PT-2022-3558 · Hotdog · Hotdog

Name of the Vulnerable Software and Affected Versions: Hotdog versions prior to 1.0.1 Description: The issue is related to errors in access control, allowing a container to gain full privileges on the host and bypass restrictions set on the container. This could enable an attacker to elevate thei...

PT-2022-16905 · Github +1 · Git Lfs +1

Name of the Vulnerable Software and Affected Versions: Git LFS versions 2.12.1 through 3.1.2 Description: On Windows, if Git LFS operates on a malicious repository with a ..exe file as well as a file named git.exe, and git.exe is not found in PATH, the ..exe program will be executed, permitting t...

PT-2022-2416 · Oracle +11 · Mysql Server +10

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 5.7.37 and prior MySQL Server versions 8.0.28 and prior Description: A vulnerability in the MySQL Server product allows a high privileged attacker with network access via multiple protocols to compromise the server...

InsightCloudSec Supports the Recently Updated NSA/CISA Kubernetes Hardening Guide

The National Security Agency NSA and the Cybersecurity and Infrastructure Security Agency CISA recently updated their Kubernetes Hardening Guide, which was originally published in August 2021. With the help and feedback received from numerous partners in the cybersecurity community, this guide...

Delta Electronics DMARS

1. EXECUTIVE SUMMARY CVSS v3 5.5 ATTENTION: Low attack complexity Vendor: Delta Electronics Equipment: DMARS Vulnerability: Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain sensitive information...

PT-2022-8698 · B. Braun Melsungen Ag · Data Module Compactplus +1

Name of the Vulnerable Software and Affected Versions: B. Braun Melsungen AG SpaceCom versions L81/U61 and earlier B. Braun Melsungen AG Data module compactplus versions A10 and A11 Description: A relative path traversal attack allows attackers with service user privileges to upload arbitrary...

PT-2022-7068 · Adobe · Acrobat Reader

Name of the Vulnerable Software and Affected Versions: Acrobat Reader DC versions 17.012.30205 through 22.001.20085 Acrobat Reader DC versions 20.005.3031x and earlier Description: The issue is related to an out-of-bounds read vulnerability when parsing a crafted file, which could result in a rea...

PT-2022-6078

Name of the Vulnerable Software and Affected Versions SnakeYaml versions prior to 2.0 Bitbucket Data Center versions 7.17.x through 8.8.6 Bitbucket Server versions 7.17.x through 8.8.6 Confluence Data Center versions 6.13.x through 8.3.0 Confluence Server versions 6.13.x through 8.3.0 Description...

PT-2025-8009 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.17.0-rc7 Description: A vulnerability in the Linux kernel has been identified, which can cause runtime warnings when CONFIG DEBUG KMAP LOCAL is enabled. The issue arises from the kmap local sched in,out...

PT-2022-15485 · 3S Smart Software Solutions · Codesys Control Runtime System

Name of the Vulnerable Software and Affected Versions: CODESYS Control runtime system affected versions not specified Description: The issue allows any system user to read and write within restricted memory space due to a problem in the SysDrv3S driver. Recommendations: At the moment, there is no...

NFTLoanFacilitator: Unsupported fee-on-transfer tokens

Lines of code Vulnerability details Impact loanAssetContractAddress is specified by the user when the user creates a loan. When loanAssetContractAddress is fee-on-transfer tokens, in the lend function, the actual amount of tokens received by the contract will be less than the amount, so that the...

PT-2022-7301 · Async +2 · Async +2

Name of the Vulnerable Software and Affected Versions: Async versions 2.x through 2.6.3 Async versions 3.x through 3.2.1 Description: The issue is related to the mapValues function in the Async library, which is used for working with asynchronous JavaScript. It involves the incorrect control of...

Johnson Controls Metasys

1. EXECUTIVE SUMMARY CVSS v3 8.4 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Inc. Equipment: Metasys Vulnerability: Server-side Request Forgery 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an authenticated attacker to inject...

Update on Spring4Shell’s Impact on Rapid7 Solutions and Systems

We have completed remediating the instances of Spring4Shell CVE-2022-22965 and Spring Cloud CVE-2022-22963 vulnerabilities that we found on our internet-facing services and systems. We continue to monitor for new vulnerability instances and to remediate vulnerabilities on internally accessible...

PT-2022-2283 · Swhkd · Swhkd

Name of the Vulnerable Software and Affected Versions: SWHKD versions 1.1.5 and prior Description: The issue is related to the use of the /tmp/swhkd.pid pathname by the SWHKD daemon, which can lead to information leaks or denial of service. This is because the /tmp directory is accessible to all...

PT-2022-9761 · Unknown · Impresscms

Name of the Vulnerable Software and Affected Versions: ImpressCMS versions prior to 1.4.3 Description: The issue allows for SQL Injection in the include/findusers.php groups. There is a remote code execution exploit. Recommendations: For versions prior to 1.4.3, update to version 1.4.3 or later t...

PT-2022-2786 · Unknown +5 · Imagemagick +5

Name of the Vulnerable Software and Affected Versions: ImageMagick version 7.1.0-27 Description: The issue is related to a buffer overflow in the implementation of the PushLongPixel function in the ImageMagick graphic editor. This can be exploited by an attacker using a specially crafted image...

PT-2022-3187 · Sap · Krnl64Uc +4

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver and ABAP Platform versions KERNEL 7.49, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, KRNL64NUC 7.49, KRNL64UC 7.49, SAP ROUTER 7.53, 7.22 Description: The issue is related to errors in authorization in the saprouttab file, which can allo...

PT-2022-4187 · Unknown +1 · Passwork On-Premise Edition +1

Name of the Vulnerable Software and Affected Versions: Passwork On-Premise Edition versions prior to 4.6.13 Description: The issue is related to multiple XSS problems in the Passwork On-Premise Edition. This is due to the lack of protection measures for the web page structure, allowing a remote...

PT-2025-8000

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition issue exists due to the exposure of GPIO chip irq members before they are fully initialized. This can lead to a kernel NULL pointer dereference, as observed with the...