PT-2022-19636 · Cybozu · Cybozu Garoon

Name of the Vulnerable Software and Affected Versions: Cybozu Garoon affected versions not specified Description: A browse restriction bypass issue in Cybozu Garoon allows a remote authenticated attacker to obtain Bulletin data. Recommendations: At the moment, there is no information about a newe...

JVN#14077132: Multiple vulnerabilities in Cybozu Garoon

Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below. CyVDB-2909 Operation restriction bypass in multiple applications CWE-285 - CVE-2022-30602 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L| Base Score: 5.4 CVSS v2|...

CVE-2022-1981

An issue has been discovered in GitLab EE affecting all versions starting from 12.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. In GitLab, if a group enables the setting to restrict access to users belonging to specific domains, that allow-list may be bypassed if a Maintaine...

CVE-2022-1981

An issue has been discovered in GitLab EE affecting all versions starting from 12.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. In GitLab, if a group enables the setting to restrict access to users belonging to specific domains, that allow-list may be bypassed if a Maintaine...

CVE-2022-1981

GitLab EE vulnerability CVE-2022-1981 affects GitLab EE versions from 12.2 up to <14.10.5, 15.0 up to <15.0.4, and 15.1 up to

PT-2022-7447 · Net Snmp +8 · Net-Snmp +8

Name of the Vulnerable Software and Affected Versions: net-snmp versions prior to 5.9.2 Description: The issue is related to a NULL pointer dereference in the nsVacmAccessTable component of the net-snmp software. This can be caused by a user with read-write credentials using a malformed OID in a...

PT-2022-7448 · Net Snmp +8 · Net-Snmp +8

Name of the Vulnerable Software and Affected Versions: net-snmp versions prior to 5.9.2 Description: The issue is related to a NULL pointer dereference in the NET-SNMP-AGENT-MIB::nsLogTable function. A user with read-write credentials can use a malformed OID in a SET request to cause this issue. ...

PT-2022-22347 · Jenkins · Jenkins Deployment Dashboard Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Deployment Dashboard Plugin versions 1.0.10 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because environment names on the Deployment Dashboard view are not properly escape...

PT-2022-22348 · Jenkins · Jenkins Deployment Dashboard Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Deployment Dashboard Plugin versions 1.0.10 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. This issue...

PT-2022-22351 · Jenkins · Jenkins Deployment Dashboard Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Deployment Dashboard Plugin versions 1.0.10 and earlier Description: The issue concerns the storage of a password in an unencrypted form in the global configuration file on the Jenkins controller. This file, specifically...

PT-2022-22355 · Jenkins · Jenkins Opsgenie Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins OpsGenie Plugin versions 1.9 and earlier Description: The issue concerns the storage of API keys in an unencrypted manner within the global configuration file and job config.xml files on the Jenkins controller. These keys can be...

Access Restriction Bypass

Overview ruby-mysql is a MySQL connector. pure Ruby version Affected versions of this package are vulnerable to Access Restriction Bypass. A malicious MySQL server can request local file content from a client using without explicit authorization from the user. Remediation Upgrade ruby-mysql to...

The vulnerability of the HTTP File Server (+WebDAV) file server for operating systems based on Android allows a hacker to gain access to read, modify, or delete files.

The vulnerability of the HTTP File Server +WebDAV file server for Android operating systems is related to incorrect path name restrictions for restricted access directories. Exploiting this vulnerability can allow an attacker to gain read, modify, or delete file access rights...

PT-2022-7987 · Trueconf · Trueconf Server

Name of the Vulnerable Software and Affected Versions: TrueConf Server version 4.3.7 Description: A problematic issue affects some unknown functionality of the file "/admin/conferences/list/". The manipulation of the argument domxss leads to basic cross site scripting DOM. The attack may be...

CVE-2022-31096

Discourse (open source discussion platform) has a vulnerability where a logged-in user can redeem an invite with an email that doesn’t match the invite or violates the invite’s email domain restriction, potentially leading to viewing content restricted to certain groups. The issue is worsened whe...

CVE-2022-31096 Invites restricted to an email or invite links restricted to an email domain may be bypassed by a under certain conditions in Discourse

Discourse is an open source discussion platform. Under certain conditions, a logged in user can redeem an invite with an email that either doesn't match the invite's email or does not adhere to the email domain restriction of an invite link. The impact of this flaw is aggravated when the invite h...

PT-2022-20524 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse affected versions not specified Description: The issue allows a logged-in user to redeem an invite with an email that either doesn't match the invite's email or does not adhere to the email domain restriction of an invite link. This...

PT-2022-22017 · Benjamin Balet · Jorani

Name of the Vulnerable Software and Affected Versions: Benjamin BALET Jorani version 1.0 Description: The issue is a SQL injection vulnerability that can be exploited via the id parameter at the application/controllers/Leaves.php endpoint. This vulnerability allows for potential unauthorized acce...

PT-2022-22019 · Benjamin Balet · Jorani

Name of the Vulnerable Software and Affected Versions: Benjamin BALET Jorani version 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF in the component /application/controllers/Users.php. This allows for unauthorized actions to be performed on behalf of a user without the...

PT-2022-20942 · 3S Smart Software Solutions · Codesys Gateway Server

Name of the Vulnerable Software and Affected Versions: CODESYS Gateway Server V2 versions prior to V2.3.9.38 Description: The issue allows an attacker to perform authentication by specifying a small password that matches a part of the longer real CODESYS Gateway password, as only a part of the...