PT-2022-6775 · Google +1 · Google Chrome +1

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 101.0.4951.41 Description: The issue is related to a use after free in Base Internals, allowing a remote attacker to perform arbitrary read/write via a crafted HTML page. This can be exploited by a remote...

PT-2022-13851 · WordPress · Cab Fare Calculator

Name of the Vulnerable Software and Affected Versions: Cab fare calculator WordPress plugin versions prior to 1.0.4 Description: The issue is related to the lack of validation of the controller parameter, which is used in require statements. This could lead to Local File Inclusion issues...

PT-2022-5522 · Freerdp +6 · Freerdp +6

Name of the Vulnerable Software and Affected Versions: FreeRDP versions prior to 2.7.0 Description: The issue is related to the authentication procedure in FreeRDP, a free implementation of the Remote Desktop Protocol RDP. Server-side authentication against a SAM file might be successful for...

WordPress Plugin "MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership" vulnerable to cross-site request forgery

Overview WordPress Plugin "MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership" provided by VideoWhisper contains a cross-site request forgery vulnerability CWE-352. Kosuke Sakai reported and coordinated with the developer to fix this vulnerability. After coordination was...

PT-2022-2601 · Linux +10 · Linux Kernel +10

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to 5.18 Linux Kernel version 4.14 and later versions Description: The issue is related to an improper update of the reference count in the net/sched component of the Linux Kernel, which can be exploited by a local...

PT-2022-3589 · Unknown · Igss Data Server

Name of the Vulnerable Software and Affected Versions: IGSS Data Server - IGSSdataServer.exe versions prior to V15.0.0.22073 Description: A CWE-190: Integer Overflow or Wraparound issue exists, potentially causing a heap-based buffer overflow. This could lead to denial of service and possibly...

PT-2022-19225 · Samsung · Samsung Members

Name of the Vulnerable Software and Affected Versions: Samsung Members versions prior to 13.6.08.5 Description: The issue is related to an improper access control vulnerability. It allows a local attacker to execute a call function without the required CALL PHONE permission. Recommendations: For...

PT-2023-12176

Name of the Vulnerable Software and Affected Versions mechanize versions prior to 0.4.6 Description The mechanize library, used for automatically interacting with HTTP web servers, contains a regular expression vulnerable to regular expression denial of service ReDoS. If a web server responds...

PT-2022-13461 · WordPress · Amelia

Name of the Vulnerable Software and Affected Versions: Amelia WordPress plugin versions prior to 1.0.48 Description: The issue allows any customer to send paid test SMS notifications and retrieve sensitive information about the admin, such as email, account balance, and payment history. A malicio...

WordPress Ad Inserter plugin <= 2.7.11 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Taurus Omar in WordPress Ad Inserter plugin versions = 2.7.11. Solution Update the WordPress Ad Inserter plugin to the latest available version at least 2.7.12...

OPENSUSE-SU-2022:0770-1 Security update for buildah

This update for buildah fixes the following issues: buildah was updated to version 1.23.1: Update to version 1.22.3: Update dependencies Post-branch commit Accept repositories on login/logout Update to version 1.22.0: c/image, c/storage, c/common vendor before Podman 3.3 release Proposed patch fo...

SUSE-SU-2022:0703-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Update to version 2.34.6 bsc1196133: - CVE-2022-22620: Processing maliciously crafted web content may have lead to arbitrary code execution. Update to version 2.34.5 bsc1195735: - CVE-2022-22589: A validation issue was addressed with improve...

MarkText vulnerable to cross-site scripting

Overview MarkText is a Markdown editor. MarkText contains a cross-site scripting vulnerability CWE-79. Eiji Mori of Flatt Security Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrary script may...

OPENSUSE-SU-2022:0526-1 Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container

This update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container fixes the following issues: - Update to version 0.49.0 Release notes...

PT-2022-7269 · Libde265 +3 · Libde265 +3

Name of the Vulnerable Software and Affected Versions: Libde265 version 1.0.8 Description: The issue is related to a segmentation violation via the apply sao internal function in sao.cc, which can be exploited to cause a Denial of Service DoS by using a crafted video file. This can be achieved by...

WordPress Cost Calculator plugin <= 1.5 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress Cost Calculator plugin versions = 1.5. Solution Update the WordPress Cost Calculator plugin to the latest available version at least 1.6...

Mageia: Security Advisory (MGASA-2021-0409)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-2311 · Cisco · Cisco Webex Meetings

Name of the Vulnerable Software and Affected Versions: Cisco Webex Meetings affected versions not specified Description: The issue exists due to insufficient validation of user-supplied input by the web-based interface of Cisco Webex Meetings. An attacker could exploit this by persuading a user t...

CVE-2021-43827 Inline footnotes wrapped in <a> tags can cause errors in discourse-footnotes

discourse-footnote is a library providing footnotes for posts in Discourse. Impact When posting an inline footnote wrapped in tags e.g. ^footnote, the resulting rendered HTML would include a nested , which is stripped by Nokogiri because it is not valid. This then caused a javascript error on top...

PT-2021-7276 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to v5.16-rc6 Description: A flaw in the Linux kernel's eBPF verifier allows internal memory locations to be returned to userspace when handling internal data structures. This can be exploited by a local attacker wi...