PT-2022-34969 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to the blk-mq elevator switch when reinitializing queues. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2022-35043 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue concerns a fix for DMA transfer direction in the crypto: qat module. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2022-35537 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.150 Description: The issue is related to the drm/msm/dpu component, specifically with the indexing of dpu kms-hw vbif using vbif idx. The actual impact and attack plausibility have not yet been proven...

PT-2022-35453 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.152 Description: The issue is related to a potential security vulnerability in the cifs flock function, which may cause an xid leak. The actual impact and attack plausibility have not yet been proven...

MGASA-2022-0419 Updated chromium-browser-stable packages fix security vulnerabilities

The chromium-browser-stable package has been updated to the new 107 branch with the 107.0.5304.87 version, fixing many bugs and 15 vulnerabilities, together with 107.0.5304.68. Some of the security fixes are: High CVE-2022-3652: Type Confusion in V8. Reported by srodulv and ZNMchtss at S.S.L Team...

PT-2022-18826 · Intel · Intel Xmm 7560 Modem

Name of the Vulnerable Software and Affected Versions: IntelR XMMTM 7560 Modem software versions prior to M2 7560 R 01.2146.00 Description: The issue is related to improper input validation in the IntelR XMMTM 7560 Modem software, which may allow a privileged user to potentially enable escalation...

CVE-2022-41892 Arches vulnerable to SQL Injection

Arches is a web platform for creating, managing, & visualizing geospatial data. Versions prior to 6.1.2, 6.2.1, and 7.1.2 are vulnerable to SQL Injection. With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database. This issue is fixed in...

PT-2022-26110

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 4.10.19 Parse Server versions prior to 5.3.2 Description The issue allows keywords specified in the requestKeywordDenylist option to be injected via Cloud Code Webhooks or Triggers, resulting in the keyword being...

Security Bulletin: IBM Security Verify Access is vulnerable to execute arbitrary code due to jsr-sasign component. [CVE-2022-25898]

Summary jsr-sasign is used by IBM Security Verify Access product. This has been fixed by updating the version used by IBM Security Verify Access. CVE-2022-25898 Vulnerability Details CVEID:CVE-2022-25898 DESCRIPTION: Node.js jsrsasign module could allow a remote attacker to execute arbitrary code...

SUSE-SU-2022:3895-1 Security update for ganglia-web

This update for ganglia-web fixes the following issues: - updated to 3.7.5 which fixes bsc1179835 - CVE-2019-20378: Fixed a possible XSS via ce and cs parameters in header.php bsc1160761...

PT-2022-18644 · Fatcat Apps · Fatcat Apps Analytics Cat Plugin

Name of the Vulnerable Software and Affected Versions: Fatcat Apps Analytics Cat plugin versions = 1.0.9 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows changes to plugin settings. Recommendations: For Fatcat Apps Analytics Cat plugin versions = 1.0.9, update...

CVE-2022-36077 Electron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirect

The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7, Electron is vulnerable to Exposure of Sensitive Information. When following a redirect, Electron delays a check for redirecti...

PT-2022-16302 · WordPress · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads WordPress plugin versions prior to 3.0 Description: The issue arises from the lack of a CSRF check when deleting payment history, and the failure to verify that the post to be deleted is actually a payment history. This...

SUSE-SU-2022:3879-1 Security update for release-notes-susemanager, release-notes-susemanager-proxy

This update for release-notes-susemanager, release-notes-susemanager-proxy fixes the following issues: Release notes for SUSE Manager: - Update to SUSE Manager 4.2.10 Apache exporter has been upgraded to version 0.11.0 CVEs fixed: CVE-2022-43753, CVE-2022-43754, CVE-2022-31255 Bugs mentioned:...

UBUNTU-CVE-2022-39353

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the childNodes collection of the Document, without reporting any error or...

CVE-2022-3509 Parsing issue in protobuf textformat

A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes...

PT-2022-24036

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 3.1.8 Description The issue is related to Cross-site Scripting XSS - Reflected. This means an attacker can inject malicious scripts into a website, which will then be executed by the user's browser. The estimated...

PT-2022-26776 · Rtf2Html · Rtf2Html

Name of the Vulnerable Software and Affected Versions: rtf2html version 0.2.0 Description: A heap overflow was discovered in the component /rtf2html/./rtf tools.h. Recommendations: For version 0.2.0, update to a newer version that contains a fix for this issue...

PT-2022-21796 · Publishpress · Publishpress Capabilities Pro

Name of the Vulnerable Software and Affected Versions: PublishPress Capabilities WordPress plugin versions prior to 2.5.2 PublishPress Capabilities Pro WordPress plugin versions prior to 2.5.2 Description: The issue allows PHP object injection attacks by administrators on multisite WordPress...

PT-2022-36634 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: cacti versions prior to 1.2.22 cacti-spine versions prior to 1.2.22 Description: The issue is related to a cross-site injection vulnerability that can occur when creating new graphs. This vulnerability can be exploited when the boo1203952...