PT-2022-13961 · Unknown +1 · Krakend-Ce +2

Name of the Vulnerable Software and Affected Versions: Lura versions prior to 2.0.2 KrakenD-CE versions prior to 2.0.2 KrakenD-EE versions prior to 2.0.0 Description: The issue arises from incorrect sanitization of URL parameters, allowing malicious users to alter the backend URL defined for a pi...

PT-2022-23028 · Unknown · Rust-Websocket

Content removed...

PUB-A-214245176

In TBD of TBD, there is a possible out of bounds write due to kernel stack overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

PUB-A-223375145

In v4l2m2mquerybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

PT-2022-3736 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.29 and prior Description: The issue is related to insufficient input validation in the Server: Optimizer component of MySQL Server. It allows a high-privileged attacker with network access via multiple protocols to...

CVE-2022-30242

Honeywell Alerton Ascent Control Module ACM through 2022-05-04 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then implemented. A user with malicious intent can send a crafted packet to change the controller...

Malicious code in ihgyfqjvdnuwtkxk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 260eddb0c6693f62d0209cd63e01d5c2fbe699a1b352d55396b574cae63e3ae7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4196 Malicious code in kmauqkvxzsgifpbj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13bd0d5ed37547a70635cd57a9e6d88220e552bc9eff761922713d585cecd655 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-21784

In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06704526; Issue ID: ALPS06704462...

CVE-2022-21775

In sched driver, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06479032; Issue ID: ALPS06479032...

CVE-2022-31125 Authentication Bypass in Roxy-wi

Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to bypass authentication and access admin functionality by sending a specially crafted HTTP request. This affects Roxywi version...

CVE-2022-31116 Incorrect handling of invalid surrogate pair characters in ujson

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupti...

PT-2022-3296 · Trueconf · Trueconf Server

Name of the Vulnerable Software and Affected Versions: TrueConf Server version 4.3.7 Description: A problematic vulnerability has been found in TrueConf Server, affecting an unknown part of the file /admin/general/change-lang. The manipulation of the redirect url argument leads to an open redirec...

CVE-2022-31098 Weave GitOps leaked cluster credentials into logs on connection errors

Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in the logging of Weave GitOps could allow an authenticated remote attacker to view sensitive cluster configurations, aka KubeConfg, of...

Buy logic is not correct

Lines of code Vulnerability details Impact This will affect the curves from where the buy need to happen. This will lead to erroneous result. Proof of Concept Tools Used Manual calculation and code review Recommended Mitigation Steps Update the Buy logic by referring the sell logic. --- The text...

PT-2022-22067 · Jenkins · Jenkins Stash Branch Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Stash Branch Parameter Plugin versions 0.3.0 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability, which can be exploited by attackers with Item/Configure permission. This occurs because the...

MAL-2022-1549 Malicious code in bfx-reports-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c91401ae4d7bf54dad96d13c79dbe2470122cd840dc7ebc1abef3273f3c26c7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1136 Malicious code in assessment-zmarta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45653801bc7c04da5271fafa815874ed3e90695328e763a6415f729f6de09968 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5371 Malicious code in plugin-svgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1341e5c5e07e1379451f4873b4c4fa7b1d05d4cfbd7444c8484145e2dddca09c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @coinalpha/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4a7704a85626f889573180f8a0f9209011120627ad9c9481261dd65ca9e3d9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...