PT-2022-35369 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.4 through v5.15.74 Description: A use-after-free issue exists in the nouveau gem prime import sg table function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

Palantir log information leakage vulnerability

Palantir is a data platform from Palantir, Inc. that reimagines how people use data by removing the barriers between back-end data management and front-end data analysis. A log information disclosure vulnerability exists in Palantir Foundry Code-Workbooks versions 4.144 through 4.460.0, which...

PortlandLabs Concrete CMS code-related vulnerabilities

PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A security vulnerability exists in Concrete CMS concrete5 versions prior to 8.5.10 and 9.0.0 through 9.1.2, which stems from the presence of a vulnerability in XXE-base...

PT-2022-34897 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.13 through v6.0.6 Description: The issue is related to missing SIGTRAPs in the Linux Kernel. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions v5.13 through...

PT-2022-35403 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.15.58 through v5.15.74 Description: A memory leak issue was discovered in the xhci alloc dbc function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2022-35465 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 5.10.141 through 5.10.149 Description: The issue concerns a potential security vulnerability in the Linux Kernel. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2022-24400 · Ibm · Ibm Cloud Pak For Security

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak for Security CP4S versions 1.10.0.0 through 1.10.2.0 Description: The issue allows a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. Recommendations: For versions...

AZL-11385 CVE-2022-44792 affecting package net-snmp for versions less than 5.9.4-1

handleipDefaultTTL in agent/mibgroup/ip-mib/ipscalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker who has write access to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service...

PT-2022-5703 · D Link · D-Link Dir-882

Name of the Vulnerable Software and Affected Versions: D-Link DIR-882 versions 1.10B02 through 1.20B06 Description: The issue is related to buffer overflow errors in the D-Link DIR-882 wireless router's firmware. Exploitation of this issue may allow a remote attacker to cause a denial of service...

PT-2022-5707 · D Link · D-Link Dir-882

Name of the Vulnerable Software and Affected Versions: D-Link DIR-882 versions 1.10B02 through 1.20B06 Description: The issue is related to a buffer overflow error in the webGetVarString function of the D-Link DIR-882 wireless router's firmware. This can be exploited by a remote attacker to execu...

PT-2022-18672 · Osisoft · Osisoft-Pi-Web-Connector

Name of the Vulnerable Software and Affected Versions: osisoft-pi-web-connector versions 0.15.0 through 0.43.0 Description: The Foundry Magritte plugin osisoft-pi-web-connector was found to be logging in a manner that captured authentication requests. Recommendations: For osisoft-pi-web-connector...

CVE-2022-44622

In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive...

PT-2022-25297 · Ibm · Ibm Mq Appliance

Name of the Vulnerable Software and Affected Versions: IBM MQ Appliance versions 9.2 CD through 9.3 LTS Description: The issue allows an authenticated user to impersonate another user on the system because it does not invalidate the session after logout. Recommendations: For IBM MQ Appliance...

Sudo buffer error vulnerability

Sudo is a program used on Unix-like systems that allows users to execute commands in a secure manner with special privileges. A buffer error vulnerability exists in Sudo versions 1.8.0 through 1.9.12, which stems from the presence of an array out-of-bounds error that could result in a heap-based...

CVE-2022-43995

Sudo 1.8.0 through 1.9.12, with the crypt password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer...

PT-2022-24940

Name of the Vulnerable Software and Affected Versions Fluentd versions 1.13.2 through 1.15.2 Description A remote code execution vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. This issue affect...

CVE-2022-41974

multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege...

CVE-2022-3400

The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the brickssavepost AJAX action in versions 1.0 to 1.5.3. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to edit any page, post, or template...

Litespeed Technology OpenLiteSpeed code issues and vulnerabilities

Litespeed Technologie OpenLiteSpeed is an open source web server from Litespeed Technologie. A code issue vulnerability exists in LiteSpeed Technologies OpenLiteSpeed versions prior to 1.6.15 through 1.7.16.1, which stems from its Web Server Container allowing untrusted path searches leading to a...

CVE-2022-42468

Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol...