PT-2022-23300

Name of the Vulnerable Software and Affected Versions Vesta versions 1.0.0 through 1.0.5 Description A cross-site scripting XSS issue was found in the body function at the "/web/api/v1/upload/UploadHandler.php" API endpoint. This allows for potential exploitation. Recommendations For versions 1.0...

CVE-2022-32058: Loop with Unreachable Exit Condition

An infinite loop in the function httpRpmPass of TP-Link TL-WR741N/TL-WR742N V1/V2/V3130415 allows attackers to cause a Denial of Service DoS via a crafted packet...

PT-2022-3648

Name of the Vulnerable Software and Affected Versions FortiDeceptor versions 1.0.0 through 4.0.1 Description The issue is related to relative path traversal errors in the management interface, allowing a remote and authenticated attacker to retrieve and delete arbitrary files from the underlying...

Frequent price update make the project vulnerable to price oracle manipulation

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Frequent price update make the project vulnerable to price oracle manipulation Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof...

PT-2022-3282

Name of the Vulnerable Software and Affected Versions PingID Windows Login versions prior to 2.8 Description The issue is related to the incorrect use of privileged APIs in the PingID multi-factor authentication MFA software for Windows. This could allow an attacker to elevate their privileges...

Malicious code in service-bus-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 31858bdcfbb3924248460b003094be153f39da14723789001495407f920c6b86 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6027 Malicious code in service-bus-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 31858bdcfbb3924248460b003094be153f39da14723789001495407f920c6b86 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in free-fortnite-skins-api-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84adc7f3e89bcdaf2440857943395002466913468cf0aed35f78e5879eaf84d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3147 Malicious code in free-fortnite-skins-api-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84adc7f3e89bcdaf2440857943395002466913468cf0aed35f78e5879eaf84d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in free-fire-diamonsd-hakc-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01dd727b615eda36a111eed448a3e95546f23e6f60533ecf10c2b80404bff3e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3840 Malicious code in ing-web-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe142cd2d72a18a133fe6108f27a51f49d27b4afc2942e0acf271d7959d85ce9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5672 Malicious code in react-select-v1-deprecated (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d29d5cb498fe3472e1d7bf13f449cf73407728a4f7493ee3ccd8af301c71308 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Signature forgery in Biscuit

Impact The paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscu...

CVE-2022-29525

Rakuten Casa version APFV141 or APFV200 uses a hard-coded credential which may allow a remote unauthenticated attacker to log in with the root privilege and perform an arbitrary operation...

PT-2022-19180 · Rakuten · Rakuten Casa

Name of the Vulnerable Software and Affected Versions: Rakuten Casa versions AP F V1 4 1 through AP F V2 0 0 Description: The issue is related to improper access control, allowing a remote attacker to log in with root privilege and perform arbitrary operations if the product is in its default...

ASB-A-218836280

In cgroup1parseparam of cgroup-v1.c, there is a possible container breakout due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2022-2783

Name of the Vulnerable Software and Affected Versions TrueConf Server affected versions not specified Description The issue is related to the conf id parameter in TrueConf Server, which allows for path traversal in the /client/upsld/v1 scenario. Exploitation of this issue may enable a remote...

Important: Red Hat Security Advisory: kpatch-patch security update

An update is now available for Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

PT-2022-37715

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the V1/customers/me endpoint to achieve information exposure and privile...

PT-2022-19343

Name of the Vulnerable Software and Affected Versions OrangeHRM version v4.10.1 Description A stored cross-site scripting XSS issue in the addNewPost component allows attackers to execute arbitrary web scripts or HTML via a crafted POST request to the /api/v1/addNewPost endpoint, using vulnerable...