CVE-2021-41119 DoS vulnerabiliity in wire-server json parser

Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of servic...

PT-2022-12957 · Palo Alto Networks · Pan-Os

Name of the Vulnerable Software and Affected Versions: PAN-OS versions prior to 8.1.22 PAN-OS versions prior to 9.0.16 PAN-OS versions prior to 9.1.13 PAN-OS versions prior to 10.0.10 PAN-OS versions prior to 10.1.5 Description: An improper handling of exceptional conditions issue exists in the D...

PT-2022-3913 · Adobe · Acrobat Reader

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat Reader versions 22.001.20085 and earlier Adobe Acrobat Reader versions 20.005.30314 and earlier Adobe Acrobat Reader versions 17.012.30205 and earlier Description: The issue is caused by an out-of-bounds read vulnerability when...

PT-2022-3689 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 100.0.4896.88 Description: The issue is related to a use after free in WebGPU, which can potentially allow a remote attacker to exploit heap corruption via a crafted HTML page. This could enable the attacker to...

PT-2022-2357

Name of the Vulnerable Software and Affected Versions Django versions 2.2 before 2.2.28 Django versions 3.2 before 3.2.13 Django versions 4.0 before 4.0.4 Description An issue was discovered in the QuerySet.annotate, aggregate, and extra methods, which are subject to SQL injection in column alias...

PT-2022-18342 · Inhand Networks · Inrouter 900

Name of the Vulnerable Software and Affected Versions: InHand Networks InRouter 900 Industrial 4G Router versions prior to v1.0.0.r11700 Description: A remote code execution issue was discovered in the config ovpn component. This issue can be triggered by a crafted packet, allowing for potential...

CVE-2021-35628 affecting package mysql for versions less than 8.0.28-1

CVE-2021-35628 affecting package mysql for versions less than 8.0.28-1. An upgraded version of the package is available that resolves this issue...

PT-2022-3421

Name of the Vulnerable Software and Affected Versions Django versions 3.2.0 through 3.2.13 Django versions 4.0.0 through 4.0.5 Description The issue is related to SQL injection in the Trunc and Extract database functions when untrusted data is used as a kind/lookup name value. This can allow an...

PT-2022-24492 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 100.0.4896.75 Description: The issue is related to a use after free in Browser History, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. The severity of this issue is...

MGASA-2022-0127 Updated php-smarty packages fix security vulnerability

Updated php-smarty packages to version 4 for php 8 compatibility and to fix security vulnerabilities...

MGASA-2022-0120 Updated graphicsmagick packages fix security vulnerability

The graphicsmagick package has been updated to version 1.3.38, fixing several security issues and other bugs. See the referenced NEWS link for details...

PT-2022-13132 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 11.4 through 14.5.3 GitLab CE/EE versions 14.6 through 14.6.3 GitLab CE/EE versions 14.7 through 14.7.0 Description: An issue has been discovered in GitLab CE/EE where the search function may allow authenticated users to...

PT-2022-9761 · Unknown · Impresscms

Name of the Vulnerable Software and Affected Versions: ImpressCMS versions prior to 1.4.3 Description: The issue allows for SQL Injection in the include/findusers.php groups. There is a remote code execution exploit. Recommendations: For versions prior to 1.4.3, update to version 1.4.3 or later t...

PT-2022-9814 · Ge · Ge Ur

Name of the Vulnerable Software and Affected Versions: GE UR firmware versions prior to 8.1x Description: The issue allows sensitive information exposure without authentication. This occurs because the web server interface is supported over the HTTP protocol. Recommendations: For GE UR firmware...

PT-2022-4187 · Unknown +1 · Passwork On-Premise Edition +1

Name of the Vulnerable Software and Affected Versions: Passwork On-Premise Edition versions prior to 4.6.13 Description: The issue is related to multiple XSS problems in the Passwork On-Premise Edition. This is due to the lack of protection measures for the web page structure, allowing a remote...

OPENSUSE-SU-2022:0087-1 Security update for icingaweb2

This update for icingaweb2 fixes the following issues: icingaweb2 was updated to 2.8.6 This is a security release. Security Fixes - CVE-2022-24715: SSH resources allow arbitrary code execution for authenticated users GHSA-v9mv-h52f-7g63 boo1196911 - CVE-2022-24714: Unwanted disclosure of hosts an...

CVE-2022-23610 Improper Verification of Cryptographic Signature in wire-server

wire-server provides back end services for Wire, an open source messenger. In versions of wire-server prior to the 2022-01-27 release, it was possible to craft DSA Signatures to bypass SAML SSO and impersonate any Wire user with SAML credentials. In teams with SAML, but without SCIM, it was...

PT-2022-6938 · Mariadb +9 · Mariadb Server +9

Name of the Vulnerable Software and Affected Versions: MariaDB Server versions 10.9 and below Description: The issue is related to a segmentation fault in the sql/item subselect.cc component of the MariaDB Server. This can be exploited by a remote attacker to cause a denial of service. The...

PT-2022-08: Deserialization of untrusted data in Veeam Agent for Microsoft Windows

The vulnerability was identified in Veeam Agent for Windows versions 2.0, 2.1, 2.2, 3.0.2, 4.0, and 5.0. The discovered vulnerability allows local users to run arbitrary code with LOCAL SYSTEM privileges. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 12.03.2022...

PT-2022-07: Insufficient authentication in Veeam Backup & Replication

The vulnerability was identified in Veeam Backup & Replication versions 9.5, 10, 11. The discovered vulnerability allows an attaker to authenticate using a NULL-session. This may lead to gaining control over the target system. Vulnerability status: Confirmed by vendor Date of vulnerability...