PT-2022-36299 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.156 Description: The issue is related to close race conditions on sk receive queue. The actual impact and attack plausibility have not yet been proven. It was introduced in version v4.6 and fixed in Linux...

PT-2022-36214 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.79 Description: A potential issue exists in the Linux Kernel, which may cause a panic on frag list with mixed head alloc types. The actual impact and attack plausibility have not yet been proven...

PT-2022-36548 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.300 Description: The issue is related to the misuse of put device in mISDN register device. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2022-36414 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.225 Description: The issue is related to a use-after-free in the snd soc exit function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior t...

PT-2022-27982 · Jetbrains · Jetbrains Intellij Idea

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2022.3 Description: The built-in web server in JetBrains IntelliJ IDEA leaked information about open projects. Recommendations: For versions prior to 2022.3, update to version 2022.3 or later to resol...

PT-2022-27408 · Unknown · Movable Type Premium +3

Name of the Vulnerable Software and Affected Versions: Movable Type versions 7 r.5301 and earlier Movable Type Advanced versions 7 r.5301 and earlier Movable Type versions 6.8.7 and earlier Movable Type Advanced versions 6.8.7 and earlier Movable Type Premium version 1.53 and earlier Movable Type...

PT-2022-26454 · Basercms · Basercms

Name of the Vulnerable Software and Affected Versions: baserCMS versions prior to 4.7.2 Description: The issue allows a remote authenticated attacker with administrative privileges to inject an arbitrary script in the User group management of baserCMS. This is a stored cross-site scripting issue...

PT-2022-14638 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-10 through Android-13 Description: The issue is related to a possible out of bounds write in the avdt msg asmbl function of avdt msg.cc due to a missing bounds check. This could lead to remote code execution over...

PT-2022-6543 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 16.2 iPadOS versions prior to 16.2 Description: A logic issue was addressed with improved restrictions, allowing a user with physical access to a locked Apple Watch to potentially view user photos via accessibility...

Upgrade OpenSearch to 1.3.7 to mitigate CVE-2022-42889

In BSERV-13534 commons-text usages were upgraded in the Bitbucket Webapp to mitigate against CVE-2022-42889 although Bitbucket WebApp was actually unaffected. The bundled OpenSearch should also be updated to 1.3.7 when it is released. The release date is currently scheduled for 13-Dec-2022:...

PT-2022-21878 · Fortinet · Fortiadc

Name of the Vulnerable Software and Affected Versions: Fortinet FortiADC versions 6.2.4 and below Fortinet FortiADC versions 7.0.0 through 7.0.2 Fortinet FortiADC version 7.1.0 Description: An improper neutralization of special elements used in an SQL Command 'SQL Injection' vulnerability allows ...

PT-2022-27656 · WordPress · Contest Gallery

Name of the Vulnerable Software and Affected Versions: Contest Gallery plugin versions = 13.1.0.9 Description: The issue is related to an Unauth. Stored Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be stored on the website, potentially affecting user sessions...

PT-2022-27466 · Kwoksys · Kwok Information Server

Name of the Vulnerable Software and Affected Versions: Kwoksys Kwok Information Server versions prior to 2.9.5.SP31 Description: An XML external entity XXE injection issue allows remote authenticated users to conduct server-side request forgery SSRF attacks. This enables attackers to manipulate t...

PT-2022-25284 · Xylus Themes · Xylus Themes Wp Smart Import

Name of the Vulnerable Software and Affected Versions: Xylus Themes WP Smart Import plugin versions 1.0.2 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability affects the Xylus Themes WP Smart Import plugin on WordPress,...

CVE-2022-46169 Unauthenticated Command Injection

Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data...

PT-2022-27862 · Veritas · Veritas Netbackup Access Appliance +1

Name of the Vulnerable Software and Affected Versions: Veritas NetBackup Flex Scale versions 1.0 through 3.0 Veritas NetBackup Access Appliance versions 1.0 through 8.0.100 Description: An issue was discovered that allows authenticated remote command execution via the management portal...

PT-2022-25644 · WordPress · 2Kb Amazon Affiliates Store Plugin

Name of the Vulnerable Software and Affected Versions: 2kb Amazon Affiliates Store plugin versions =2.1.5 Description: The issue is a Reflected Cross-Site Scripting XSS vulnerability. This means an attacker can inject malicious scripts into a website, potentially stealing user data or taking...

ConnectWise Quietly Patches Flaw That Helps Phishers

ConnectWise, which offers a self-hosted, remote desktop software application that is widely used by Managed Service Providers MSPs, is warning about an unusually sophisticated phishing attack that can let attackers take remote control over user systems when recipients click the included link. The...

PT-2022-19784 · Delta Industrial Automation · Dialink

Name of the Vulnerable Software and Affected Versions: Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 Description: The issue arises from the software's failure to properly neutralize special elements within a pathname constructed from external input. This pathname is intend...

PT-2022-26957 · Aruba · Aruba Edgeconnect Enterprise

Name of the Vulnerable Software and Affected Versions: Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.2.1.1 Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.1.3.1 Aruba EdgeConnect Enterprise Software versions prior to ECOS 9.0.7.1 Aruba EdgeConnect Enterprise Softwa...