PT-2022-17167 · Candidats · Candidats

Name of the Vulnerable Software and Affected Versions: CandidATS version 3.0.0 Beta Description: The issue allows an authenticated user to inject SQL queries through specific API endpoints, including '/index.php?m=settings&a=show' via the userID parameter, '/index.php?m=candidates&a=show' via the...

PT-2022-19692 · Qualys · Qualys Cloud Agent

Name of the Vulnerable Software and Affected Versions: Qualys Cloud Agent version 4.8.0-49 Description: An issue was discovered in the Qualys Cloud Agent where it executes programs at various full pathnames without first making ownership and permission checks, and without integrity checks. This...

PT-2022-23777 · Flir · Flir Ax8

Name of the Vulnerable Software and Affected Versions: FLIR AX8 thermal sensor cameras version up to and including 1.46.16 Description: The issue allows for Remote Command Injection, which can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST...

PT-2022-24012 · Ampere · Ampere Altra +1

Name of the Vulnerable Software and Affected Versions: Ampere Altra devices before 1.08g Ampere Altra Max devices before 2.05a Description: The issue allows attackers to control the predictions for return addresses and potentially hijack code flow to execute arbitrary code via a side-channel...

PT-2022-24271 · Esri · Esri Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS version 10.8.1 Description: A system property in Esri Portal for ArcGIS is not properly encrypted, potentially allowing a local user to read sensitive information from a properties file. Recommendations: For Esri Portal...

PT-2022-23712 · Solarwinds · Solarwinds Platform

Name of the Vulnerable Software and Affected Versions: SolarWinds Platform versions 2022.3 and previous Description: The issue is related to insufficient control on a URL parameter, causing an insecure direct object reference IDOR vulnerability. This allowed users with Node Management rights to...

PT-2022-23229 · Tifig · Tifig

Name of the Vulnerable Software and Affected Versions: tifig version 0.2.2 Description: A heap-use-after-free issue was discovered in tifig, related to the function temInfoEntry. Recommendations: For version 0.2.2, consider disabling the temInfoEntry function as a temporary workaround until a pat...

SUSE-SU-2022:2808-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage bsc1201050. -...

PT-2022-15138 · WordPress · Greyd.Suite

Name of the Vulnerable Software and Affected Versions: GREYD.SUITE WordPress theme affected versions not specified Description: The issue concerns the GREYD.SUITE WordPress theme, which fails to properly validate uploaded custom font packages and does not perform authorization or CSRF checks. Thi...

Oil and Gas Cybersecurity: Recommendations Part 3

In the final part of our series, we look at the APT33 case study and several recommendations from our expert team...

User Funds are Locked in the VotingEscrow Contract When Delegated User Withdraws

Lines of code Vulnerability details Description There exists an issue when a delegated user attempts to withdraw the locked funds after a lock duration is expired, as a result the funds for the original user who triggered the delegation is lost within the contract. Impact This is an issue because...

PT-2022-14599 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a possible bypass of configuration integrity due to improperly used crypto, which could lead to local escalation of privilege with no additional execution privileges needed. User interaction...

PT-2022-14511 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: In Connectivity, there is a possible bypass of the restriction of starting activity from background due to a logic error in the code. This could lead to local escalation of privilege with User executio...

PT-2022-14606 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel affected versions not specified Description: The issue concerns the Android kernel. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents whe...

Emerson ROC800, ROC800L and DL8000

1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION: High attack complexity Vendor: Emerson Equipment: ROC800, ROC800L and DL8000 Vulnerability: Insufficient Verification of Data Authenticity CISA is aware of a public report, known as “OT:ICEFALL” that details vulnerabilities found in multiple operational...

PT-2022-14475 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue concerns a side channel information disclosure in PackageManager, allowing an attacker to determine whether an app is installed without requiring query permissions. This could lead to local...

PT-2022-15470 · Ibm · Ibm Robotic Process Automation

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation versions 21.0.0 through 21.0.2 Description: The issue allows a privileged user to obtain sensitive Azure bot credential information. Recommendations: For versions 21.0.0 through 21.0.2, consider restricting acce...

Siemens Teamcenter

1. EXECUTIVE SUMMARY CVSS v3 7.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Teamcenter Vulnerabilities: Command Injection, Infinite Loop 2. RISK EVALUATION Successful exploitation of these vulnerabilities could lead to command injection and denial-of-service...

Intel® Ethernet VMware Drivers Advisory

Summary: A potential security vulnerability in some Intel® Ethernet VMWare drivers may allow denial of service. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2022-21793 Description: Insufficient control flow management in the Intel...

PT-2022-4390 · Adobe · Framemaker

Name of the Vulnerable Software and Affected Versions: Adobe FrameMaker versions 2019 Update 8 and earlier Adobe FrameMaker versions 2020 Update 4 and earlier Description: The issue is related to a Use After Free vulnerability that could result in arbitrary code execution in the context of the...