PT-2022-5268 · D Link · D-Link Dir-816 A2

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.10 B05 Description: The issue is related to a stack overflow in the setSecurity function, specifically via the pskValue parameter. This can potentially allow a remote attacker to execute arbitrary code due to a...

PT-2022-24930 · Metabase · Metabase

Name of the Vulnerable Software and Affected Versions: Metabase versions prior to 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 Description: The issue concerns the automatic execution of unsaved SQL queries, which could pose a possible attack vector. Metabase has addressed th...

Samba Releases Security Updates 

The Samba Team has released security updates to address vulnerabilities in multiple versions of Samba. A remote attacker could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following Samba Security Announcements...

PT-2022-21784 · WordPress · Contact Bank Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Contact Bank WordPress plugin versions 3.0.30 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowe...

CVE-2022-39350 @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details

@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Due to the common practice of providing vulnerability details in markdown format, the...

PT-2022-7180 · Free5Gc · Free5Gc

Name of the Vulnerable Software and Affected Versions: Free5gc version 3.2.1 Description: The issue is related to information disclosure due to a lack of authentication for a critical function in the free5GC software, which is used for organizing 5G mobile network communications. This allows a...

PT-2022-21649 · WordPress · Cleantalk

Name of the Vulnerable Software and Affected Versions: Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin versions prior to 5.185.1 Description: The issue concerns a lack of validation for ids used in SQL statements, potentially leading to SQL injection. This could be exploited by...

Adversary can cause malicious slashing of operators by setting gas price low

Lines of code Vulnerability details Impact Operators are maliciously slashed Proof of Concept The gas price and limit can be set to whatever the user wishes when calling the bridge. A malicious user could set the gas prices to be low for current chain conditions. This would allow them to use up t...

CVE-2022-39351 Dependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissions

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit...

PT-2022-21919 · Bestwebsoft · Post To Csv

Name of the Vulnerable Software and Affected Versions: Post to CSV by BestWebSoft WordPress plugin versions 1.4.0 and earlier Description: The issue arises from the plugin's failure to properly escape fields when exporting data as CSV, leading to a CSV injection. Recommendations: For Post to CSV ...

PT-2022-21926 · WordPress · Wp All Export Pro

Name of the Vulnerable Software and Affected Versions: WP All Export Pro versions prior to 1.7.9 Description: The issue allows any logged-in user with export privileges to execute arbitrary code on the site, despite the default restriction to administrators. This is because the plugin does not...

PT-2022-22405 · Apache · Apache Geode

Name of the Vulnerable Software and Affected Versions: Apache Geode versions up to 1.15.0 Description: The issue is related to a Cross-Site Scripting XSS vulnerability via data injection when using the Pulse web application to view Region entries. Recommendations: For Apache Geode versions up to...

PT-2022-23376 · Mitel · Mitel Micollab

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions through 9.5.0.101 Description: A vulnerability in the web conferencing component could allow an unauthenticated attacker to upload malicious files, potentially leading to the execution of arbitrary code within the...

PT-2022-24888 · Unknown · Gin-Vue-Admin

Name of the Vulnerable Software and Affected Versions: Gin-vue-admin versions prior to 2.5.4 Description: The issue concerns an arbitrary file read due to insufficient validation of the fileMd5 and fileName parameters in the file upload functionality. This allows unauthorized access to files. The...

PT-2022-26579 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13 Description: A permissions issue existed, allowing a malicious application to potentially read sensitive location information. This issue was addressed with improved permission validation. Recommendations: For...

PT-2022-26078 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to 5.1.4 GROWI versions prior to 4.5.25 Description: The issue allows a remote authenticated attacker to bypass access restrictions and download markdown data from pages set to private by other users. Recommendations: For...

PT-2022-6818

Name of the Vulnerable Software and Affected Versions xterm versions prior to 375 Description The issue is related to the lack of input validation in the xterm terminal emulator, which can be exploited by a remote attacker to gain access to confidential data, compromise its integrity, and cause a...

CVE-2022-3646

A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfsattachlogwriter of the file fs/nilfs2/segment.c of the component BPF. The manipulation leads to memory leak. The attack may be initiated remotely. It is recommended to apply ...

CVE-2022-3633

A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function j1939sessiondestroy of the file net/can/j1939/transport.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is...

CVE-2022-3630

A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects some unknown processing of the file fs/fscache/cookie.c of the component IPsec. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of...