CVE-2022-43967

Concrete CMS formerly concrete5 below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the multilingual report due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+...

PT-2022-35419 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.73 Description: A potential security issue has been identified in the Linux Kernel. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...

PT-2022-35896 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.9.331 Description: The issue is related to a user-after-free problem in the Bluetooth L2CAP protocol. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

CVE-2022-3510

A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown...

OESA-2022-2077 grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB and OpenTSDB. Security Fixes: Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin prox...

PT-2022-27418 · Unknown · Pi-Star Dv Dash

Name of the Vulnerable Software and Affected Versions: Pi-Star DV Dash for Pi-Star DV versions prior to 5aa194d Description: The issue concerns the mishandling of the module parameter. Recommendations: For versions prior to 5aa194d, update to a version that includes the fix for the mishandling of...

PT-2022-17815 · Intel · Intel Xmm 7560 Modem

Name of the Vulnerable Software and Affected Versions: IntelR XMMTM 7560 Modem software versions prior to M2 7560 R 01.2146.00 Description: The issue is related to improper buffer restrictions, which may allow a privileged user to potentially enable escalation of privilege via local access...

PT-2022-23938 · Intel · Intel Nuc Kit

Name of the Vulnerable Software and Affected Versions: IntelR NUC Kits versions prior to RY0386 Description: The issue is related to improper authentication in BIOS firmware, which may allow an authenticated user to potentially enable escalation of privilege via local access. Recommendations: For...

CVE-2022-41892 Arches vulnerable to SQL Injection

Arches is a web platform for creating, managing, & visualizing geospatial data. Versions prior to 6.1.2, 6.2.1, and 7.1.2 are vulnerable to SQL Injection. With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database. This issue is fixed in...

PT-2022-6516 · Suse · Opensuse Leap +3

Name of the Vulnerable Software and Affected Versions: SUSE Linux Enterprise Module for SAP Applications 15-SP1 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e SUSE Linux Enterprise Server for SAP 12-SP5 saphanabootstrap-formula versions prior to...

Tenable Nessus < 8.15.6 Multiple Vulnerabilities (TNS-2022-16)

Tenable Nessus Agent is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:tenable:nessus";...

PT-2022-22381 · Datadog +1 · Datadog +2

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.1 through 15.3.5 GitLab CE/EE versions 15.4 through 15.4.4 GitLab CE/EE versions 15.5 through 15.5.2 Description: An issue has been discovered in GitLab CE/EE. A malicious maintainer could exfiltrate a Datadog...

PT-2022-25229 · WordPress · Advanced Order Export For Woocommerce

Name of the Vulnerable Software and Affected Versions: Advanced Order Export For WooCommerce plugin versions = 3.3.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which can lead to the download of export files. This occurs in the Advanced Order Export For...

KLA20039 Multiple vulnerabilities in Foxit PDF Reader

Use after free vulnerabilities were found in Foxit Reader. Malicious users can exploit these vulnerabilities to cause denial of service. Original advisories Security updates available in Foxit PDF Reader 12.0.2 and Foxit PDF Editor 12.0.2 Exploitation Public exploits exist for this vulnerability...

PT-2022-25233 · A3Rev · A3Rev Software Page View Count Plugin

Name of the Vulnerable Software and Affected Versions: a3rev Software Page View Count plugin versions = 2.5.5 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to reset the plugin settings. Recommendations: For a3rev Software Page View...

Mageia: Security Advisory (MGASA-2022-0404)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM Cloud Pak for Security is vulnerable to using components with known vulnerabilities

Summary IBM Cloud Pak for Security is vulnerable to using components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pa...

CVE-2022-3509

CVE-2022-3509 concerns a parsing issue in protobuf-java (core and lite) textformat that, on inputs with multiple non-repeated embedded messages and repeated/unknown fields, can cause objects to flip between mutable/immutable forms and trigger long GC pauses, enabling a denial-of-service condition...

CVE-2022-3509 Parsing issue in protobuf textformat

A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes...

PT-2022-37580 · Php · Php

Name of the Vulnerable Software and Affected Versions: PHP versions prior to the fixed version Description: The issue is related to several bugs in PHP, including an out-of-bounds read due to insufficient input validation in the imageloadfont function, a buffer overflow in the hash update functio...