PT-2022-8039 · Paint.Net · Paint.Net

Name of the Vulnerable Software and Affected Versions: Paint.NET versions prior to 4.1.2 Description: The issue allows deserialization of untrusted data. Recommendations: For versions prior to 4.1.2, update to version 4.1.2 or later to resolve the issue...

bingo!CMS vulnerable to authentication bypass

Overview bingo!CMS provided by Shift Tech Inc. contains an authentication bypass vulnerability CWE-288 in some of the management functions. Shift Tech Inc. states that attacks exploiting this vulnerability have been observed. Shift Tech Inc. reported this vulnerability to IPA to notify users of i...

Description of the security update for Office 2013: October 11, 2022 (KB5002279)

Description of the security update for Office 2013: October 11, 2022 KB5002279 Summary This security update resolves a Microsoft Office remote code execution vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2022-38048. Note: To apply thi...

PT-2022-25931 · Gnu +2 · Gnu Osip +2

Name of the Vulnerable Software and Affected Versions: GNU oSIP version 5.3.0 Description: The issue is related to an integer overflow in the osip body parse header component. Recommendations: For GNU oSIP version 5.3.0, update to a version that fixes the integer overflow issue in the osip body...

JVN#74592196: bingo!CMS vulnerable to authentication bypass

bingo!CMS provided by Shift Tech Inc. contains an authentication bypass vulnerability CWE-288 in some of the management functions. Shift Tech Inc. states that attacks exploiting this vulnerability have been observed. Impact Accessing a specific URL directly may allow a remote unauthenticated...

PT-2022-26317 · Unknown · Wedding Planner

Name of the Vulnerable Software and Affected Versions: Wedding Planner version 1.0 Description: The issue allows for arbitrary code execution via the "package edit.php" endpoint. Recommendations: For version 1.0, update to a version that fixes this issue, if available, or consider disabling acces...

PT-2022-21137 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: Gogs versions v0.6.5 through v0.12.10 Description: The issue is related to Stored Cross-Site Scripting XSS that can lead to an account takeover. Recommendations: For versions v0.6.5 through v0.12.10, update to a version that is not affected b...

PT-2022-25261 · Siemens · Desigo Pxm40-1 +9

Name of the Vulnerable Software and Affected Versions: Desigo PXM30-1 versions prior to V02.20.126.11-41 Desigo PXM30.E versions prior to V02.20.126.11-41 Desigo PXM40-1 versions prior to V02.20.126.11-41 Desigo PXM40.E versions prior to V02.20.126.11-41 Desigo PXM50-1 versions prior to...

PT-2022-6418 · Adobe · Acrobat Reader

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat Reader versions 22.002.20212 and earlier Adobe Acrobat Reader versions 20.005.30381 and earlier Description: The issue is a Stack-based Buffer Overflow that could result in arbitrary code execution in the context of the current...

PT-2022-34765 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.12 Description: The issue arises when the function to allocate a gendisk fails, but the code still attempts to call blk put queue. This could potentially lead to security vulnerabilities, although the actu...

PT-2022-34842 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.146 Description: The issue is related to the taprio component in the Linux Kernel, where offload can be disabled even if it was never enabled. The actual impact and attack plausibility have not yet been...

PT-2022-34756 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0 Description: A use-after-free issue has been identified. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v5.7 and is fixed in Linux Kernel version...

MGASA-2022-0360 Updated enlightenment packages fix security vulnerability

Updated enlightenment package to fix the security vulnerability, CVE-2022-37706 that would allow an user to gain root privileges...

CVE-2022-40684: Remote Authentication Bypass Vulnerability in Fortinet Firewalls, Web Proxies

Emergent threats evolve quickly, and as we learn more about this vulnerability, this blog post will evolve, too. On October 3, 2022, Fortinet released a software update that indicates then-current versions of their FortiOS firewall and FortiProxy web proxy software are vulnerable to CVE-2022-4068...

Vulnerability Spotlight: Issue in Hancom Office 2020 could lead to code execution

Marcin “Icewall” Noga of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos recently discovered an exploitable memory corruption vulnerability in Hancom Office 2020. Hancom Office is a popular software collection among South Korean users that offers similar products to...

SUSE-SU-2022:3550-1 Security update for xmlgraphics-commons

This update for xmlgraphics-commons fixes the following issues: - Update to version 2.6 - CVE-2020-11988: Fixed a server-side request forgery caused by improper input validation by the XMPParser. bsc281607...

PT-2022-23672 · Unknown · Mousenkeyhiddevice

Name of the Vulnerable Software and Affected Versions: MouseNKeyHidDevice versions prior to SMR Oct-2022 Release 1 Description: The issue is related to the improper restriction of broadcasting Intent in MouseNKeyHidDevice, which leaks the MAC address of the connected Bluetooth device...

PT-2022-25038 · Samsung · Knox Vpn Policy

Name of the Vulnerable Software and Affected Versions: knox vpn policy versions prior to SMR Oct-2022 Release 1 Description: The issue is related to improper access control in the knox vpn policy service, which allows unauthorized read access to configuration data. Recommendations: For versions...

PT-2022-25037 · Unknown · At Distributor

Name of the Vulnerable Software and Affected Versions: AT Distributor versions prior to SMR Oct-2022 Release 1 Description: The issue allows a local attacker to access sensitive information, specifically the SerialNo, via log exposure. Recommendations: For versions prior to SMR Oct-2022 Release 1...

SUSE-SU-2022:3531-1 Security update for squid

This update for squid fixes the following issues: Updated squid to version 5.7: - CVE-2022-41317: Fixed exposure of sensitive information in cache manager bsc1203677. - CVE-2022-41318: Fixed buffer overread in SSPI and SMB Authentication bsc1203680...