PT-2022-36497 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.265 Description: A potential buffer overflow issue exists in the brcmf fweh event worker function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2022-36557 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.300 Description: A memory leak issue was discovered in the macvlan component of the Linux Kernel. The issue was introduced in version v4.9 and is fixed in version v4.14.300. The actual impact and attack...

PT-2022-36412 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.225 Description: The issue is related to a missing .thaw noirq hook in the serial imx driver. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2022-25102 · Samsung · Samsung Gear Iconx Pc Manager

Name of the Vulnerable Software and Affected Versions: Samsung Gear IconX PC Manager versions prior to 2.1.221019.51 Description: The issue is related to insufficient verification of data authenticity, allowing local attackers to create arbitrary files using symbolic links. This can be exploited ...

python-ujson: improper decoding of escaped surrogate characters may lead to string corruption, key confusion or value overwriting

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupti...

PT-2022-23978 · Ricoh · Aficio Sp 4210N

Name of the Vulnerable Software and Affected Versions: Aficio SP 4210N firmware versions prior to Web Support 1.05 Description: A cross-site scripting issue allows a remote authenticated attacker with administrative privileges to inject an arbitrary script. Recommendations: For Aficio SP 4210N...

PT-2022-27262 · Unknown · Udr-Ja1608 +2

Name of the Vulnerable Software and Affected Versions: UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier Description: The issue allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings. Recommendations: Fo...

PT-2022-27684 · Ilias · Ilias

Name of the Vulnerable Software and Affected Versions: ILIAS versions prior to 7.16 Description: The issue allows for cross-site scripting XSS, which is a type of attack where an attacker can inject malicious scripts into a website. Recommendations: For versions prior to 7.16, update to version...

PT-2022-23355 · Devolutions +1 · Devolutions Remote Desktop Manager +1

Name of the Vulnerable Software and Affected Versions: Devolutions Remote Desktop Manager versions 2022.3.13 through 2022.3.24 Description: The issue allows an authenticated user to spoof a privileged account due to elevation of privilege in the Azure SQL Data Source. Recommendations: For version...

PT-2022-27948 · Jenkins · Jenkins Checkmarx Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Checkmarx Plugin versions 2022.3.3 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the plugin does not escape values returned from the Checkmarx service API before...

Upgraded Q -> M from #366 [1670366212013]

Judge has assessed an item in Issue 366 as M risk. The relevant finding follows: 1. Not support fee-on-transfer tokens Every tokens of credit line will be transferred from lender to LineOfCredit first, then to borrower later. These 2-transfer steps will make the tax for some fee-on-transfer token...

PT-2022-27651 · WordPress · Easy Wp Smtp

Name of the Vulnerable Software and Affected Versions: Easy WP SMTP plugin versions 1.5.1 and earlier Description: The issue is related to an Authenticated Path Traversal vulnerability. There is no information provided about the estimated number of potentially affected devices worldwide or detail...

PT-2022-27330 · Py7Zr +2 · Py7Zr +2

Name of the Vulnerable Software and Affected Versions: py7zr versions 0.20.0 and earlier Description: A directory traversal issue in the SevenZipFile.extractall function allows attackers to write arbitrary files by extracting a crafted 7z file. Recommendations: For py7zr versions 0.20.0 and...

PT-2022-16013 · Python · Random +1

Name of the Vulnerable Software and Affected Versions: Passeo versions prior to 1.0.5 Description: Passeo is an open source python password generator that relies on the python random library for random value selection in versions prior to 1.0.5. The python random library is not suitable for...

PT-2022-27771 · Unknown · Kodexplorer

Name of the Vulnerable Software and Affected Versions: Kodexplorer versions prior to 4.50 Description: Kodexplorer is a Chinese language web-based file manager and browser-based code editor. The issue allows unauthenticated users to request arbitrary files from the host OS file system, making any...

Upgraded Q -> M from #366 [1670366311052]

Judge has assessed an item in Issue 366 as M risk. The relevant finding follows: 5. Cannot cancel mutual consent Mutual consent works by using two TXs with the same msg.data. However, when first one call, there is no way to cancel it. First caller might send wrong msg.data or later caller change...

PT-2022-22087 · WordPress · Advanced Wp Columns

Name of the Vulnerable Software and Affected Versions: Advanced WP Columns WordPress plugin versions 2.0.6 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...

PT-2022-27640 · Unknown · Clicshopping V3

Name of the Vulnerable Software and Affected Versions: ClicShopping V3 version 3.402 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted URL parameter. Recommendations: For ClicShopping V3 version 3.402, update to a version that...

PT-2022-27373 · Unknown · Slims9 Bulian

Name of the Vulnerable Software and Affected Versions: SLiMS 9 Bulian version 9.5.0 Description: A SQL injection issue was found via the keywords parameter. Recommendations: For SLiMS 9 Bulian version 9.5.0, avoid using the keywords parameter until the issue is resolved...

Incorrect behavior in CrossChainExecutorPolygon contract

Lines of code Vulnerability details Description: We have discovered an issue with the CrossChainExecutorPolygon contract. When a message with a nonce that has already been executed is received, the contract does not prevent the message from being processed or display an error message. This issue...