12776 matches found
PT-2022-24833 · Netlify · Netlify-Ipx
Name of the Vulnerable Software and Affected Versions: netlify-ipx versions prior to 1.2.3 Description: The issue allows an attacker to bypass the source image domain allowlist by sending specially crafted headers, causing the handler to load and return arbitrary images. Because the response is...
PT-2022-21232 · Rdiffweb · Rdiffweb
Name of the Vulnerable Software and Affected Versions: rdiffweb versions prior to 2.4.6 Description: The issue is related to Cross-Site Request Forgery CSRF in the GitHub repository ikus060/rdiffweb. This could potentially lead to disabling notifications in a user's profile. Recommendations: For...
PT-2022-11822 · Keylime · Keylime
Name of the Vulnerable Software and Affected Versions: Keylime versions prior to 6.3.0 Description: A vulnerability allows an attacker to craft a request to the agent that resets the U and V keys as if the agent were being re-added to a verifier, potentially leading to remote code execution...
PT-2022-37291 · Git +1 · File
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read crash has been reported. The crash involves the following functions: file magwarn, parse strength, and load 1. No information...
PT-2022-19284 · Octoprint · Octoprint
Name of the Vulnerable Software and Affected Versions: OctoPrint versions prior to 1.8.3 Description: The issue allows an attacker to authenticate using a victim's OctoPrint session cookie as long as the victim's account exists. This can be done if the attacker comes into possession of the cookie...
PT-2022-23345 · WordPress · Soflyy Import Any Xml/Csv File To Wordpress
Name of the Vulnerable Software and Affected Versions: Soflyy Import any XML or CSV File to WordPress plugin versions = 3.6.7 Description: The issue is related to an Authenticated Arbitrary Code Execution vulnerability. This allows for the execution of arbitrary code by an authenticated user...
PT-2022-6107 · Jenkins · Jenkins Extreme-Feedback Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins extreme-feedback Plugin versions 1.7 and earlier Description: The issue is related to a missing permission check in the Jenkins extreme-feedback Plugin, allowing attackers with Overall/Read permission to access sensitive information...
PT-2022-25771 · Jenkins · Jenkins Cons3Rt Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins CONS3RT Plugin versions 1.0.0 and earlier Description: The issue allows users with access to the Jenkins controller file system to view the Cons3rt API token, which is stored unencrypted in job config.xml files on the Jenkins...
PT-2022-25752 · Jenkins · Jenkins Dotci Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins DotCi Plugin versions 2.40.00 and earlier Description: The issue arises from the Jenkins DotCi Plugin not configuring its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...
PT-2022-21349 · Minarca · Minarca
Name of the Vulnerable Software and Affected Versions: minarca versions prior to 4.2.2 Description: The issue concerns a sensitive cookie in an HTTPS session that lacks the 'Secure' attribute. This problem is identified in the GitHub repository ikus060/minarca. Recommendations: For versions prior...
CVE-2022-39958 Response body bypass in OWASP ModSecurity Core Rule Set via repeated HTTP Range header submission with a small byte range
The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP Range header field with a small byte range. A restricted resource, access to which would ordinarily be detected, may be...
PT-2022-22627 · Testlink · Testlink
Name of the Vulnerable Software and Affected Versions: TestLink version 1.9.20 Description: A Cross-Site Request Forgery CSRF issue was found via the "/lib/plan/planView.php" API endpoint. Recommendations: For version 1.9.20, update to a newer version that contains a fix for this issue...
PT-2022-25359 · Z Blogphp · Z-Blogphp
Name of the Vulnerable Software and Affected Versions: Z-BlogPHP versions prior to 1.7.3 Description: A security issue was discovered that allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter, due to a Server-Side...
PT-2022-19489 · Yetiforce · Yetiforcecrm
Name of the Vulnerable Software and Affected Versions: YetiForce CRM versions prior to 6.3 YetiForce CRM versions 6.4.0 and prior Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the GitHub repository yetiforcecompany/yetiforcecrm. The WidgetsManagement module...
PT-2022-19981 · Unknown · Yetiforcecrm
Name of the Vulnerable Software and Affected Versions: YetiForce CRM versions prior to 6.4.0 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the WorkFlow module. This allows for potential exploitation via cross-site scripting. Recommendations: For versions...
PT-2022-6072 · Apache · Apache Kafka
Name of the Vulnerable Software and Affected Versions: Apache Kafka versions 2.8.0 through 3.2.2 Apache Kafka versions 2.8.0 through 3.1.1 Apache Kafka versions 2.8.0 through 3.0.1 Apache Kafka versions 2.8.0 through 2.8.1 Description: A security issue in Apache Kafka is related to uncontrolled...
PT-2022-24125 · Aruba · Aruba Clearpass Policy Manager
Name of the Vulnerable Software and Affected Versions: Aruba ClearPass Policy Manager versions 6.10.6 and below Aruba ClearPass Policy Manager versions 6.9.11 and below Description: A vulnerability exists in the ClearPass Policy Manager Guest User Interface that can allow an unauthenticated...
PT-2022-20187 · Tibco Software · Tibco Spotfire Analytics Platform For Aws Marketplace +1
Name of the Vulnerable Software and Affected Versions: TIBCO Spotfire Analytics Platform for AWS Marketplace version 12.0.0 TIBCO Spotfire Server version 12.0.0 Description: The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire...
PT-2022-19986 · Unknown · Yetiforcecrm
Name of the Vulnerable Software and Affected Versions: YetiForce CRM versions prior to 6.4.0 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the YetiForce CRM GitHub repository. The SlaPolicy module is vulnerable to cross-site scripting. Recommendations: For...
