Pterodactyl vulnerable to 2FA Sniffing

Pterodactyl version 0.7.13 and lower - 2FA Sniffing Users who have enabled 2FA protections on their account can unintentionally have their account's existence sniffed by malicious users who enter random credentials into the login fields. Impact Users who have enabled 2FA protections on their...

GHSA-FG52-XJFC-9RH8 Pterodactyl vulnerable to 2FA Sniffing

Pterodactyl version 0.7.13 and lower - 2FA Sniffing Users who have enabled 2FA protections on their account can unintentionally have their account's existence sniffed by malicious users who enter random credentials into the login fields. Impact Users who have enabled 2FA protections on their...

Persistent XSS vulnerability in Jenkins DRY Plugin

The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to this plugin could insert arbitrary HTML into this view...

KLA12532 Elevation of privilege in Microsoft Products (ESU)

Elevation of privilege was found in Microsoft Products Extended Security Update. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2022-30138 Related products Microsoft-Windows Microsoft-Windows-Server Microsoft-Windows-7 Microsoft-Windows-Server-2008 CVE...

KLA12533 Elevation of privilege in Microsoft Windows

Elevation of privilege vulnerability was found in Microsoft Windows. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2022-30138 Related products Microsoft-Windows Microsoft-Windows-Server Microsoft-Windows-Server-2012 Microsoft-Windows-8 Windows-RT...

KLA12527 Elevation of privilege vulnerability in Microsoft Server Software

Elevation of privilege vulnerability was found in Microsoft Server Software. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2022-21978 Related products Microsoft-Exchange-Server CVE list CVE-2022-21978 critical KB list 5014261 5014260 Solution Install...

KLA12534 RCE vulnerability in Microsoft Azure

A remote code execution vulnerability was found in Microsoft Azure. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2022-29972 ADV220001 Related products Microsoft-Azure CVE list CVE-2022-29972 unknown Solution Install necessary updates from the K...

GHSA-HX8W-GHH8-R4XF Write access to the catalog for any user when restricted-admin role is enabled in Rancher

Impact This vulnerability only affects customers using the restricted-admin role in Rancher. For this role to be active, Rancher must be bootstrapped with the environment variable CATTLERESTRICTEDDEFAULTADMIN=true or the configuration flag restrictedAdmin=true. A flaw was discovered in Rancher...

Path traversal

Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system...

KLA12513 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, gain privileges, bypass security restrictions. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in BFCache ca...

KLA12514 PE vulnerability in 7-Zip

Privilege escalation vulnerability was found in 7-Zip. Malicious users can exploit this vulnerability to gain privileges and execute arbitrary code by dragging and dropping file with the .7z extension to the HelpContents area.The vulnerability announced in version 21.07 and disputed by vendor...

KLA12510 Spoofing vulnerability in Microsoft SQL Server

A spoofing vulnerability was found in Microsoft SQL Server. Malicious users can exploit this vulnerability to spoof user interface. Original advisories CVE-2022-23292 Related products Microsoft-Power-BI CVE list CVE-2022-23292 warning KB list Solution Install necessary updates from the KB section...

KLA12504 Remote code execution vulnerability in Microsoft Dynamics

A remote code execution vulnerability was found in Microsoft Dynamics 365. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2022-23259 Related products Microsoft-Dynamics-365 CVE list CVE-2022-23259 critical KB list 5012731 5012732 Solution Install...

KLA12511 Remote code execution vulnerability in Windows Apps

Remote code execution vulnerability was found in Microsoft Apps. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2022-26903 Related products Microsoft-Excel Microsoft-Word CVE list CVE-2022-26903 critical KB list Solution Install necessary updates...

KLA19263 OSI vulnerability in Apache Tomcat

Information disclosure vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories Apache Tomcat 10.x vulnerabilities Apache Tomcat 9.x vulnerabilities Apache Tomcat 8.x vulnerabilities Related products Apache-Tomca...

KLA12492 Type Confusion vulnerability in Microsoft Browser

Type Confusion vulnerability in Microsoft Browser. Malicious users can exploit this vulnerability to execute arbitrary code, cause denial of service. Original advisories CVE-2022-1096 Exploitation Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details...

CVE-2022-24781 Malicious users can take over the session of other players

Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through the browser console and become co-owners of the target session. This issue is patched in version 1.1.0. No known workaround exists...

CVE-2021-44631

A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloudconfig/routerpost/resetcloudpwd feature, which allows malicous users to execute arbitrary code on the system via a crafted post request...

Spoofing

Dell BSAFE SSL-J contains remediation for a covert timing channel vulnerability that may be exploited by malicious users to compromise the affected system. Only customers with active BSAFE maintenance contracts can receive details about this vulnerability. Public disclosure of the vulnerability...

KLA12465 Security vulnerability in LibreOffice

Security vulnerability was found in LibreOffice. Malicious users can exploit this vulnerability to bypass security restrictions. Original advisories Incorrect trust validation of signature with ambiguous KeyInfo children Related products LibreOffice CVE list CVE-2021-25636 critical Solution Updat...