PT-2022-27657 · Opencaching Deutschland · Opencaching Deutschland Oc-Server3

Name of the Vulnerable Software and Affected Versions: Opencaching Deutschland oc-server3 affected versions not specified Description: A problematic vulnerability has been found in Opencaching Deutschland oc-server3, affecting the Cookie Handler component, specifically an unknown part of the file...

PT-2022-11598

Name of the Vulnerable Software and Affected Versions roxlukas LMeve affected versions not specified Description A critical issue was found in the Login Page component of roxlukas LMeve, where the manipulation of the X-Forwarded-For argument leads to sql injection. This issue can be exploited...

CVE-2022-4583 jLEMS JUtil.java unpackJar path traversal

A vulnerability was found in jLEMS. It has been declared as critical. Affected by this vulnerability is the function unpackJar of the file src/main/java/org/lemsml/jlems/io/util/JUtil.java. The manipulation leads to path traversal. The attack can be launched remotely. The name of the patch is...

CVE-2022-4572 UBI Reader UBIFS File output.py ubireader_extract_files path traversal

A vulnerability, which was classified as problematic, has been found in UBI Reader up to 0.8.0. Affected by this issue is the function ubireaderextractfiles of the file ubireader/ubifs/output.py of the component UBIFS File Handler. The manipulation leads to path traversal. The attack may be...

PT-2022-27646 · Unknown · 1J01 Mind-Map

Name of the Vulnerable Software and Affected Versions: 1j01 mind-map affected versions not specified Description: A vulnerability was found in 1j01 mind-map and classified as problematic. This issue affects some unknown processing of the file app.coffee. The manipulation of the argument html lead...

Cross site scripting

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in other users' browsers. This issue affects Apache Zeppelin before 0.8.2. Users are recommended to upgrade to a supported...

recoverTimelock can have a value shorter than the winner's deadline to claim

Lines of code Vulnerability details Impact The value of recoverTimelock is checked to be greater than a week and less than a year, but it should never be allowed to be shorter than block.timestamp + settings.drawBufferTime, which is the time given to the winner to claim the NFT. Otherwise it coul...

PT-2022-14728 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: In the onPreferenceClick method of AccountTypePreferenceLoader.java, there is a possible way to retrieve protected files from the Settings app due to a confused deputy. This could lead to local...

PT-2022-14748 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: A side channel information disclosure issue exists in the WifiManager.java file, specifically in the registerLocalOnlyHotspotSoftApCallback function. This issue could allow an attacker to determine...

PT-2022-14782 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a missing bounds check in the externalOnRequest function of rilapplication.cpp, which could lead to a possible out of bounds write. This might result in local escalation of privilege,...

Function fulfillRandomWords in VRFNFTRandomDraw contract must not revert

Lines of code Vulnerability details The VRFNFTRandomDraw contract implements the Chainlink VFR feature to pull random data to select the raffle winner. As per their security guidelines the implementation of the fulfillRandomWords function must not revert. Impact If the fulfillRandomWords function...

PT-2022-27577 · Inex · Inex Ipx-Manager

Name of the Vulnerable Software and Affected Versions: INEX IPX-Manager versions up to 6.2.0 Description: A vulnerability was found in the file resources/views/customer/list.foil.php, which can lead to cross site scripting. The attack can be initiated remotely. Recommendations: For INEX IPX-Manag...

PT-2022-14725 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to improper input validation in the navigateUpTo function of Task.java, which could allow launching an intent handler with a mismatched intent. This could lead to local escalation ...

PT-2022-27997 · Apache · Apache Zeppelin

Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions prior to 0.8.2 Description: An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' issue allows logged-in users to execute arbitrary javascript in other users' browsers. Recommendations:...

PT-2022-26489 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a missing null check in the cd SsParseMsg function of cd SsCodec.c. This could lead to a crash, resulting in a remote denial of service. No additional execution privileges are needed for...

PT-2022-14731 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to a possible access to restricted tables due to SQL injection in the MmsSmsProvider.java query. This could lead to local information disclosure with User execution privileges...

PT-2022-24554 · Micro Focus · Micro Focus Groupwise Web

Name of the Vulnerable Software and Affected Versions: Micro Focus GroupWise Web versions prior to 18.4.2 Description: A vulnerability has been identified in the GW Web component, which makes a request to the Post Office Agent containing sensitive information in the query parameters. This sensiti...

PT-2022-21577 · Apple · Ios

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 16 Description: An out-of-bounds read issue existed, leading to the disclosure of kernel memory. This issue was addressed with improved input validation. An app may be able to disclose kernel memory. Recommendations: For...

PT-2022-25123 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about a specific vulnerability. It appears to be a notification about a rejected candidate...

PT-2022-27395 · Openemr · Openemr

Name of the Vulnerable Software and Affected Versions: openemr versions prior to 7.0.0.2 Description: The issue concerns an unrestricted upload of a file with a dangerous type in the GitHub repository openemr/openemr. Recommendations: For versions prior to 7.0.0.2, update to version 7.0.0.2 or...