PT-2022-17549 · Samsung · Galaxy Watch Plugin

Name of the Vulnerable Software and Affected Versions: Galaxy Watch Plugin versions prior to 2.2.05.220126741 Description: The issue allows attackers to access user information in log, potentially exposing sensitive data. Recommendations: For Galaxy Watch Plugin versions prior to 2.2.05.220126741...

Elastic Elasticsearch Privilege Escalation Vulnerability (ESA-2022-02)

Elastic Elasticsearch is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2022-23648

containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to...

Node.js 12.x < 12.22.9, 14.x < 14.18.3, 16.x < 16.13.2, 17.x < 17.3.1 Multiple Vulnerabilities - Mac OS X

Node.js is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

PT-2022-9568 · WordPress · Maps Plugin Using Google Maps

Name of the Vulnerable Software and Affected Versions: Maps Plugin using Google Maps for WordPress versions prior to 1.8.1 Description: The issue concerns a lack of proper authorization and CSRF protection in most AJAX actions of the plugin, potentially allowing any authenticated user to delete...

KLA12465 Security vulnerability in LibreOffice

Security vulnerability was found in LibreOffice. Malicious users can exploit this vulnerability to bypass security restrictions. Original advisories Incorrect trust validation of signature with ambiguous KeyInfo children Related products LibreOffice CVE list CVE-2021-25636 critical Solution Updat...

PT-2022-16587 · Okta · Okta Advanced Server Access Client

Name of the Vulnerable Software and Affected Versions: Okta Advanced Server Access Client for Windows versions prior to 1.57.0 Description: The issue is related to command injection via a specially crafted URL. Recommendations: For versions prior to 1.57.0, update to version 1.57.0 or later to...

PT-2022-13358 · Parse-Url +2 · Url-Parse +2

Name of the Vulnerable Software and Affected Versions: url-parse versions prior to 1.5.8 Description: The issue is related to an Authorization Bypass Through User-Controlled Key. This allows for potential unauthorized access. The estimated number of potentially affected devices worldwide is not...

PT-2022-15139 · Mmp +2 · Mmp +2

Name of the Vulnerable Software and Affected Versions: MMP versions prior to 1.0.3 PTP C-series versions prior to 2.8.6.1 PTMP C-series and A5x versions prior to 2.5.4.1 Description: The software uses the MD5 algorithm to hash passwords before storing them but does not salt the hash. As a result,...

PT-2022-15926 · Pcf2Bdf +1 · Pcf2Bdf +1

Name of the Vulnerable Software and Affected Versions: pcf2bdf versions 1.05 and later Description: A segmentation fault during PCF file parsing allows an attacker to trigger a program crash via a specially crafted PCF font file. This crash affects the availability of the software and dependent...

QNAP QTS RCE Vulnerability (QSA-21-57)

QNAP QTS is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts";...

Discourse < 2.8.1 DoS Vulnerability

Discourse is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"...

Discourse 2.9.x < 2.9.0.beta2 DoS Vulnerability

Discourse is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"...

PT-2022-13291 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 1.2.11 Description: The issue is related to improper validation of specified quantity in input, which can lead to business logic errors. This could allow an attacker to manipulate the total value and...

Gitea < 1.15.7 Cookies Vulnerability

Gitea is prone to a cookies reuse vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Gitea < 1.7.0 SSRF Vulnerability

Gitea is prone to a server-side request forgery SSRF vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitea:gitea";...

XWiki RCE Vulnerability (GHSA-mgjw-2wrp-r535)

Xwiki is prone to an remote code execution RCE vulnerability SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

gitea < 1.11.2 RCE Vulnerability

Gitea is prone to a remote code execution RCE vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

PT-2022-15690 · Schneider Electric · Ecostruxure Ev Charging Expert

Name of the Vulnerable Software and Affected Versions: EcoStruxure EV Charging Expert formerly known as EVlink Load Management System versions prior to V4.0.0.13 Description: A Cross-Site Request Forgery CSRF issue exists, allowing a remote attacker to gain unauthorized access to the product by...

CVE-2022-23623 Validation bypass in frourio

Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through validators/ folder are subject to a input validation vulnerability. Validators do not work properly for request bodies and queries in specific...