PT-2022-35159 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue concerns the initialization of registers in the arm64 architecture, specifically related to the MTE Memory Tagging Extension feature. The actual impact and potential for attacks hav...

PT-2022-35064 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.3 through v6.0.2 Description: The issue is related to RDMA/siw, where a fix is applied to ensure that QP destroy waits for all references to be dropped. The actual impact and attack plausibility have not yet been...

PT-2022-35130 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: A potential memory leak was identified in the ext4 fc record regions function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2022-27011 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions prior to 8.5.10 Concrete CMS versions 9.0.0 through 9.1.2 Description: The issue allows for Stored Cross-Site Scripting XSS in the dashboard/system/express/entities/associations endpoint because Concrete CMS permits...

PT-2022-27048 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions below 8.5.10 Concrete CMS versions 9.0.0 through 9.1.2 Description: The issue is related to Reflected XSS in the multilingual report due to un-sanitized output. Recommendations: For Concrete CMS versions below 8.5.10,...

PT-2022-35144 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: A potential issue exists in the jbd2 component of the Linux Kernel, related to the fc do one pass function. The actual impact and attack plausibility have not yet been proven. Recommendations...

PT-2022-34969 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to the blk-mq elevator switch when reinitializing queues. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2022-35453 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.152 Description: The issue is related to a potential security vulnerability in the cifs flock function, which may cause an xid leak. The actual impact and attack plausibility have not yet been proven...

PT-2022-35537 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.150 Description: The issue is related to the drm/msm/dpu component, specifically with the indexing of dpu kms-hw vbif using vbif idx. The actual impact and attack plausibility have not yet been proven...

PT-2022-35043 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue concerns a fix for DMA transfer direction in the crypto: qat module. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

MGASA-2022-0419 Updated chromium-browser-stable packages fix security vulnerabilities

The chromium-browser-stable package has been updated to the new 107 branch with the 107.0.5304.87 version, fixing many bugs and 15 vulnerabilities, together with 107.0.5304.68. Some of the security fixes are: High CVE-2022-3652: Type Confusion in V8. Reported by srodulv and ZNMchtss at S.S.L Team...

PT-2022-18826 · Intel · Intel Xmm 7560 Modem

Name of the Vulnerable Software and Affected Versions: IntelR XMMTM 7560 Modem software versions prior to M2 7560 R 01.2146.00 Description: The issue is related to improper input validation in the IntelR XMMTM 7560 Modem software, which may allow a privileged user to potentially enable escalation...

CVE-2022-41892 Arches vulnerable to SQL Injection

Arches is a web platform for creating, managing, & visualizing geospatial data. Versions prior to 6.1.2, 6.2.1, and 7.1.2 are vulnerable to SQL Injection. With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database. This issue is fixed in...

PT-2022-26110

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 4.10.19 Parse Server versions prior to 5.3.2 Description The issue allows keywords specified in the requestKeywordDenylist option to be injected via Cloud Code Webhooks or Triggers, resulting in the keyword being...

Security Bulletin: IBM Security Verify Access is vulnerable to execute arbitrary code due to jsr-sasign component. [CVE-2022-25898]

Summary jsr-sasign is used by IBM Security Verify Access product. This has been fixed by updating the version used by IBM Security Verify Access. CVE-2022-25898 Vulnerability Details CVEID:CVE-2022-25898 DESCRIPTION: Node.js jsrsasign module could allow a remote attacker to execute arbitrary code...

SUSE-SU-2022:3895-1 Security update for ganglia-web

This update for ganglia-web fixes the following issues: - updated to 3.7.5 which fixes bsc1179835 - CVE-2019-20378: Fixed a possible XSS via ce and cs parameters in header.php bsc1160761...

PT-2022-18644 · Fatcat Apps · Fatcat Apps Analytics Cat Plugin

Name of the Vulnerable Software and Affected Versions: Fatcat Apps Analytics Cat plugin versions = 1.0.9 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows changes to plugin settings. Recommendations: For Fatcat Apps Analytics Cat plugin versions = 1.0.9, update...

CVE-2022-36077 Electron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirect

The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7, Electron is vulnerable to Exposure of Sensitive Information. When following a redirect, Electron delays a check for redirecti...

PT-2022-16302 · WordPress · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads WordPress plugin versions prior to 3.0 Description: The issue arises from the lack of a CSRF check when deleting payment history, and the failure to verify that the post to be deleted is actually a payment history. This...

SUSE-SU-2022:3879-1 Security update for release-notes-susemanager, release-notes-susemanager-proxy

This update for release-notes-susemanager, release-notes-susemanager-proxy fixes the following issues: Release notes for SUSE Manager: - Update to SUSE Manager 4.2.10 Apache exporter has been upgraded to version 0.11.0 CVEs fixed: CVE-2022-43753, CVE-2022-43754, CVE-2022-31255 Bugs mentioned:...