PT-2022-17572 · Terser +2 · Terser +2

Name of the Vulnerable Software and Affected Versions: terser versions prior to 4.8.1 terser versions 5.0.0 through 5.14.2 Description: The issue is related to a Denial of Service by Regular Expression ReDoS due to the insecure usage of regular expressions. This can lead to a service disruption...

SUSE-SU-2022:2359-1 Security update for squid

This update for squid fixes the following issues: - CVE-2021-46784: Fixed DoS when processing gopher server responses. bsc1200907 - Update to 5.6: - Improve handling of Gopher responses - Changes in 5.5: - fixes regression Bug 5192: esiparser default is incorrect - Bug 5177: clientca certificates...

PT-2022-20220 · Go +8 · Go +8

Name of the Vulnerable Software and Affected Versions: Go versions prior to 1.17.12 Go versions prior to 1.18.4 Description: The issue is related to uncontrolled recursion in Glob in io/fs, which allows an attacker to cause a panic due to stack exhaustion. This can be achieved by providing a path...

PT-2022-14118 · 3S Smart Software Solutions · Codesys Opc Da Server

Name of the Vulnerable Software and Affected Versions: CODESYS OPC DA Server versions prior to V3.5.18.20 Description: The issue concerns the storage of PLC passwords in plain text within the configuration file of the CODESYS OPC DA Server, making these passwords visible to all authorized Microso...

PT-2022-8921 · Dell · Dell Bsafe Crypto-C Micro Edition +1

Name of the Vulnerable Software and Affected Versions: Dell BSAFE Crypto-C Micro Edition versions prior to 4.1.5 Dell BSAFE Micro Edition Suite versions prior to 4.6 Description: The issue is related to an Observable Timing Discrepancy, which may allow attackers to exploit the vulnerability...

SUSE-SU-2022:2341-1 Security update for containerd, docker and runc

This update for containerd, docker and runc fixes the following issues: containerd: - CVE-2022-31030: Fixed denial of service via invocation of the ExecSync API bsc1200145 docker: - Update to Docker 20.10.17-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/201017...

PT-2022-6935 · Eclipse +3 · Eclipse Jetty +3

Name of the Vulnerable Software and Affected Versions: Eclipse Jetty versions prior to 9.4.47 Eclipse Jetty versions prior to 10.0.10 Eclipse Jetty versions prior to 11.0.10 Description: The issue arises from the incorrect handling of invalid HTTP/2 requests by the Eclipse Jetty HTTP/2 server...

PT-2022-22430 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.35.7 MediaWiki versions 1.36.x MediaWiki versions 1.37.x prior to 1.37.3 MediaWiki versions 1.38.x prior to 1.38.1 Description: An issue can occur in configurations that allow a JavaScript payload in a username,...

Important: Red Hat Enhancement Advisory: Red Hat Single Sign-On 7.6.0 update

New Red Hat Single Sign-On 7.6.0 packages are available from the Customer Portal. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat...

PT-2022-14845 · Unknown +6 · Cloud-Init +6

Name of the Vulnerable Software and Affected Versions: cloud-init versions prior to 22.3 Description: Sensitive data could be exposed in world-readable logs of cloud-init when schema failures are reported, potentially including hashed passwords. This issue may allow an attacker to gain unauthoriz...

CVE-2022-31082 SQL Injection via package deployment tasks in glpi-inventory-plugin

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plugin is a plugin for GLPI to handle inventory management. In affected versions a SQL injection can be made using package deployment tasks...

Design/Logic Flaw

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's repo-server. A malicious Argo CD user...

PT-2022-22044 · Jenkins · Jenkins Pipeline: Input Step Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Input Step Plugin versions 448.v37cea 9a 10a 70 and earlier Description: The issue allows attackers who can configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specifi...

PT-2022-4952 · Microsoft · Advertising Universal Event Tracking (Uet) Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Microsoft Advertising Universal Event Tracking UET WordPress plugin versions prior to 1.0.4 Description: The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks, even when the unfiltered html capability ...

PT-2022-11391 · Drools +1 · Drools +1

Name of the Vulnerable Software and Affected Versions: drools versions prior to 7.60 Description: The issue is related to an XML External Entity XXE vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability. Recommendations:...

Growi vulnerable to weak password requirements

Overview GROWI provided by WESEEK, Inc. contains a weak password requirements vulnerability CWE-521, CVE-2022-1236. 418sec first reported this vulnerability to JPCERT/CC, then JPCERT/CC contacted WSEEK, Inc. as a coordinator. After the coordination between 418sec and WESEEK, Inc. was completed,...

Unbreakable Enterprise kernel security update

5.4.17-2136.308.7 - uek-rpm: Update OL7/8 Secureboot certificate and shim versions Sherry Yang Orabug: 34248329 5.4.17-2136.308.6 - mac80211hwsim: call ieee80211txprepareskb under RCU protection Johannes Berg - arm: remove CONFIGARCHHASHOLESMEMORYMODEL Mike Rapoport - x86/cpu: Load microcode duri...

PT-2022-13992 · WordPress · Hc Custom Wp-Admin Url

Name of the Vulnerable Software and Affected Versions: HC Custom WP-Admin URL WordPress plugin versions 1.4 and earlier Description: The issue allows the secret login URL to be leaked when a specific crafted request is sent. Recommendations: For HC Custom WP-Admin URL WordPress plugin versions 1....

GHSA-V8X6-59G4-5G3W Denial of service binding form from JSON in Play Framework

Impact A denial-of-service vulnerability has been discovered in Play's forms library, in both the Scala and Java APIs. This can occur when using either the FormbindFromRequest method on a JSON request body or the Formbind method directly on a JSON value. If the JSON data being bound to the form...

PT-2022-6934 · Mariadb +6 · Mariadb +7

Name of the Vulnerable Software and Affected Versions: MariaDB versions prior to 10.9.2 Description: The issue is caused by errors in resource locking in the ds compress.cc component of the MariaDB database management system. Exploitation of this issue can allow an attacker to cause a denial of...