PT-2022-15402 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX and Windows versions 9.7, 10.1, 10.5, 11.1, and 11.5 Description: The issue allows an authenticated user to execute specially crafted SQL statements, potentially causing the server to terminate abnormally, resulting in...

PT-2022-22077 · Jenkins · Jenkins Beaker Builder Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Beaker builder Plugin versions 1.10 and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to an attacker-specified URL. This can be exploited by attackers to perform unauthorized actions...

PT-2022-3073 · Brocade · Brocade Sannav +1

Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions prior to 2.2.0.2 Brocade SANnav versions prior to 2.1.1.8 Description: The issue is related to the storage of sensitive information in plain text. Specifically, the Brocade Fabric OS switch password is logged in plain...

WEM deletes registry set by a GPO

Administrator restricted some application execution say PowerShell, Command Prompt through Group Policy which sets following registry and WEM delets it. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun...

PT-2022-20361 · Unknown · Nukeviet Cms

Name of the Vulnerable Software and Affected Versions: NukeViet CMS versions prior to 4.5.02 Description: The issue is related to a Cross Site Scripting Stored XSS vulnerability. This means that an attacker can inject malicious scripts into the website, which can then be executed by other users. ...

PT-2022-21964 · Comodo · Comodo Antivirus

Name of the Vulnerable Software and Affected Versions: Comodo Antivirus version 12.2.2.8012 Description: The issue is related to a quarantine flaw that allows privilege escalation. A low-privileged attacker can exploit this by using an NTFS directory junction to restore a malicious DLL from...

CVE-2022-1614

CVE-2022-1614 affects the WP-EMail WordPress plugin up to version 2.69.0. The root cause is that the plugin prioritizes obtaining a visitor IP from certain HTTP headers (e.g., HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR) over PHP’s REMOTE_ADDR, enabling an attacker to bypass IP-based anti-spam restricti...

MAL-2022-3863 Malicious code in intercom-react-native-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1fcd283f1ce396af81c959bb56b8fd32a56f22617596e78bebdaf08d500a1b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

USN-5486-1: Intel Microcode vulnerabilities

It was discovered that some Intel processors did not implement sufficient control flow management. A local attacker could use this to cause a denial of service. CVE-2021-0127 Joseph Nuzman discovered that some Intel processors did not properly initialise shared resources. A local attacker could u...

SUSE-SU-2022:2111-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP1 kernel was updated. The following security bugs were fixed: - CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. bsc1199650 - CVE-2022-21123: Fixed a stale MMIO data...

PT-2022-14867 · Inventree · Inventree

Name of the Vulnerable Software and Affected Versions: inventree versions prior to 0.7.2 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the GitHub repository inventree/inventree. This type of attack occurs when an application stores user input and later...

PT-2022-20669 · Unknown · Dlt-Daemon

Name of the Vulnerable Software and Affected Versions: dlt-daemon version 2.18.8 Description: An issue in the dlt config file parser.c file allows attackers to cause a double free via crafted TCP packets. This can be exploited by sending specifically crafted packets to the affected system...

PT-2022-20988 · Unknown · Zoo Management System

Name of the Vulnerable Software and Affected Versions: Zoo Management System version 1.0 Description: The issue is related to Cross Site Scripting XSS in the Zoo Management System. The vulnerability can be exploited via the "zms/admin/public html/save animal?an id=24" API endpoint, specifically...

PT-2022-21718 · Trend Micro · Trend Micro Vpn Proxy One Pro

Name of the Vulnerable Software and Affected Versions: Trend Micro VPN Proxy Pro versions 5.2.1026 and below Description: The issue involves overly permissive folders in a key directory, which could allow a local attacker to obtain privilege escalation on an affected system. Recommendations: For...

PT-2022-21216 · Unknown · Youdiancms

Name of the Vulnerable Software and Affected Versions: YoudianCMS version 9.5.0 Description: A SQL injection issue was discovered via the id parameter at the "/App/Lib/Action/Admin/SiteAction.class.php" endpoint. This allows for potential exploitation. No information is provided about the estimat...

SUSE: Security Advisory (SUSE-SU-2022:2078-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Input validation

Possible assertion due to improper validation of rank restriction field in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile...

CVE-2021-35073

Possible assertion due to improper validation of rank restriction field in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile...

CVE-2022-25167

Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

PT-2022-3588 · Robustel · Robustel R1510

Name of the Vulnerable Software and Affected Versions: Robustel R1510 version 3.3.0 Description: The issue is related to the implementation of the Art2 command in the CLISH Command Line Interface SHell of the Robustel R1510 VPN router's firmware. It is associated with weaknesses in security...