PT-2022-35973 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.10 Description: The issue is related to a potential null pointer dereference in the kprobe event gen test exit function. This could potentially lead to security vulnerabilities, although the actual impact a...

PT-2022-36516 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v4.19.257 through v4.19.264 Description: The issue is related to a NULL pointer dereference in the rose send frame function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

SUSE-SU-2022:4349-1 Security update for buildah

This update for buildah fixes the following issues: Version update to 1.28.2. - CVE-2022-2990: Fixed a possible information disclosure and modification vulnerability bsc1202812. - CVE-2020-10696: Fixed an issue with a crafted input tar file that may lead to a local file overwriting during image...

Vulnerabilities fixed in MobaXterm

Vulnerabilities have been fixed in Mobatek MobaXterm. The vulnerability allows a malicious party to bypass authentication bypass and connect unauthenticated via the SSH or SFTP protocol. Furthermore, a malicious party can perform a denial-of-service DoS exploit on the SFTP protocol. The...

PT-2022-27975

Name of the Vulnerable Software and Affected Versions PaddlePaddle versions prior to 2.4 Description The issue is an out-of-bounds read in the gather tree function. This problem affects PaddlePaddle versions before 2.4. A patch for this issue is available in the release/2.4 branch. Recommendation...

PT-2022-27651 · WordPress · Easy Wp Smtp

Name of the Vulnerable Software and Affected Versions: Easy WP SMTP plugin versions 1.5.1 and earlier Description: The issue is related to an Authenticated Path Traversal vulnerability. There is no information provided about the estimated number of potentially affected devices worldwide or detail...

PT-2022-26644 · WordPress · Armember

Name of the Vulnerable Software and Affected Versions: ARMember premium plugin versions = 5.5.1 Description: The issue is related to an Unauth. Privilege Escalation vulnerability. It affects the ARMember premium plugin on WordPress. Recommendations: For ARMember premium plugin versions = 5.5.1,...

PT-2022-27650 · WordPress · Advanced Booking Calendar

Name of the Vulnerable Software and Affected Versions: Advanced Booking Calendar plugin version 1.7.1 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions ...

PT-2022-27012 · Unknown · Stackstorm

Name of the Vulnerable Software and Affected Versions: StackStorm versions prior to 3.8.0 Description: A cross-site scripting XSS issue in the Web UI allows logged-in users with write access to pack rules to inject arbitrary script or HTML, which may be executed in the Web UI for other logged-in...

CVE-2022-43556

Concrete CMS formerly concrete5 below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dashboard page output is not sanitized. The Concrete CMS security team has ranked this 4.2 with CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Thanks...

PT-2022-5775 · NetGear · Netgear Rax30 Ax2400

Name of the Vulnerable Software and Affected Versions: NETGEAR RAX30 AX2400 series of routers versions prior to 1.0.9.90 Description: A network misconfiguration is present in the affected devices, where IPv6 is enabled for the WAN interface by default. However, the firewall restrictions in place...

PT-2022-26194 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 24.0.7 Nextcloud Server versions prior to 25.0.1 Description: The issue affects Nextcloud Server, an open source personal cloud server, where disabled download shares still allow download through preview...

PT-2022-24014 · WordPress · Becustom

Name of the Vulnerable Software and Affected Versions: Becustom plugin for WordPress versions up to, and including, 1.0.5.2 Description: The issue is due to missing nonce validation when saving the plugin's settings, making it possible for unauthenticated attackers to update the plugin's settings...

PYSEC-2022-43175

Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. Versions prior to 3.0.0 are vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that has deployed the XBlock may be impacted. Version 3.0.0 contai...

PT-2022-19861 · WordPress · Salat Times

Name of the Vulnerable Software and Affected Versions: Salat Times WordPress plugin versions prior to 3.2.2 Description: The issue allows high-privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitize and escape its...

PT-2022-22426 · WordPress · Checkout Field Editor

Name of the Vulnerable Software and Affected Versions: The Checkout Field Editor Checkout Manager for WooCommerce WordPress plugin versions prior to 1.8.0 Description: The issue allows high privilege users, such as admins, to perform PHP Object Injection when a suitable gadget is present. This is...

PT-2022-24423 · WordPress · Wp User Merger

Name of the Vulnerable Software and Affected Versions: WP User Merger WordPress plugin versions prior to 1.5.3 Description: The issue arises from the plugin's failure to properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection. This can be exploited ...

PT-2022-24334 · WordPress · Video Thumbnails

Name of the Vulnerable Software and Affected Versions: Video Thumbnails WordPress plugin versions 2.12.3 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...

Security update for opera (important)

openSUSE Security Update: Security update for opera Announcement ID: openSUSE-SU-2022:10219-1 Rating: important References: Cross-References: CVE-2022-3723 CVSS scores: CVE-2022-3723 NVD : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.4:NonFree An update tha...

PT-2022-37625 · Opensuse +3 · Xtrabackup

This update for xtrabackup fixes the following issues: Update xtrabackup to version 2.4.26: - CVE-2020-10997: Information exposure via cmd line output and table history boo1170644 - CVE-2020-29488: Changes in how absolute paths are handled boo1205581...