Hello, We have find potential security issue that user with “view-full-other-user-info” permissions is able to view another user's OAuth tokens via Rest API. Tested on Rocket.Chat version 4.3.3 Steps to reproduce: 1. Integration with OAuth 2.0 identity provider e.g. Keycloak is required 1. Add ro...

PT-2022-17318

Name of the Vulnerable Software and Affected Versions: ThinkPHP Framework version 5.0.24 Description: The ThinkPHP Framework was discovered to be configured without the PATHINFO parameter, allowing attackers to access all system environment parameters from index.php. It is noted that this issue i...

CVE-2022-25452

Tenda AC6 v15.03.05.09multi was discovered to contain a stack overflow via the URLs parameter in the saveParentControlInfo function...

DEBIAN-CVE-2022-24773

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that...

DEBIAN-CVE-2022-24772

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed an...