PT-2022-27411 · Plesk · Plesk Obsidian

Name of the Vulnerable Software and Affected Versions: Plesk Obsidian Description: The issue allows a CSRF attack, for example, via the "/api/v2/cli/commands" REST API to change an Admin password. This affects Plesk Obsidian, which is a specific version of the Plesk product where versions are...

CVE-2022-39395

CVE-2022-39395 : Vela’s default configuration allows container breakout in Vela Server/Worker (pre-0.16.0) and Vela UI (pre-0.17.0). Upgrading to Server 0.16.0, Worker 0.16.0, and UI 0.17.0 is required to fix the issue; after patching, admins must explicitly adjust defaults to their desired confi...

PT-2022-7336

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.83, 9.0.40 through 9.0.68, 10.1.0-M1 through 10.1.1 Description The issue is related to the JsonErrorReportValve in Apache Tomcat, which does not properly escape the type, message, or description values. These values...

PT-2022-26846 · Feehicms · Feehicms

Name of the Vulnerable Software and Affected Versions: FeehiCMS version 2.1.1 Description: A reflected cross-site scripting XSS issue was found in FeehiCMS. The vulnerability occurs via the id parameter at the "/web/admin/index.php?r=log%2Fview-layer" endpoint. This allows for potential XSS...

PT-2022-25081 · Samsung · Galaxywatch4Plugin

Name of the Vulnerable Software and Affected Versions: GalaxyWatch4Plugin versions prior to 2.2.11.22101351 and 2.2.12.22101351 Description: The issue is related to improper access control, allowing attackers to access wearable device information. Recommendations: For versions prior to...

BLOCK_PERIOD is incorrect

Lines of code Vulnerability details The BLOCKPERIOD is set to 13 seconds in Config.sol. uint256 constant BLOCKPERIOD = 13 seconds; Since moving to Proof-of-Stake PoS after the Merge, block times on ethereum are fixed at 12 seconds per block slots. . Impact This results in incorrect calculation of...

opencontainers: OCI manifest and index parsing confusion

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Image Specification, the manifest and index documents were not self-describing and documents with a single digest could be interpreted as either a manifest or an index. ...

PT-2022-14669 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to a possible out of bounds read due to a use after free in the PAN WriteBuf function of pan api.cc. This could lead to remote information disclosure over Bluetooth with no...

Intel® Support Android App Advisory

Summary: Potential security vulnerabilities in the Intel® Support Android application may allow escalation of privilege or information disclosure. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2022-30691 Description: Uncontrolle...

PT-2022-5459 · Microsoft +7 · Windows Kerberos +9

Name of the Vulnerable Software and Affected Versions: Windows Kerberos versions prior to the update that addresses the RC4-HMAC vulnerability Samba Active Directory DC affected versions not specified Description: The issue is related to the implementation of the Kerberos protocol in Windows...

PT-2025-26139

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A potential use-after-free issue exists in the Linux kernel due to the netfilter: nf tables allowing SET ID to refer to another table. When doing lookups for sets on the same batch by...

PT-2025-25995 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.19.0-rc7 Description: A potential bad pointer dereference issue exists in the bpf sys bpf helper function, which allows an eBPF program to load another eBPF program from within the kernel. The issue arises whe...

PT-2022-11212 · Unknown · Perfex Crm

Name of the Vulnerable Software and Affected Versions: perfex crm version 1.10 Description: The issue is related to Cross Site Scripting XSS that can be exploited via the "/clients/profile" API endpoint. This allows for potential malicious script injection. Recommendations: For perfex crm version...

PT-2022-25867 · Unknown · Eyesofnetwork Web Interface

Name of the Vulnerable Software and Affected Versions: EyesOfNetwork Web Interface version 5.3 Description: A reflected cross-site scripting XSS issue was found in the EyesOfNetwork Web Interface, specifically via the "module/admin bp/add application.php" API endpoint. This issue can be exploited...

PT-2022-26860 · N-Prolog · N-Prolog

Name of the Vulnerable Software and Affected Versions: N-Prolog version 1.91 Description: A global buffer overflow issue was found in the gettoken function at Main.c. Recommendations: For N-Prolog version 1.91, consider disabling the gettoken function as a temporary workaround until a patch is...

PT-2022-5611

Name of the Vulnerable Software and Affected Versions LibTIFF affected versions not specified Description A critical issue was found in LibTIFF, affecting the TIFFReadRGBATileExt function in the libtiff/tif getimage.c file. This issue is related to an integer overflow and can be exploited remotel...

PT-2022-25866 · Unknown · Eyesofnetwork Web Interface

Name of the Vulnerable Software and Affected Versions: EyesOfNetwork Web Interface version 5.3 Description: A reflected cross-site scripting XSS issue was found in the EyesOfNetwork Web Interface. The issue is related to the "/module/report event/index.php" API endpoint. Recommendations: For...

PT-2022-14674 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to Android-13 Description: The issue is related to a possible method arbitrary code execution due to a confused deputy in the initializeFromParcelLocked method of BaseBundle.java. This could lead to local escalation of...

PT-2022-25868 · Unknown · Eyesofnetwork Web Interface

Name of the Vulnerable Software and Affected Versions: EyesOfNetwork Web Interface version 5.3 Description: A reflected cross-site scripting XSS issue was found in the EyesOfNetwork Web Interface. The issue is related to the /lilac/main.php API endpoint. Recommendations: For EyesOfNetwork Web...

PT-2022-27315 · Firstobject · Object First Ootbi Beta

Name of the Vulnerable Software and Affected Versions: Object First Ootbi BETA versions 1.0.7.712 through 1.0.13.1610 Description: A flaw was found in the Web Service, which could lead to local information disclosure. The command that creates the URL for the support bundle uses an insecure RNG,...