PT-2022-16361 · Keylime · Keylime

Name of the Vulnerable Software and Affected Versions: Keylime versions prior to 6.3.0 Description: The issue arises from the Revocation Notifier in Keylime using a fixed /tmp path for a UNIX domain socket. This can be exploited by unprivileged users to prohibit Keylime operations. Recommendation...

PT-2022-11822 · Keylime · Keylime

Name of the Vulnerable Software and Affected Versions: Keylime versions prior to 6.3.0 Description: A vulnerability allows an attacker to craft a request to the agent that resets the U and V keys as if the agent were being re-added to a verifier, potentially leading to remote code execution...

PT-2022-37291 · Git +1 · File

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read crash has been reported. The crash involves the following functions: file magwarn, parse strength, and load 1. No information...

PT-2022-19284 · Octoprint · Octoprint

Name of the Vulnerable Software and Affected Versions: OctoPrint versions prior to 1.8.3 Description: The issue allows an attacker to authenticate using a victim's OctoPrint session cookie as long as the victim's account exists. This can be done if the attacker comes into possession of the cookie...

PT-2022-23345 · WordPress · Soflyy Import Any Xml/Csv File To Wordpress

Name of the Vulnerable Software and Affected Versions: Soflyy Import any XML or CSV File to WordPress plugin versions = 3.6.7 Description: The issue is related to an Authenticated Arbitrary Code Execution vulnerability. This allows for the execution of arbitrary code by an authenticated user...

PT-2022-21349 · Minarca · Minarca

Name of the Vulnerable Software and Affected Versions: minarca versions prior to 4.2.2 Description: The issue concerns a sensitive cookie in an HTTPS session that lacks the 'Secure' attribute. This problem is identified in the GitHub repository ikus060/minarca. Recommendations: For versions prior...

PT-2022-6107 · Jenkins · Jenkins Extreme-Feedback Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins extreme-feedback Plugin versions 1.7 and earlier Description: The issue is related to a missing permission check in the Jenkins extreme-feedback Plugin, allowing attackers with Overall/Read permission to access sensitive information...

PT-2022-25752 · Jenkins · Jenkins Dotci Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins DotCi Plugin versions 2.40.00 and earlier Description: The issue arises from the Jenkins DotCi Plugin not configuring its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

PT-2022-25771 · Jenkins · Jenkins Cons3Rt Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins CONS3RT Plugin versions 1.0.0 and earlier Description: The issue allows users with access to the Jenkins controller file system to view the Cons3rt API token, which is stored unencrypted in job config.xml files on the Jenkins...

PT-2022-19489 · Yetiforce · Yetiforcecrm

Name of the Vulnerable Software and Affected Versions: YetiForce CRM versions prior to 6.3 YetiForce CRM versions 6.4.0 and prior Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the GitHub repository yetiforcecompany/yetiforcecrm. The WidgetsManagement module...

PT-2022-22627 · Testlink · Testlink

Name of the Vulnerable Software and Affected Versions: TestLink version 1.9.20 Description: A Cross-Site Request Forgery CSRF issue was found via the "/lib/plan/planView.php" API endpoint. Recommendations: For version 1.9.20, update to a newer version that contains a fix for this issue...

CVE-2022-39958 Response body bypass in OWASP ModSecurity Core Rule Set via repeated HTTP Range header submission with a small byte range

The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP Range header field with a small byte range. A restricted resource, access to which would ordinarily be detected, may be...

PT-2022-25359 · Z Blogphp · Z-Blogphp

Name of the Vulnerable Software and Affected Versions: Z-BlogPHP versions prior to 1.7.3 Description: A security issue was discovered that allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter, due to a Server-Side...

PT-2022-6072 · Apache · Apache Kafka

Name of the Vulnerable Software and Affected Versions: Apache Kafka versions 2.8.0 through 3.2.2 Apache Kafka versions 2.8.0 through 3.1.1 Apache Kafka versions 2.8.0 through 3.0.1 Apache Kafka versions 2.8.0 through 2.8.1 Description: A security issue in Apache Kafka is related to uncontrolled...

PT-2022-24125 · Aruba · Aruba Clearpass Policy Manager

Name of the Vulnerable Software and Affected Versions: Aruba ClearPass Policy Manager versions 6.10.6 and below Aruba ClearPass Policy Manager versions 6.9.11 and below Description: A vulnerability exists in the ClearPass Policy Manager Guest User Interface that can allow an unauthenticated...

PT-2022-19981 · Unknown · Yetiforcecrm

Name of the Vulnerable Software and Affected Versions: YetiForce CRM versions prior to 6.4.0 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the WorkFlow module. This allows for potential exploitation via cross-site scripting. Recommendations: For versions...

PT-2022-20187 · Tibco Software · Tibco Spotfire Analytics Platform For Aws Marketplace +1

Name of the Vulnerable Software and Affected Versions: TIBCO Spotfire Analytics Platform for AWS Marketplace version 12.0.0 TIBCO Spotfire Server version 12.0.0 Description: The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire...

PT-2022-19986 · Unknown · Yetiforcecrm

Name of the Vulnerable Software and Affected Versions: YetiForce CRM versions prior to 6.4.0 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the YetiForce CRM GitHub repository. The SlaPolicy module is vulnerable to cross-site scripting. Recommendations: For...

Intel AMT Advisory - Lenovo Support US

No description provided...

PT-2022-19704 · WordPress · Badgeos

Name of the Vulnerable Software and Affected Versions: BadgeOS WordPress plugin versions prior to 3.7.1.3 Description: The issue concerns the BadgeOS WordPress plugin, which does not properly sanitise and escape parameters before using them in SQL statements via AJAX actions. This can lead to SQL...