PT-2022-20058 · Festo · Festo Controller Cecc-X-M1

Name of the Vulnerable Software and Affected Versions: Festo Controller CECC-X-M1 product family affected versions not specified Description: The issue concerns the http-endpoint "cecc-x-web-viewer-request-on" POST request, which does not check for port syntax. This can result in unauthorized...

CVE-2022-30309

In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection...

CVE-2022-30310

In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection...

CVE-2022-30311

In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-refresh-request" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection...

CVE-2022-30308

In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection...

Autodesk Design Review Buffer Overflow

The vulnerability of the TGA file syntax analysis implementation in the Autodesk Design Review software relates to the writing beyond buffer boundaries in memory during DWG file syntax analysis. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code in the context o...

GHSA-HR8G-F6R6-MR22 Buffer over-flow in Pillow

When reading a TGA file with RLE packets that cross scan lines, Pillow reads the information past the end of the first line without deducting that from the length of the remaining file data. This vulnerability was introduced in Pillow 9.1.0, and can cause a heap buffer overflow. Opening an image...

GHSA-Q5RG-WG7H-73M5 LibreNMS Information Disclosure

An issue was discovered in LibreNMS through 1.47. The scripts that handle graphing options html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with...

Artifex MuJS code-related vulnerabilities

Artifex Software Artifex MuJS is a lightweight JavaScript interpreter from Artifex Software, which is used to embed into other software to provide script execution functionality. vulnerability, which stems from the existence of a null pointer dereference in jsPdumpsyntax in jsdump.c. An attacker...

ClamAV Cisco AMP DoS

The vulnerability of the ClamAV antivirus software library and the Cisco AMP tool for protecting against malicious software in end devices is related to resource management errors during CHM file syntax analysis. Exploiting this vulnerability can allow a remote attacker to cause service...

[SECURITY] Fedora 36 Update: curl-7.82.0-5.fc36

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

org.xwiki.commons:xwiki-commons-legacy-velocity (>=10.7-rc-1, <=12.6.6), org.xwiki.rendering:xwiki-rendering-syntax-xwiki10 (>=3.2-milestone-3, <=7.4.6) +1 more potentially affected by CVE-2022-24897 via org.xwiki.commons:xwiki-commons-velocity (>=3.2-milestone-3, <=12.6.6)

org.xwiki.commons:xwiki-commons-velocity MAVEN version =3.2-milestone-3, =10.7-rc-1, =3.2-milestone-3, =4.3-milestone-2, =12.6.6 Source cves: CVE-2022-24897 Source advisory: MEND:CVE-2022-24897...

GHSA-H7MF-QRM9-2848 OpenSymphony XWork vulnerable to improper input validation

XWork is an command-pattern framework that is used to power WebWork as well as other applications. Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language OGNL expression...

org.xwiki.commons:xwiki-commons-legacy-velocity (>=10.7-rc-1, <=12.6.6), org.xwiki.rendering:xwiki-rendering-syntax-xwiki10 (>=3.2-milestone-3, <=7.4.6) +1 more potentially affected by CVE-2022-24897 via org.xwiki.commons:xwiki-commons-velocity (>=3.2-milestone-3, <=12.6.6)

org.xwiki.commons:xwiki-commons-velocity MAVEN version =3.2-milestone-3, =10.7-rc-1, =3.2-milestone-3, =4.3-milestone-2, =12.6.6 Source cves: CVE-2022-24897 Source advisory: OSV:GHSA-CVX5-M8VG-VXGC...

org.xwiki.commons:xwiki-commons-legacy-velocity (>=10.7-rc-1, <=12.6.6), org.xwiki.rendering:xwiki-rendering-syntax-xwiki10 (>=3.2-milestone-3, <=7.4.6) +1 more potentially affected by CVE-2022-24897 via org.xwiki.commons:xwiki-commons-velocity (>=3.2-milestone-3, <=12.6.6)

org.xwiki.commons:xwiki-commons-velocity MAVEN version =3.2-milestone-3, =10.7-rc-1, =3.2-milestone-3, =4.3-milestone-2, =12.6.6 Source cves: CVE-2022-24897 Source advisory: GHSA-CVX5-M8VG-VXGC...

Firefox Thunderbird Regex DoS

The vulnerability of the regular expression validation implementation in Firefox web browsers, Firefox ESR, and Thunderbird email client is related to errors in syntax analysis of input data. Exploiting this vulnerability allows an attacker to cause service interruptions using specially crafted...

CVE-2021-31805: Improper Neutralization of Special Elements used in an Expression Language Statement

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %... syntax. Using forced OGNL evaluation on untrusted user input can lead to a...

[SECURITY] Fedora 35 Update: fish-3.4.1-1.fc35

fish is a fully-equipped command line shell like bash or zsh that is smart and user-friendly. fish supports powerful features like syntax highlighting, autosuggestions, and tab completions that just work, with nothing to learn or configure...

[SECURITY] Fedora 36 Update: fish-3.4.1-1.fc36

fish is a fully-equipped command line shell like bash or zsh that is smart and user-friendly. fish supports powerful features like syntax highlighting, autosuggestions, and tab completions that just work, with nothing to learn or configure...

[SECURITY] Fedora 34 Update: gitit-0.13.0.0-5.1.fc34

Gitit is a wiki backed by a git, darcs, or mercurial filestore. Pages and uploaded files can be modified either directly via the VCS's command-line too ls or through the wiki's web interface. Pandoc is used for markup processing, so pages may be written in extended markdown, reStructuredText,...