CVE-2022-3633 Linux Kernel transport.c j1939_session_destroy memory leak

A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function j1939sessiondestroy of the file net/can/j1939/transport.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is...

PT-2022-11614 · Stmicroelectronics +2 · Stm32 Mw Usb Host +2

Name of the Vulnerable Software and Affected Versions: stm32 mw usb host versions prior to 3.5.1 Description: A buffer overflow issue allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH MAX NUM ENDPOINTS. This typically occurs when using a RTOS such ...

PT-2022-6887 · Libtiff +7 · Libtiff +7

Name of the Vulnerable Software and Affected Versions: LibTIFF version 4.4.0 Description: The issue is related to an out-of-bounds write in the extractContigSamplesShifted24bits function, allowing attackers to cause a denial-of-service via a crafted tiff file. This can be exploited by a remote...

PT-2022-6886 · Libtiff +7 · Libtiff +7

Name of the Vulnerable Software and Affected Versions: LibTIFF version 4.4.0 Description: The issue is related to an out-of-bounds write in the TIFFmemset function, allowing attackers to cause a denial-of-service via a crafted tiff file. This can be triggered when the TIFFmemset function is calle...

Upgraded Q -> M from 129 [1666359797557]

Judge has assessed an item in Issue 129 as Medium risk. The relevant finding follows: 1.use transfer to pay eth GolomTrader.sol payEther use transfer to pay eth , and receiver can be specified arbitrarily, it is recommended to use call to avoid a certain chance of failure due to 2300 gas fee...

CVE-2022-3635 Linux Kernel IPsec idt77252.c tst_timer use after free

A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function tsttimer of the file drivers/atm/idt77252.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. VDB-211934 ...

PT-2022-26311 · Unknown · Phpgurukul Hospital Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Hospital Management System version 4.0 Description: The issue concerns a Cross Site Scripting XSS flaw. This type of flaw occurs when an application includes user input in its output without proper validation or encoding, allowing ...

PT-2022-6889 · Libtiff +7 · Libtiff +7

Name of the Vulnerable Software and Affected Versions: LibTIFF version 4.4.0 Description: The issue is related to an out-of-bounds read in the writeSingleSection function of the LibTIFF library, which can be exploited by attackers to cause a denial-of-service via a crafted tiff file...

CVE-2022-3623

A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function followpagepte of the file mm/gup.c of the component BPF. The manipulation leads to race condition. The attack can be launched remotely. It is recommended to apply a patch...

PT-2022-26309 · Unknown · Simple Exam Reviewer Management System

Name of the Vulnerable Software and Affected Versions: Simple Exam Reviewer Management System version 1.0 Description: The issue concerns Stored Cross Site Scripting XSS via the Exam List. This means an attacker can inject malicious scripts into the Exam List, which can then be executed by other...

PT-2022-23910

Name of the Vulnerable Software and Affected Versions Shinken Monitoring version 2.4.3 Description The issue is related to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nod...

PT-2022-26299 · Pctechsoft · Pcsecure

Name of the Vulnerable Software and Affected Versions: PCTechSoft PCSecure version 5.0.8.xw Description: The issue is related to the use of hard-coded credentials in configuration files, which can lead to unauthorized access to the admin panel. Recommendations: For PCTechSoft PCSecure version...

CVE-2022-1970

Rejected reason: The originally reported issue in https://github.com/syedsohaibkarim/OpenRedirect-Keycloak18.0.0 is a known misconfiguration, and recommendation already exists in the Keycloak documentation to mitigate the issue:...

PT-2022-26717 · Bento4 · Bento4

Name of the Vulnerable Software and Affected Versions: Bento4 version 1.6.0-639 Description: An issue in the component AP4 HdlrAtom::AP4 HdlrAtom allows attackers to cause a Denial of Service DoS via a crafted input. This is due to a bad free, which can be exploited to disrupt the service...

PT-2022-21678 · Unknown · Nopcommerce

Name of the Vulnerable Software and Affected Versions: nopcommerce version 4.50.2 Description: The issue is related to an access control problem, allowing attackers to modify any customer's address. This is achieved through the "addressedit" endpoint. Recommendations: For nopcommerce version...

PT-2022-26900 · Jenkins · Jenkins Repo Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins REPO Plugin versions 1.15.0 and earlier Description: The issue allows attackers who can control which repo binary is executed on agents to have Jenkins parse a crafted XML document. This can lead to extraction of secrets from the...

PT-2022-26712 · Tenda · Tenda Tx3

Name of the Vulnerable Software and Affected Versions: Tenda TX3 version US TX3V1.0br V16.03.13.11 multi TDE01 Description: A stack overflow issue was discovered via the timeZone parameter at the "/goform/SetSysTimeCfg" API endpoint. Recommendations: For Tenda TX3 version US TX3V1.0br V16.03.13.1...

PT-2022-26718 · Bento4 · Bento4

Name of the Vulnerable Software and Affected Versions: Bento4 version 1.6.0-639 Description: An issue was discovered in the AP4 BitReader::SkipBitsunsigned int function in mp42ts, which is a heap buffer overflow. Recommendations: For Bento4 version 1.6.0-639, consider disabling the AP4...

PT-2022-26905 · Jenkins · Jenkins Contrast Continuous Application Security Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Contrast Continuous Application Security Plugin versions 3.9 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the plugin does not escape data returned from the Contras...

PT-2022-26720 · Bento4 · Bento4

Name of the Vulnerable Software and Affected Versions: Bento4 version 1.6.0-639 Description: An issue was discovered in the function AP4 File::ParseStream in /Core/Ap4File.cpp, which results in a memory leak. Recommendations: For Bento4 version 1.6.0-639, consider disabling the AP4...