PT-2022-11637 · Leanote · Leanote

Name of the Vulnerable Software and Affected Versions: leanote version 2.6.1 Description: A problematic issue has been found in leanote, affecting the function define of the file public/js/plugins/history.js. The manipulation of the content argument leads to cross-site scripting. The attack may b...

PT-2022-7118 · Unrar +5 · Unrar +5

Name of the Vulnerable Software and Affected Versions: UnRAR versions prior to 6.2.3 Description: The issue is related to the incorrect handling of symbolic links before accessing a file, which can be exploited by a remote attacker to gain access to confidential data. This can occur via symlink...

PT-2022-27901 · Tenda · Tenda F1203

Name of the Vulnerable Software and Affected Versions: Tenda F1203 version 2.0.1.6 Description: A buffer overflow issue was discovered via the page parameter at the "/goform/VirtualSer" API endpoint. Recommendations: For Tenda F1203 version 2.0.1.6, as a temporary workaround, consider restricting...

PT-2022-27892 · Tenda · Tenda F1203

Name of the Vulnerable Software and Affected Versions: Tenda F1203 version 2.0.1.6 Description: A command injection issue was discovered via the mac parameter at the "/goform/WriteFacMac" API endpoint. Recommendations: For Tenda F1203 version 2.0.1.6, as a temporary workaround, consider restricti...

CVE-2022-23536

Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted t...

Design/Logic Flaw

Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted t...

CVE-2022-23536 Alertmanager can expose local files content via specially crafted config

Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted t...

CVE-2022-23536 Alertmanager can expose local files content via specially crafted config

Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted t...

GHSA-CQ2G-PW6Q-HF7J Cortex's Alertmanager can expose local files content via specially crafted config

Impact A local file inclusion vulnerability exists in Cortex versions v1.13.0, v1.13.1 and v1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users o...

PT-2022-25383 · Unknown · Employee Performance Evaluation System

Name of the Vulnerable Software and Affected Versions: Employee Performance Evaluation System version 1.0 Description: The issue is related to a persistent cross-site scripting XSS vulnerability. This vulnerability can be exploited via adding new entries under the Departments and Designations...

PT-2022-26674 · Autodesk · Autodesk Maya

Name of the Vulnerable Software and Affected Versions: Autodesk Maya versions 2022 through 2023 Description: A maliciously crafted X B file can be used to write beyond the allocated buffer when parsed through Autodesk Maya. This issue can lead to arbitrary code execution. Recommendations: For...

PT-2022-11610 · Unknown · Ctrlo Lenio

Name of the Vulnerable Software and Affected Versions: ctrlo lenio affected versions not specified Description: A vulnerability has been found in ctrlo lenio, classified as problematic, affecting an unknown functionality of the file views/layouts/main.tt of the component Notice Handler. The...

PT-2022-27728 · Unknown · 3D City Database Ogc Web Feature Service

Name of the Vulnerable Software and Affected Versions: 3D City Database OGC Web Feature Service versions up to 5.2.1 Description: A vulnerability was found in the 3D City Database OGC Web Feature Service, which affects some unknown processing and leads to xml external entity reference. The...

PT-2022-11603 · As +1 · As

Name of the Vulnerable Software and Affected Versions: as affected versions not specified Description: A vulnerability was found in the function getFullURL of the file include.cdn.php. The manipulation leads to cross-site scripting. The attack can be initiated remotely. Recommendations: Apply a...

PT-2022-11622 · Unknown · Ctrlo Lenio

Name of the Vulnerable Software and Affected Versions: ctrlo lenio affected versions not specified Description: A vulnerability was found in the Task Handler component, affecting the file views/task.tt. The manipulation of the argument site.org.name/check.name/task.tasktype.name/task.name leads t...

PT-2022-27676 · Unknown · Mschaef Toto

Name of the Vulnerable Software and Affected Versions: mschaef toto versions up to 1.4.20 Description: A vulnerability was found in the Todo List Handler component, which can be exploited remotely. The manipulation leads to cross-site scripting. It is recommended to upgrade the affected component...

PT-2022-16022 · Unknown · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: BigBlueButton versions prior to 2.4-rc-6 Description: The moderators-only webcams lock setting in BigBlueButton is not enforced on the backend. This allows an attacker to subscribe to viewers' webcams, even when the lock setting is applied, b...

PT-2022-27658 · Opencaching Deutschland · Oc-Server3

Name of the Vulnerable Software and Affected Versions: Opencaching Deutschland oc-server3 affected versions not specified Description: A problematic vulnerability was found in the Cachelist Handler component, specifically in the file htdocs/templates2/ocstyle/cachelists.tpl. The manipulation of t...

Null pointer dereference

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to 4.9 contain a NULL Pointer Dereference in BLE L2CAP module. The Contiki-NG operating system for IoT devices contains a Bluetooth Low Energy stack. An attacker can inject a packet in th...

CVE-2022-41972 Contiki-NG contains NULL Pointer Dereference in BLE L2CAP module

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to 4.9 contain a NULL Pointer Dereference in BLE L2CAP module. The Contiki-NG operating system for IoT devices contains a Bluetooth Low Energy stack. An attacker can inject a packet in th...