PT-2022-23794 · WordPress · Web Stories

Name of the Vulnerable Software and Affected Versions: Web Stories plugin for WordPress versions up to, and including 1.24.0 Description: The issue arises from insufficient validation of URLs supplied via the url parameter in the "/v1/hotlink/proxy" REST API Endpoint. This allows authenticated...

CVE-2022-39359 Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions...

PT-2022-21793 · Rdiffweb · Rdiffweb

Name of the Vulnerable Software and Affected Versions: rdiffweb versions prior to 2.5.0a7 Description: The issue concerns Business Logic Errors in the GitHub repository ikus060/rdiffweb. Recommendations: For versions prior to 2.5.0a7, update to version 2.5.0a7 or later to resolve the issue...

PT-2022-26450 · Apache · Apache Flume

Name of the Vulnerable Software and Affected Versions: Apache Flume versions 1.4.0 through 1.10.1 Description: The issue allows for a remote code execution RCE attack when a configuration uses a JMS Source with an unsafe providerURL. This is due to the JMSSource class being configured with a...

CVE-2022-39348 Twisted vulnerable to NameVirtualHost Host header injection

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and scri...

PT-2022-21649 · WordPress · Cleantalk

Name of the Vulnerable Software and Affected Versions: Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin versions prior to 5.185.1 Description: The issue concerns a lack of validation for ids used in SQL statements, potentially leading to SQL injection. This could be exploited by...

PT-2022-18528 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 7.1-42661 Description: A Server-Side Request Forgery SSRF issue in the Package Center functionality allows remote authenticated users to access intranet resources via unspecified vectors. Thi...

CVE-2021-42010

Heron versions = 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue...

PT-2022-26200 · Iij · Iij Smartkey

Name of the Vulnerable Software and Affected Versions: IIJ SmartKey versions prior to 2.1.4 Description: The issue allows an attacker to obtain a one-time password issued by the product under certain conditions. This is related to an information disclosure vulnerability in the Android App...

CVE-2021-42010 CRLF log injection

Heron versions = 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue...

PT-2022-11614 · Stmicroelectronics +2 · Stm32 Mw Usb Host +2

Name of the Vulnerable Software and Affected Versions: stm32 mw usb host versions prior to 3.5.1 Description: A buffer overflow issue allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH MAX NUM ENDPOINTS. This typically occurs when using a RTOS such ...

PT-2022-18410 · Unknown · College Website Cms

Name of the Vulnerable Software and Affected Versions: College Website v1.0 CMS Description: The issue concerns a SQL injection exploit in the College Website v1.0 CMS. Recommendations: For College Website v1.0 CMS, update to a version that fixes the SQL injection issue to prevent exploitation...

PT-2022-24010 · Softing · Softing Opc Ua C++ Sdk

Name of the Vulnerable Software and Affected Versions: Softing OPC UA C++ SDK versions prior to 6.10 Description: The issue is related to unchecked array and matrix bounds in structure data types, which can lead to a buffer overflow or excess allocation. Recommendations: For versions prior to 6.1...

PT-2022-26448 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 2.0.0-M9 Description: The issue allows an end-user to set the value of an editable string property of a domain object to a value that would be rendered unchanged when the value was saved. This enables the end-user ...

PT-2022-26909 · Jenkins · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins Custom Checkbox Parameter Plugin versions 1.4 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability, which can be exploited by attackers with Item/Configure permission. This occurs because the...

PT-2022-14987 · Oracle · Oracle Enterprise Data Quality

Name of the Vulnerable Software and Affected Versions: Oracle Enterprise Data Quality versions 12.2.1.3.0 through 12.2.1.4.0 Description: The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Data Quality, resulting in unauthorized access to...

PT-2022-14980 · Oracle · Oracle Siebel Crm Siebel Core

Name of the Vulnerable Software and Affected Versions: Oracle Siebel CRM Siebel Core - DB Deployment and Configuration versions prior to 22.8 Description: The issue allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks can result in...

PT-2022-17484 · WordPress · Meks Easy Social Share

Name of the Vulnerable Software and Affected Versions: Meks Easy Social Share WordPress plugin versions prior to 1.2.8 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is...

PT-2022-21496 · WordPress · Drag/Drop Multiple File Upload

Name of the Vulnerable Software and Affected Versions: Drag and Drop Multiple File Upload WordPress plugin versions prior to 1.3.6.5 Description: The issue arises from the plugin not properly checking the upload size limit set in forms. Instead, it takes the value from user input sent when...

PT-2022-6026 · Libksba +10 · Libksba +10

Name of the Vulnerable Software and Affected Versions: Libksba versions prior to 1.6.3 Description: The issue is related to an integer overflow vulnerability in the CRL signature parser. This vulnerability can be exploited by a remote attacker to send specially crafted data to the application,...