PT-2022-21162 · Unknown · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions prior to 5 Rocket.Chat versions prior to 4.8.2 Rocket.Chat versions prior to 4.7.5 Description: The issue concerns a cleartext transmission of sensitive information in Rocket.Chat, specifically relating to OAuth tokens...

PT-2022-37295 · Git +1 · File

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ crash has been reported, with the crash state involving functions such as file magwarn, load 1, and apprentice load. No...

PT-2022-21797 · Apache · Apache Pulsar Java Client

Name of the Vulnerable Software and Affected Versions: Apache Pulsar Java Client versions 2.6.4 and earlier Apache Pulsar Java Client versions 2.7.0 through 2.7.4 Apache Pulsar Java Client versions 2.8.0 through 2.8.3 Apache Pulsar Java Client versions 2.9.0 through 2.9.2 Apache Pulsar Java Clien...

PT-2022-25463 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about a specific vulnerability. It appears to be a notification about a rejected candidate...

PT-2022-21798 · Apache · Apache Pulsar Websocket Proxy +2

Name of the Vulnerable Software and Affected Versions: Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.6.4 and earlier Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.7.0 through 2.7.4 Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.8.0 through 2.8.3 Apache...

PT-2022-22500 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC commit 617837b Description: A global buffer overflow issue was discovered in OTFCC, specifically via the /release-x64/otfccdump+0x718693 endpoint. This issue can be exploited, potentially leading to unintended consequences...

PT-2022-22510 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC commit 617837b Description: A segmentation violation was discovered in OTFCC commit 617837b via the /release-x64/otfccdump+0x4fe954 endpoint. This issue affects the specified commit. Recommendations: For OTFCC commit 617837b, consider...

Consul Service Mesh Intention Bypass with Malicious Certificate Signing Request

Summary A vulnerability was identified in Consul and Consul Enterprise “Consul” such that a specially crafted CSR sent directly to Consul’s internal server agent RPC endpoint can include multiple SAN URI values with additional service names. This vulnerability, CVE-2022-40716, was fixed in Consul...

PT-2022-20464

Name of the Vulnerable Software and Affected Versions OSV affected versions not specified Description The issue concerns the JWT code's ability to auto-detect token types, potentially leading to incorrect conclusions about token trustworthiness. Under certain circumstances, an attacker can...

PT-2022-25749 · Jenkins · Jenkins Rundeck Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Rundeck Plugin versions 3.6.11 and earlier Description: The issue allows attackers with Item/Read permission to obtain information about build artifacts of a given job, if the optional Run/Artifacts permission is enabled, due to a lac...

PT-2022-25760 · Jenkins · Jenkins Worksoft Execution Manager Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Worksoft Execution Manager Plugin versions 10.0.3.503 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs, capturin...

PT-2022-25759 · Jenkins · Jenkins View26 Test-Reporting Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins View26 Test-Reporting Plugin versions 1.0.7 and earlier Description: The issue concerns a lack of hostname validation when connecting to the configured View26 server. This could be exploited using a man-in-the-middle attack to interce...

PT-2022-23890 · Craft Cms · Craft Cms

Name of the Vulnerable Software and Affected Versions: Craft CMS version 4.2.0.1 Description: The issue is related to Cross Site Scripting XSS in the file src/web/assets/cp/src/js/BaseElementSelectInput.js, specifically on the line label: elementInfo.label. This suggests a potential problem with...

PT-2022-25751 · Jenkins · Jenkins Wildfly Deployer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins WildFly Deployer Plugin versions 1.0.2 and earlier Description: The issue allows agent processes to read arbitrary files on the Jenkins controller file system. This is only exploitable in certain versions of Jenkins, specifically 2.31...

PT-2022-20886 · Spring · Spring Data Rest

Name of the Vulnerable Software and Affected Versions: Spring Data REST versions 3.5.5 and earlier Spring Data REST versions 3.6.0 through 3.6.6 Spring Data REST versions 3.7.0 through 3.7.2 Description: The issue allows attackers to expose hidden entity attributes by crafting HTTP requests, if...

PT-2022-23330 · Unknown · Wha Crossword Plugin

Name of the Vulnerable Software and Affected Versions: WHA Crossword plugin versions 1.1.10 and earlier Description: The issue concerns multiple authenticated Stored Cross-Site Scripting XSS vulnerabilities. These vulnerabilities can be exploited by contributors or users with higher privileges. T...

PT-2022-19339 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.1.0 through 7.4.2 Liferay DXP 7.1 before fix pack 26 Liferay DXP 7.2 before fix pack 15 Liferay DXP 7.3 before service pack 3 Description: A cross-site scripting XSS issue was discovered in the Portal Search module's...

Festo CPX-CEC-C1 and CPX-CMXX

SUMMARY Unauthenticated access to critical webpage functions e.g. reboot may cause a denial of service of the device. 2. IMPACT CPX-CEC-C1 and CPX-CMXX allow unauthenticated access to critical webpage functions e.g. reboot which may cause a denial of service of the device 3. REMEDIATION...

CVE-2022-34917 Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers

A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Exampl...

UBUNTU-CVE-2022-39956

The OWASP ModSecurity Core Rule Set CRS is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and...