PT-2022-17587 · Fava +1 · Fava +1

Name of the Vulnerable Software and Affected Versions: Fava versions prior to 1.22.3 Description: The issue is related to Cross-site Scripting XSS - Reflected, which occurs due to improper validation on filter conversion. This allows for malicious scripts to be injected into the website,...

PT-2022-15896 · WordPress · Simple Membership

Name of the Vulnerable Software and Affected Versions: Simple Membership WordPress plugin versions prior to 4.1.3 Description: The issue allows a user to change their membership at the registration stage due to insufficient checking of a user-supplied parameter. Recommendations: For versions prio...

PT-2022-15439 · WordPress · Counter Box

Name of the Vulnerable Software and Affected Versions: The Counter Box WordPress plugin versions prior to 1.2.1 Description: The issue is related to a lack of CSRF check when activating and deactivating counters. This could allow attackers to make a logged-in admin perform such actions via CSRF...

PT-2022-4923 · Dell Emc · Dell Emc Cloudlink

Name of the Vulnerable Software and Affected Versions: Dell EMC CloudLink versions prior to 7.1.2 Description: The issue is related to weaknesses in the authentication procedure, allowing a remote attacker with knowledge of active directory usernames to potentially gain unauthorized access to the...

PT-2022-14210 · WordPress · Youzify

Name of the Vulnerable Software and Affected Versions: Youzify WordPress plugin versions prior to 1.2.0 Description: The issue concerns an unauthenticated SQL injection due to a parameter not being sanitized and escaped before use in a SQL statement. This occurs via an AJAX action that is availab...

MGASA-2022-0268 Updated chromium-browser-stable packages fix security vulnerability

The chromium-browser-stable package has been updated to version 103.0.5060.134 branch, fixing many bugs and 11 CVE. Some of them are listed below. Use after free in Guest View. CVE-2022-2477 Use after free in PDF. CVE-2022-2478 Insufficient validation of untrusted input in File. CVE-2022-2479 Use...

"Hulu" App for iOS vulnerable to improper server certificate verification

Overview "Hulu" App for iOS provided by HJ Holdings, Inc. is vulnerable to improper server certificate verification CWE-295. Shungo Kumasaka of GMO Cyber Security by IERAE reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

PT-2022-23755 · Jetbrains · Intellij Idea

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2022.2 Description: The issue concerns a missing email address validation in the "Git User Name Is Not Defined" dialog. This problem affects JetBrains IntelliJ IDEA. Recommendations: For versions prio...

PT-2022-7864 · Zulip · Zulip

Name of the Vulnerable Software and Affected Versions: Zulip versions prior to 1.3.12 Description: The issue allows deactivated users to access messages when Single Sign-On SSO is enabled. Recommendations: For versions prior to 1.3.12, update to version 1.3.12 or later to resolve the issue...

PT-2022-7855 · Unknown · Kippo-Graph

Name of the Vulnerable Software and Affected Versions: kippo-graph versions prior to 1.5.1 Description: The issue is related to a cross-site scripting vulnerability in the xss clean function within class/KippoInput.class.php. Recommendations: For versions prior to 1.5.1, update to version 1.5.1 o...

SUSE-SU-2022:2568-1 Security update for SUSE Manager Server 4.2

This update fixes the following issues: apache-commons-csv: - Fix the URL for the package - Declare the LICENSE file as license and not doc apache-commons-math3: - Fix the URL for the package - Declare the LICENSE file as license and not doc drools: - Declare the LICENSE file as license and not d...

PT-2022-4028 · Compuware +1 · Jenkins Compuware Zadviser Api Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Compuware zAdviser API Plugin versions 1.0.3 and earlier Description: The issue is related to a flaw in the data protection mechanism of the Jenkins Compuware zAdviser API Plugin. This flaw can be exploited by a remote attacker to gai...

OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407)

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 o...

MGASA-2022-0265 Updated virtualbox packages fix security vulnerabilities

This update provides the upstream 6.1.36 maintenance release that fixes at least the following security vulnerabilities: A vulnerability in the Oracle VM VirtualBox prior to 6.1.36 contains an easily exploitable vulnerability that allows a high privileged attacker with logon to the infrastructure...

PT-2022-23358 · Scooter · Beyond Compare

Name of the Vulnerable Software and Affected Versions: Scooter Beyond Compare versions 1.8a through 4.4.2 Description: A DLL hijacking issue exists in the uninstaller when installed via the EXE installer. The uninstaller attempts to load DLLs from the Windows Temp folder. If a standard user place...

SUSE-SU-2022:2533-2 Security update for mozilla-nss

This update for mozilla-nss fixes the following issues: Various FIPS 140-3 related fixes were backported from SUSE Linux Enterprise 15 SP4: - Makes the PBKDF known answer test compliant with NIST SP800-132. bsc1192079. - FIPS: Add on-demand integrity tests through sftkFIPSRepeatIntegrityCheck...

PT-2022-20577 · Slack · Slack Morphism

Name of the Vulnerable Software and Affected Versions: Slack Morphism versions prior to 0.41.0 Description: The issue concerns the potential leakage of Slack OAuth client information into application debug logs due to insecure debug log formatting. This could lead to the accidental exposure of...

KLA19261 XSS vulnerability in Apache Tomcat

Cross-site scripting XSS vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to perform cross-site scripting attack. Original advisories Apache Tomcat 9.x vulnerabilities Related products Apache-Tomcat CVE list CVE-2022-34305 high Solution Update to the latest...

PT-2022-4001 · Oracle +2 · Virtualbox +2

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.36 Description: The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox. This can be exploited by a high-privileged attacker with logon access to the...

CVE-2022-31153 OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli

OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to an error that renders account contracts unusable on live networks. This issue affects all accounts vanilla and ethereum flavors in the...