nodejs:16 security, bug fix, and enhancement update

An update is available for nodejs-nodemon, nodejs, nodejs-packaging. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a software development platform f...

PT-2022-26622 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 16.2 iPadOS versions prior to 16.2 Description: The issue was addressed with improved memory handling. An app may be able to break out of its sandbox. Recommendations: For iOS versions prior to 16.2, update to iOS 16.2 o...

CVE-2022-23527 Open Redirect in oidc_validate_redirect_url()

modauthopenidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidcvalidateredirecturl does not properly check fo...

SUSE-SU-2022:4442-1 Security update for SUSE Manager Server 4.2

This update fixes the following issues: spacewalk-java: - Version 4.2.44-1 Do not disclose Proxy password in browser console log. bsc1205339 spacewalk-web: - Version 4.2.31-1 Do not log Proxy password in browser console log. bsc1205339 susemanager-sync-data: - Version 4.2.14-1 Add SUSE Linux...

SUSE-SU-2022:4439-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: golang-github-boynux-squidexporter: - Exclude s390 architecture - Enhanced to build on Enterprise Linux 8 grafana: - Version update from 8.3.10 to 8.5.13 jscPED-2145 - Security fixes: CVE-2022-36062: bsc1203596 CVE-2022-35957: bsc1203597 CVE-2022-31107:...

PT-2022-5957 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.14 and earlier Description: The issue exists due to inadequate protection of the web page structure. It may allow a remote attacker to perform cross-site scripting attacks using a specially crafted link i...

PT-2022-27836 · Siemens · Scalance X204Rna Eec +1

Name of the Vulnerable Software and Affected Versions: SCALANCE X204RNA HSR versions prior to V3.2.7 SCALANCE X204RNA PRP versions prior to V3.2.7 SCALANCE X204RNA EEC HSR versions prior to V3.2.7 SCALANCE X204RNA EEC PRP versions prior to V3.2.7 SCALANCE X204RNA EEC PRP/HSR versions prior to...

PT-2022-6392 · Schneider Electric · Apc Easy Ups Online Monitoring +1

Name of the Vulnerable Software and Affected Versions: APC Easy UPS Online Monitoring Software versions prior to V2.5-GA APC Easy UPS Online Monitoring Software versions prior to V2.5-GA-01-22261 Schneider Electric Easy UPS Online Monitoring Software versions prior to V2.5-GS Schneider Electric...

PT-2022-25007 · WordPress · Icegram Express

Name of the Vulnerable Software and Affected Versions: Icegram Express WordPress plugin versions prior to 5.5.1 Description: The issue arises from improper sanitization and escaping of a parameter used in a SQL statement, resulting in a SQL injection that can be exploited by any authenticated use...

PT-2022-25774 · Sap · Sap Netweaver As Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS Java HTTP Provider Service version 7.50 Description: The issue is caused by insufficient input validation, allowing an unauthenticated attacker to inject a script into a web request header. Successful exploitation enables an...

PT-2022-24743 · WordPress · User Registration

Name of the Vulnerable Software and Affected Versions: User Registration WordPress plugin versions prior to 2.2.4.1 Description: The issue concerns the improper restriction of file uploads via an AJAX action, which is accessible to both unauthenticated and authenticated users. This could allow...

PT-2022-24918 · WordPress · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce WordPress plugin versions prior to 2.8.4 Description: The issue allows any authenticated users to perform Stored Cross-Site Scripting attacks due to the lack of sanitization and escaping of some parameters. Recommendations:...

PT-2022-27120 · Unknown · Nuxt/Framework

Name of the Vulnerable Software and Affected Versions: nuxt/framework versions prior to 3.0.0-rc.13 Description: The issue is related to Cross-site Scripting XSS - DOM, which allows an attacker to inject malicious scripts into a website. This can lead to unauthorized access to sensitive data or...

CVE-2022-23497 Insecure file access in FreshRSS

FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords brypt with cost 9, salted of FreshRSS Web interface. If the API is used, the configuration might contain a...

SUSE-SU-2022:4395-1 Security update for samba

This update for samba fixes the following issues: Version update to 4.15.12. Security issues fixed: - CVE-2022-2031: Fixed AD users that could have bypassed certain restrictions associated with changing passwords bsc1201495. - CVE-2022-32742: Fixed SMB1 code that does not correctly verify...

CVE-2022-23476 Unchecked return value from xmlTextReaderExpand in Nokogiri

Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri 1.13.8 and 1.13.9 fail to check the return value from xmlTextReaderExpand in the method Nokogiri::XML::Readerattributehash. This can lead to a null pointer exception when invalid markup is being parsed. Fo...

PT-2022-35941 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.10 Description: The issue is related to the 9p/trans fd functionality, where it does not always use O NONBLOCK for read/write operations. The actual impact and potential for attack have not been proven yet...

PT-2022-36416 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.225 Description: A slab-out-of-bounds write bug was found in the udf find entry function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior...

PT-2022-36349 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.154 Description: The issue is related to a potential memory leak on the error path from the vfs getxattr alloc function. The actual impact and attack plausibility have not yet been proven. Recommendations:...

PT-2022-36084 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.8 Description: The issue is related to a potential memory leak in the cxl/pmem module. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...