CVE-2022-31683

Concourse 7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9 contains an authorization bypass issue. A Concourse user can send a request with body including :teamname=team2 to bypass team scope check to gain access to certain resources belong to any other team...

CVE-2022-23524

A flaw was found in Helm, a tool for managing Charts, a pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption. Input to functions in the strvals package could cause a stack overflow that is unrecoverable by Go. Applications that use functio...

The vulnerability of the DirectX Graphics Kernel Driver (DXGKRNL) on Microsoft Windows operating systems, which allows attackers to exploit their privileges.

The vulnerability of the DirectX Graphics Kernel Driver DXGKRNL on Microsoft Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow attackers to gain increased privileges...

CVE-2022-23526

Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in thechartutil package that can cause a segmentation violation. The chartutil package contains a parser that loads a JSON Schema validation file. For example,...

CVE-2022-23525

Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the repopackage. The repo package contains a handler that processes the index file of a repository. For example, the Helm client adds references to chart...

Zoom Client for Meetings < 5.7.3 Vulnerability (ZSB-22002)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.7.3. It is, therefore, affected by a vulnerability as referenced in the ZSB-22002 advisory. - The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks in the following product versions...

Zoom Client for Meetings < 5.6.3 Vulnerability (ZSB-22002)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.6.3. It is, therefore, affected by a vulnerability as referenced in the ZSB-22002 advisory. - The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks in the following product versions...

The vulnerability of the AVEVA Edge SCADA system, related to bypassing the path when using the UNC resource for Windows, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the AVEVA Edge SCADA system relates to bypassing the path when using the UNC path for general Windows resources “\UNC\share\name”. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information by sending a specially crafted HTT...

GHSA-3W37-5P3P-JV92 Apache CXF vulnerable to Exposure of Sensitive Information

A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes...

CVE-2022-46363 Apache CXF directory listing / code exfiltration

A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes...

PT-2022-27839 · Apache · Apache Cxf

Name of the Vulnerable Software and Affected Versions: Apache CXF versions prior to 3.4.10 Apache CXF versions prior to 3.5.5 Description: A vulnerability in Apache CXF allows an attacker to perform a remote directory listing or code exfiltration. This issue arises when the CXFServlet is configur...

Siemens SCALANCE SC-600 Family

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SCALANCE SC-600 Family Vulnerability: Out-of-bounds Write, Use After Free, Allocation of Resources Without Limits or Throttling 2. RISK EVALUATION Successful exploitation of this...

PT-2022-16033 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 9.5.38 TYPO3 versions prior to 10.4.33 TYPO3 versions prior to 11.5.20 TYPO3 versions prior to 12.1.1 Description: Requesting invalid or non-existing resources via HTTP triggers the page error handler, which retrieves...

Tuleap 安全漏洞

Tuleap is an open source application lifecycle management system that facilitates agile software development, design projects, V-modeling, requirements management and IT service management. A security vulnerability exists in versions prior to Tuleap 14.2.99.148, which stems from failure to proper...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to an XML External Entity Injection (CVE-2022-40747)

Summary IBM InfoSphere Information Server is vulnerable to an XML External Entity Injection XXE Vulnerability Details CVEID:CVE-2022-40747 DESCRIPTION: IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker...

CVE-2022-41949

DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. In affected versions an authenticated DHIS2 user can craft a request to DHIS2 to instruct the server to make requests to external resources like third party servers. This could allow...

CVE-2022-41949 Semi-blind Server-Side Request Forgery in dhis2-core

DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. In affected versions an authenticated DHIS2 user can craft a request to DHIS2 to instruct the server to make requests to external resources like third party servers. This could allow...

Default credentials

In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to access AWS resources normally limited to TeamCity system administrators...

DHIS 2 代码问题漏洞

DHIS 2 is a software application. A flexible information system for data capture, management, validation, analysis and visualization. A code issue vulnerability exists in DHIS 2 core versions 2.34, 2.35, 2.36, 2.37, 2.38, and 2.39, which arises from the fact that an authenticated DHIS2 user can...

The vulnerability of the Advanced Local Procedure Call (ALPC) handler in the Windows operating system allows attackers to enhance their privileges within the system.

The vulnerability of the Advanced Local Procedure Call ALPC in the Windows operating system arises due to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to increase their privileges within the system...