PT-2022-05: Stored Cross-Site Scripting (XSS)

Input validation was missing while creating the schedule task in alarm reports dashboard. An attacker can create a script to inject XSS. The attack can only be performed by an internal user. The vulnerability is fixed in NetAct 22 FP2211 and onwards. Advisory status 10.10.2022 - Vendor gets...

GSD-2022-1006490 mm: slub: fix flush_cpu_slab()/__free_slab() invocations in task context.

mm: slub: fix flushcpuslab/freeslab invocations in task context. This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0 by commit...

Denial of Service (DoS)

Overview fatfreecrm is a customer relationship management platform. Affected versions of this package are vulnerable to Denial of Service DoS in the findallgrouped function in models/polymorphic/task.rb, by users with bucket access. Details Denial of Service DoS describes a family of attacks, all...

PT-2022-34790 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.12 Description: The issue is related to the slub component in the Linux Kernel, specifically with the flush cpu slab and free slab functions being invoked in a task context. The actual impact and attack...

Wordpress Zephyr Project Manager 3.2.42 Plugin - Multiple SQL injection Vulnerabilities

Exploit Title: Wordpress Plugin Zephyr Project Manager 3.2.42 - Multiple SQLi Exploit Author: Rizacan Tufan Blog Post: https://rizax.blog/blog/wordpress-plugin-zephyr-project-manager-multiple-sqli-authenticated Software Link: https://wordpress.org/plugins/zephyr-project-manager/ Vendor Homepage:...

Malicious Command Execution

xxl-job-core is vulnerable to malicious command execution. Lack of sanitization of new task in task management module of the background management allows an attacker to inject and execute malicious commands...

PT-2022-34653 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.145 Description: A potential security issue exists due to a missing lock in the cgroup attach task all function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Lin...

PT-2022-34585 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.19.9 through v5.19.11 Description: A potential security issue exists due to a missing cpus read lock call in the cgroup attach task all function. The actual impact and attack plausibility have not yet been proven...

ASB-A-238377411

In getBackgroundRestrictionExemptionReason of AppRestrictionController.java, there is a possible way to bypass device policy restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not need...

CVE-2022-39031

Smart eVision has insufficient authorization for task acquisition function. An unauthorized remote attacker can exploit this vulnerability to acquire the Session IDs of other general users only...

Authorization

Smart eVision has insufficient authorization for task acquisition function. An unauthorized remote attacker can exploit this vulnerability to acquire the Session IDs of other general users only...

CVE-2022-39031

CVE-2022-39031 affects Smart eVision where insufficient authorization in the Task Acquisition function can let an unauthorized remote attacker obtain other general users’ Session IDs. The NVD reports a CVSS v3.1 base score of 5.3 (Network, Low attack complexity, Privileges required: None, Confide...

CVE-2022-39031: Exposure of Sensitive Information to an Unauthorized Actor

Smart eVision has insufficient authorization for task acquisition function. An unauthorized remote attacker can exploit this vulnerability to acquire the Session IDs of other general users only...

XXL-JOB 操作系统命令注入漏洞

XXL-JOB is a distributed task scheduling platform based on java language from XU Xueli XXL-JOB community. XXL-JOB version 2.2.0 suffers from an operating system command injection vulnerability, which stems from a command execution vulnerability in a background task...

Smart eVision 安全漏洞

Smart eVision Information Technology Smart eVision is a business intelligence platform of China Union Quan Information Technology Smart eVision Information Technology Company. It can integrate business management rooms, dashboards, reports, and input interfaces for business operations management...

Design/Logic Flaw

In ambiot amb1sdk aka SDK for Ameba1 before 2022-06-20 on Realtek RTL8195AM devices before 284241d70308ff2519e40afd7b284ba892c730a3, the timer task and RX task would be locked when there are frequent and continuous Wi-Fi connection with four-way handshake failures in Soft AP mode...

CVE-2022-34326

CVE-2022-34326 affects amb1_sdk (SDK for Ameba1) on Realtek RTL8195AM devices. The issue occurs before 2022-06-20 and before the build 284241d70308ff2519e40afd7b284ba892c730a3, where the timer task and RX task can become locked during frequent, persistent Wi‑Fi connection failures in Soft AP mode...

Realtek RTL8195AM 安全漏洞

The Realtek RTL8195AM is an IoT microcontroller from China-based Realtek Semiconductor Realtek. A security vulnerability exists in previous versions of the Realtek RTL8195AM 284241d70308ff2519e40afd7b284ba892c730a3, which stems from the ability to lock the timer task when there are frequent and...

CVE-2022-34326

In ambiot amb1sdk aka SDK for Ameba1 before 2022-06-20 on Realtek RTL8195AM devices before 284241d70308ff2519e40afd7b284ba892c730a3, the timer task and RX task would be locked when there are frequent and continuous Wi-Fi connection with four-way handshake failures in Soft AP mode...

CVE-2022-34326: Uncontrolled Resource Consumption

In ambiot amb1sdk aka SDK for Ameba1 before 2022-06-20 on Realtek RTL8195AM devices before 284241d70308ff2519e40afd7b284ba892c730a3, the timer task and RX task would be locked when there are frequent and continuous Wi-Fi connection with four-way handshake failures in Soft AP mode...