PT-2022-10: Local Authentication Restriction Bypass in HPE OneView

The vulnerability was identified in HPE OneView versions before 6.6. The discovered vulnerability allows an attaker to bypass local authentication restriction. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 29.03.2022 Recommendations: Update to version 6.6 Additional...

PT-2022-13110 · Sophos · Sophos Firewall

Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to v18.5 MR3 Description: An information disclosure issue in Webadmin allows an unauthenticated remote attacker to read the device serial number. Recommendations: For Sophos Firewall versions prior to v18.5 MR3,...

PT-2022-18848 · Jenkins · Jenkins Job/Node Ownership Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Job and Node ownership Plugin versions 0.13.0 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the names of the secondary owners are not properly escaped, allowing...

CVE-2008-10001 Pro2col Stingray FTS cross site scriting

A vulnerability, which was classified as problematic, has been found in Pro2col Stingray FTS. The manipulation of the argument Username leads to cross site scripting. The attack may be initiated remotely. It is recommended to upgrade the affected component. NOTE: This vulnerability only affects...

CVE-2015-10002 Kiddoware Kids Place Home Button Protection denial of service

A vulnerability classified as problematic has been found in Kiddoware Kids Place. This affects the Home Button Protection. A repeated pressing of the button causes a local denial of service. It is recommended to upgrade the affected component...

PT-2022-13303 · WordPress · Database Peek

Name of the Vulnerable Software and Affected Versions: Database Peek WordPress plugin versions prior to 1.3 Description: The issue arises from the lack of proper sanitization and escaping of the match parameter, which is then outputted back in an admin page. This leads to a Reflected Cross-Site...

PT-2025-7996 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.17.0-rc8+ Description: A vulnerability in the Linux kernel has been resolved, related to the btrfs filesystem. The issue occurs when the btrfs get blocks direct write function reserves temporary outstanding...

PT-2022-18380 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idcCMS version 1.10 Description: The issue allows attackers to arbitrarily delete the install.lock file, resulting in a reset of the CMS settings and data. Recommendations: For idcCMS version 1.10, consider restricting access to the...

PT-2022-13166 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: gogs versions prior to 0.12.6 Description: The issue allows a malicious user to upload a crafted config file into a repository's .git directory to gain SSH access to the server. This affects all installations with repository upload enabled,...

AZL-45060 CVE-2022-24761 affecting package python-waitress for versions less than 3.0.1-1

Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and...

Security update for stunnel (important)

openSUSE Security Update: Security update for stunnel Announcement ID: openSUSE-SU-2022:0872-1 Rating: important References: 1181400 1182529 SLE-20679 Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 An update that contains security fixes and contains one feature can now be installed...

Security update for java-1_8_0-openjdk (important)

openSUSE Security Update: Security update for java-180-openjdk Announcement ID: openSUSE-SU-2022:0873-1 Rating: important References: 1193314 1193444 1193491 1194926 1194928 1194929 1194931 1194932 1194933 1194934 1194935 1194937 1194939 1194940 1194941 1195163 Cross-References: CVE-2022-21248...

Security update for flac (moderate)

openSUSE Security Update: Security update for flac Announcement ID: openSUSE-SU-2022:0815-1 Rating: moderate References: 1196660 Cross-References: CVE-2021-0561 CVSS scores: CVE-2021-0561 NVD : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-0561 SUSE: 5.5...

PT-2022-15376 · Ibm · Ibm Spectrum Copy Data Management

Name of the Vulnerable Software and Affected Versions: IBM Spectrum Copy Data Management versions 2.2.0.0 through 2.2.14.3 Description: The issue is caused by improper validation of input by the HOST headers, leading to HTTP header injection. This could allow an attacker to conduct various attack...

PT-2022-26180

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.53.0 Description The issue arises when Synapse attempts to generate URL previews for media stream URLs without properly limiting connection time. Connections are only terminated after a certain amount of data max...

CVE-2022-24726 Unauthenticated control plane denial of service attack in Istio

Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing when the...

HTML injection possibility in voucher code form in Shopware

Impact HTML injection possibility in voucher code form Patches Patched in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6...

AZL-61405 CVE-2022-24713 affecting package rust for versions less than regex-1.8.4

regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those tunable mitigations already provide sane defaults to preven...

CVE-2022-24713 Regular expression denial of service in Rust's regex crate

regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those tunable mitigations already provide sane defaults to preven...

PT-2022-11372 · Nextcloud · Nextcloud Talk Android

Name of the Vulnerable Software and Affected Versions: Nextcloud Android Talk App versions prior to 12.3.0 Description: Nextcloud talk is a self-hosting messaging service. The Nextcloud Android Talk application did not properly detect the lockscreen state when a call was incoming. If an attacker...