PT-2022-33318 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.6 Description: The issue is related to a refcount leak in the xfrm policy check function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prio...

PT-2022-33404 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.1 through v5.19.3 Description: A use-after-free issue was discovered, which may potentially lead to security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This issue was introduc...

PT-2022-33301 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.6 Description: A data-race issue exists around sysctl net busy read. The actual impact and attack plausibility have not yet been proven. It was introduced in version v3.11 and fixed in Linux Kernel version...

PT-2022-33559 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.2 Description: A potential use after free issue has been identified. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to v5.19.2, update ...

PT-2022-33582 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.2 Description: The issue is related to a potential security vulnerability in io uring. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior t...

PT-2022-33440 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.2 Description: The issue is related to the wifi nl80211 component, specifically with holding the wdev mutex for tid config. The actual impact and attack plausibility have not yet been proven...

PT-2022-33392 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.4 Description: A potential issue exists in the fs/ntfs3 component, specifically a NULL dereference in the ntfs update mftmirr function. The actual impact and attack plausibility have not yet been proven...

PT-2022-33540 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.2 Description: The issue concerns a potential security vulnerability related to an snprintf overflow in the Linux Kernel. The actual impact and attack plausibility have not yet been proven. Recommendations...

PT-2022-33651 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.66 Description: The issue is related to a potential security vulnerability in the Linux Kernel. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel version...

CVE-2022-36074 Authentication headers exposed on by Nextcloud Server

Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade. This can lead to account access exposure and compromise. It is recommended that the Nextcloud Server...

CVE-2022-36075 File list exposure in Nextcloud Files Access Control

Nextcloud files access control is a nextcloud app to manage access control for files. Users with limited access can see file names in certain cases where they do not have privilege to do so. This issue has been addressed and it is recommended that the Nextcloud Files Access Control app is upgrade...

CVE-2022-39213 Out-of-bounds Read in go-cvss

go-cvss is a Go module to manipulate Common Vulnerability Scoring System CVSS. In affected versions when a full CVSS v2.0 vector string is parsed using ParseVector, an Out-of-Bounds Read is possible due to a lack of tests. The Go module will then panic. The problem is patched in tag v0.4.0, by th...

Attacker can gain more voting power

Lines of code Vulnerability details Impact An attacker can gain more voting power at a low cost Proof of Concept When voting, voting power is taken from the snapshot at the same block as the proposal was created. The attacker can monitor mempool and borrow NFTs just in time when proposal is made...

PT-2022-21152 · Rdiffweb · Rdiffweb

Name of the Vulnerable Software and Affected Versions: rdiffweb versions prior to 2.4.3 Description: The issue is related to Cross-Site Request Forgery CSRF in the GitHub repository ikus060/rdiffweb. When adding SSH public keys to a profile, the server accepts GET requests, which can lead to...

CVE-2022-31143

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. It was found that in affected versions there is an exposure of private information defined in setup of...

Shopify: XSS in www.shopify.com/markets?utm_source=

Hello, hope you are having a good day : Summary: I found a reflected XSS in www.shopify.com/markets using the utmsource parameter Reflected XSS vulnerabilities arise when the application accepts a malicious input script from a user and then it is executed in the victim's browser. Since the XSS is...

PT-2022-25385 · Bento4 · Bento4

Name of the Vulnerable Software and Affected Versions: Bento4 version 1.6.0-639 Description: A memory leak issue was found in the AP4 StdcFileByteStream::Create function in mp42ts, which can be exploited by attackers to cause a denial of service using a crafted file. Recommendations: For Bento4...

CVE-2022-36104 Denial of Service via Page Error Handling in TYPO3/cms

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads t...

PT-2022-24419 · Coreshield · Coreshield One-Way Gateway

Name of the Vulnerable Software and Affected Versions: CoreShield One-Way Gateway OWG Software versions prior to V2.2 Description: A security issue has been identified where the default installation of the software sets insecure file permissions. This could allow a local attacker to escalate...

PT-2022-5076 · Adobe · Incopy

Name of the Vulnerable Software and Affected Versions: Adobe InCopy versions 17.3 and earlier Adobe InCopy versions 16.4.2 and earlier Description: The issue is related to a Heap-based Buffer Overflow that could result in arbitrary code execution in the context of the current user. Exploitation...