PT-2022-25706 · Sap · Sap 3D Visual Enterprise Author

Name of the Vulnerable Software and Affected Versions: SAP 3D Visual Enterprise Author version 9 Description: The issue arises due to improper memory management when a user opens a manipulated Windows Cursor File .cur, .ico.x3d from untrusted sources. This can cause the application to crash,...

PT-2022-24021

Name of the Vulnerable Software and Affected Versions webpack loader-utils version 2.0.0 Description A Regular expression denial of service ReDoS flaw was found in the interpolateName function in interpolateName.js via the resourcePath variable. This issue could be exploited by sending crafted...

GSD-2022-1006545 smb3: fix temporary data corruption in insert range

smb3: fix temporary data corruption in insert range This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.12 by commit...

GSD-2022-1006502 smb3: fix temporary data corruption in collapse range

smb3: fix temporary data corruption in collapse range This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0 by commit...

EulerOS Virtualization 3.0.6.6 : emacs (EulerOS-SA-2022-2494)

According to the versions of the emacs packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on the...

PT-2022-34834 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.146 Description: The issue is related to a potential stack overflow in the mlxbf i2c smbus start transaction function. The actual impact and attack plausibility have not yet been proven. Recommendations: F...

PT-2022-23615 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue allows an authenticated user to obtain sensitive information that should only be available to a privileged user. Recommendations: For IBM InfoSphere Information Server...

PT-2022-25566 · Unknown · Codeigniter

Name of the Vulnerable Software and Affected Versions: CodeIgniter versions =3.1.13 Description: The issue concerns SQL Injection via the or where in function in the system/database/DB query builder.php file. Note that the validity of this issue has been disputed by multiple third parties...

CVE-2022-39270

DiscoTOC is a Discourse theme component that generates a table of contents for topics. Users that can create topics in TOC-enabled categories and have sufficient trust level - configured in component's settings are able to inject arbitrary HTML on that topic's page. The issue has been fixed on th...

netty: world readable temporary file containing sensitive data

CVE-2021-21290 contains an incomplete fix, and this addresses the issue found in netty. When using multipart decoders in netty, local information disclosure can occur via the local system temporary directory if temporary storing of uploads on the disk is enabled...

PT-2022-34624 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.70 Description: The issue is related to an off-by-one error in the unflatten dt nodes function. This error was introduced in version v4.7 and fixed in version v5.15.70. The actual impact and attack...

CVE-2022-34428

Dell Hybrid Client prior to version 1.8 contains a Regular Expression Denial of Service Vulnerability in the UI. An adversary with WMS group admin access could potentially exploit this vulnerability, leading to temporary denial-of-service...

Design/Logic Flaw

Dell Hybrid Client prior to version 1.8 contains a Regular Expression Denial of Service Vulnerability in the UI. An adversary with WMS group admin access could potentially exploit this vulnerability, leading to temporary denial-of-service...

PT-2022-22606

Name of the Vulnerable Software and Affected Versions Bus Pass Management System version 1.0 Description A SQL Injection issue was found in the Bus Pass Management System. The vulnerability can be exploited via the searchdata parameter at the "/buspassms/download-pass.php" API endpoint...

PT-2022-26094 · Xpdf +1 · Xpdf +1

Name of the Vulnerable Software and Affected Versions: Xpdf version 4.04 Description: A problem has been detected in the convertToType0 function in the fofi/FoFiType1C.cc file, causing a crash. This issue is distinct from other known vulnerabilities. Recommendations: For Xpdf version 4.04, consid...

PT-2022-26093 · Xpdf +1 · Xpdf +1

Name of the Vulnerable Software and Affected Versions: Xpdf version 4.04 Description: An issue was discovered that causes a crash in the gfseek IO FILE, long, int function in the goo/gfile.cc file. Recommendations: For Xpdf version 4.04, as a temporary workaround, consider disabling the gfseek...

CVE-2022-28813

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of an SQL-injection to gain access to a volatile temporary database with the current states of the device...

Sql injection

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of an SQL-injection to gain access to a volatile temporary database with the current states of the device...

Carlo Gavazzi UWP SQL注入漏洞

Carlo Gavazzi UWP is a monitoring and control Universal Web Platform from Carlo Gavazzi. It is used for applications such as building automation, energy efficiency performance management and parking lot guidance. A SQL injection vulnerability exists in Carlo Gavazzi UWP 3.0, which can be exploite...

Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Thunderbird users who use the Matrix chat protocol being vulnerable to a denial of service attack. An adversary sharing a room with a user could attack affected clients, making it not show all of a user's...