PT-2022-21471 · Apple +6 · Macos Monterey +12

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 15.6 iPadOS versions prior to 15.6 watchOS versions prior to 8.7 tvOS versions prior to 15.6 macOS Monterey versions prior to 12.5 Safari versions prior to 15.6 Description: An out-of-bounds write issue was addressed wit...

Pimcore SQL Injection Vulnerability (CNVD-2022-62178)

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. A SQL injection vulnerability exists in Pimcore...

Malicious code in @goatapp/web-content-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e84e5e811d3fa4518a09e29f874e3c06261de0493410085336d5e0a717e078fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-292 Malicious code in @goatapp/web-content-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e84e5e811d3fa4518a09e29f874e3c06261de0493410085336d5e0a717e078fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-31050

TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This...

CVE-2022-31049

TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions...

CVE-2022-31046

TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality fails to limit the result set to allowed columns of a particular database table. This way, authenticated users can export internal details...

Design/Logic Flaw

TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This...

Cross site scripting

TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit...

CVE-2022-31050

TYPO3 Admin Tool sessions could remain valid after a user account was degraded or disabled, enabling prolonged access in the admin interface prior to the fixes. The vulnerability affects TYPO3 CMS and was addressed by updates in 9.5.34 ELTS, 10.4.29, and 11.5.11, per CVE-2022-31050 disclosures. T...

CVE-2022-31049 Cross-Site Scripting in Frontend Login Mailer

TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions...

CVE-2022-31046

TYPO3 Information Disclosure via Export Module (CVE-2022-31046): The export feature could leak internal details by not limiting the result set to allowed columns. Affected TYPO3 versions include 7.6.57 ELTS, 8.7.47 ELTS, 9.5.35 ELTS, 10.4.29, and 11.5.11. Remediation: upgrade to the fixed release...

CVE-2022-31047

CVE-2022-31047 affects TYPO3: prior to 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentials (e.g., database credentials) could be logged as plaintext in exception handlers when logging complete stack traces. A fix was released in the listed versions. Practical ...

Elitecms arbitrary code execution vulnerability

Elitecms is a web content management from elitecms India. elitecms 1.01 has an arbitrary code execution vulnerability that can be exploited by attackers to execute arbitrary code attacks via admin/manageuploads.php...

Elitecms SQL Injection Vulnerability (CNVD-2022-57763)

Elitecms is a Web content management by elitecms India. elitecms version 1.01 has a SQL injection vulnerability that originates from the admin/editpost.php page's lack of validation of external input SQL statements, which can be exploited by attackers to execute illegal SQL commands to steal...

Elitecms arbitrary file deletion vulnerability

Elitecms is a web content management from elitecms India. elitecms version 1.01 has an arbitrary file deletion vulnerability that can be exploited by attackers to delete any file...

Elitecms SQL Injection Vulnerability (CNVD-2022-57759)

Elitecms is a Web content management from elitecms India. elitecms version 1.01 has a SQL injection vulnerability that originates from the lack of validation of external input SQL statements on the /admin/addpost.php page, which can be exploited by attackers to execute illegal SQL commands to ste...

CVE-2022-26709

A flaw was found in webkitgtk. Due to improper input validation, the issue occurs, leading to a use-after-free vulnerability. This flaw allows an attacker with network access to pass specially crafted web content files, causing an application to halt, crash, or arbitrary code execution...

CVE-2022-26700

A flaw was found in webkitgtk. The vulnerability occurs due to improper input validation, leading to memory corruption. This flaw allows an attacker with network access to pass specially crafted web content files, causing an application to halt, crash, or arbitrary code execution...

USN-5457-1: WebKitGTK vulnerabilities

A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service...