PT-2022-27431 · Unknown · Jeecg-Boot

Name of the Vulnerable Software and Affected Versions: Jeecg-boot version 3.4.3 Description: A SQL injection issue was found in Jeecg-boot via the component /sys/dict/queryTableData. This allows for potential SQL injection attacks. Recommendations: For Jeecg-boot version 3.4.3, as a temporary...

PT-2022-26171

Content removed...

PT-2022-26459 · Unknown · Api2Cart Bridge Connector

Name of the Vulnerable Software and Affected Versions: Api2Cart Bridge Connector plugin version 1.1.0 and earlier Description: The issue is related to an Arbitrary Code Execution vulnerability. Recommendations: For Api2Cart Bridge Connector plugin version 1.1.0 and earlier, update to a version...

PT-2022-27290 · Unknown · Chameleon Plugin

Name of the Vulnerable Software and Affected Versions: Chameleon plugin versions 1.4.3 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability requires authentication with admin or higher privileges. The estimated number of potentially...

CVE-2022-43968

Concrete CMS formerly concrete5 below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the dashboard icons due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+...

PT-2022-35036 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: A potential security issue exists due to a race in lowcomms. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to v6.0.3,...

PT-2022-35060 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to some leaks in the probe function of the dwc3 core in the Linux Kernel's USB component. The actual impact and attack plausibility have not yet been proven...

Design/Logic Flaw

In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way to bypass user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Produc...

CVE-2022-32616

In isp, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07341258; Issue ID: ALPS07341258...

Out-of-bounds

In aee, there is a possible use after free due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07202891; Issue ID: ALPS07202891...

PT-2022-37582 · FFmpeg · Ffmpeg

Name of the Vulnerable Software and Affected Versions: ffmpeg versions prior to 4.3.5 Description: This issue concerns several security vulnerabilities and bugs in ffmpeg. The vulnerabilities were corrected upstream. Recommendations: For versions prior to 4.3.5, update to version 4.3.5 to resolve...

CVE-2022-32601

In telephony, there is a possible permission bypass due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07319132; Issue ID: ALPS07319132...

PT-2022-26457 · WordPress · All In One Seo Pro

Name of the Vulnerable Software and Affected Versions: All in One SEO Pro plugin versions = 4.2.5.1 Description: The issue is related to a Server Side Request Forgery SSRF vulnerability. This type of vulnerability allows an attacker to trick the server into making requests to unintended locations...

PUB-A-239556260

In TBD of TBD, there is a possible way to redirect code execution due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

PUB-A-239555070

In TBD of TBD, there is a possible way to corrupt memory due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

PT-2022-27103 · Lodepng · Lodepng

Name of the Vulnerable Software and Affected Versions: Lodepng version 20220717 Description: A segmentation fault was discovered in the function pngdetail. Recommendations: For version 20220717, consider disabling the pngdetail function until a patch is available...

OESA-2022-2033 kernel security update

Security Fixes: In ioidentitycow of iouring.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndro...

CVE-2022-26884 Apache DolphinScheduler exposes files without authentication

Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher...

CVE-2022-3649

A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfsnewinode of the file fs/nilfs2/inode.c of the component BPF. The manipulation leads to use after free. It is possible to launch the attack remotely. It is recommended to apply a patch t...

Security Bulletin: IBM Sterling Order Management migration strategy to Apache Log4j vulnerability (see CVEs below)

Summary Apache Log4j is used by IBM Sterling Order Management as part of its logging utility and we strongly recommend upgrading to the latest supported version of log4j that was released as part of the latest FixPack. Vulnerability Details CVEID:CVE-2020-9488 DESCRIPTION: Apache Log4j is...