PT-2022-31149

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.17.15 Description The issue is related to the s390/gmap voluntarily scheduling during key setting. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-31727

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.122 Description The issue is related to the s390/gmap voluntarily scheduling during key setting. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update

The plugin does not have proper authorisation in one of its REST endpoint, allowing unauthenticated users to update the "Toggle thecontent filter" setting POST /wp-json/yikes/cpt/v1/settings HTTP/1.1 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type:...

PT-2022-30791

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.18.4 Description The issue is related to the s390/gmap, which voluntarily schedules during key setting. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update

The plugin does not have proper authorisation in one of its REST endpoint, allowing unauthenticated users to update the "Toggle thecontent filter" setting PoC POST /wp-json/yikes/cpt/v1/settings HTTP/1.1 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type:...

CVE-2022-1845

The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete plugin's data, update the settings, add new entries and more via CSRF attacks...

PT-2022-14146

Name of the Vulnerable Software and Affected Versions PDF24 Article To PDF WordPress plugin versions 4.2.2 and earlier Description The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. This cou...

PT-2022-14149

Name of the Vulnerable Software and Affected Versions Amazon Einzeltitellinks WordPress plugin versions 1.3.3 and earlier Description The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. This...

PT-2022-14177

Name of the Vulnerable Software and Affected Versions underConstruction WordPress plugin versions prior to 1.21 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization or escaping of the Display a custom page using your own HTML...

WooCommerce PDF Invoices & Packing Slips < 2.16.0 - Reflected Cross-Site Scripting

The plugin doesn't escape a parameter on its setting page, making it possible for attackers to conduct reflected cross-site scripting attacks. PoC https://example.com/wp-admin/admin.php?page=wpowcpdfoptionspage=xxxxx%22+accesskey%3DX+onclick%3Dalert%281%29+test%3D%22...

Ghost vulnerable to remote code execution in locale setting change

Impact A vulnerability in an upstream library means an authenticated attacker can abuse locale input to execute arbitrary commands from a file that has previously been uploaded using the file upload functionality in the post editor. Patches Fixed in 5.2.3, all 5.x sites should update as soon as...

GHSA-7V28-G2PQ-GGG8 Ghost vulnerable to remote code execution in locale setting change

Impact A vulnerability in an upstream library means an authenticated attacker can abuse locale input to execute arbitrary commands from a file that has previously been uploaded using the file upload functionality in the post editor. Patches Fixed in 5.2.3, all 5.x sites should update as soon as...

CVE-2022-33175

Power Distribution Units running on Powertek firmware multiple brands before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/getparam.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrator...

CVE-2022-31757

The setting module has a vulnerability of improper use of APIs. Successful exploitation of this vulnerability may affect data confidentiality...

CVE-2022-31757

The setting module has a vulnerability of improper use of APIs. Successful exploitation of this vulnerability may affect data confidentiality...

Design/Logic Flaw

The setting module has a vulnerability of improper use of APIs. Successful exploitation of this vulnerability may affect data confidentiality...

CVE-2022-31757

Technical details, affected products, and remediation are not publicly provided in the supplied documents. Monitor updates from Red Hat, NVD, and other sources for concrete impact and fixes.

CVE-2022-1749

The WPMK Ajax Finder WordPress plugin is vulnerable to Cross-Site Request Forgery via the createpluginatfadminsettingpage function found in the /inc/config/create-plugin-config.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up to and...

CVE-2022-32739

When Secure::DisableBanner system configuration has been disabled and agent shares his calendar via public URL, received ICS file contains OTRS release number...

PT-2022-20908

Name of the Vulnerable Software and Affected Versions Setting module affected versions not specified Description The issue concerns the improper use of APIs within the setting module. This could potentially impact data confidentiality if successfully exploited. Recommendations At the moment, ther...