PT-2022-36180 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.80 Description: The issue is related to an alignment problem in the bpf prog test run skb function. It was introduced in version v4.12 and fixed in version v5.15.80. The actual impact and attack plausibili...

PT-2022-27566 · Tenda · Tenda W30E

Name of the Vulnerable Software and Affected Versions: Tenda W30E version 1.0.1.25633 Description: A stack overflow issue was discovered via the opttype parameter at the "/goform/IPSECsave" API endpoint. Recommendations: For Tenda W30E version 1.0.1.25633, as a temporary workaround, consider...

PT-2022-27555 · Tenda · Tenda W30E

Name of the Vulnerable Software and Affected Versions: Tenda W30E version 1.0.1.25633 Description: A stack overflow issue was discovered via the page parameter at the "/goform/P2pListFilter" API endpoint. Recommendations: For Tenda W30E version 1.0.1.25633, as a temporary workaround, consider...

PT-2022-27209 · Unknown · Sanitization Management System

Name of the Vulnerable Software and Affected Versions: Sanitization Management System version 1.0 Description: The issue concerns SQL Injection via the "/php-sms/admin/?page=services/view service&id=" endpoint, where an attacker can inject malicious SQL code using the id parameter. Recommendation...

PT-2022-27324 · Metinfo · Metinfo

Name of the Vulnerable Software and Affected Versions: MetInfo version 7.7 Description: A Cross-Site Request Forgery CSRF issue in the Administrator List allows attackers to arbitrarily add a Super Administrator account. This enables unauthorized access and control over the system. Recommendation...

PT-2022-27952 · Jenkins · Jenkins Sonar Gerrit Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Sonar Gerrit Plugin versions 377.v8f3808963dc5 and earlier Description: A cross-site request forgery CSRF issue allows attackers to have Jenkins connect to Gerrit servers using attacker-specified credentials IDs, potentially capturing...

PT-2022-27168 · Thinkphp · Thinkphp

Name of the Vulnerable Software and Affected Versions: Thinkphp versions 5.0.24 through 5.1.41 Description: The issue is caused by a code logic error that leads to a file upload getting shell access. This allows an attacker to potentially execute arbitrary code on the server. Recommendations: For...

PT-2022-26871 · Telegram · Telegram Web K

Name of the Vulnerable Software and Affected Versions: Telegram Web version 15.3.1 Description: The issue allows for XSS via a certain payload derived from a Target Corporation website. Some third parties have been unable to discern any relationship between the Pastebin information and a possible...

PT-2022-27825 · Proofpoint · Proofpoint Enterprise Protection

Name of the Vulnerable Software and Affected Versions: Proofpoint Enterprise Protection PPS/PoD versions 8.19.0 and below Description: The admin user interface in Proofpoint Enterprise Protection contains a command injection issue that allows an admin to execute commands beyond their allowed scop...

GHSA-X45C-CVP8-Q4FM Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace

Capsule implements a multi-tenant and policy-based environment in a Kubernetes cluster. A ServiceAccount deployed in a Tenant Namespace, when granted with PATCH capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule Operato...

PT-2022-25999 · Nadesiko3 · Nadesiko3

Name of the Vulnerable Software and Affected Versions: Nadesiko3 PC Version versions 3.3.61 and earlier Nadesiko3 PC Version versions 3.3.68 and earlier Description: The issue allows a remote attacker to execute an arbitrary OS command when processing compression and decompression on the product...

PT-2022-26932 · Fs020W +3 · Fs020W +3

Name of the Vulnerable Software and Affected Versions: +F FS040U versions v2.3.4 and earlier +F FS020W versions v4.0.0 and earlier +F FS030W versions v3.3.5 and earlier +F FS040W versions v1.4.1 and earlier Description: A cross-site request forgery CSRF issue allows an adjacent attacker to hijack...

PT-2022-27391 · Apache · Camel-Ldap

Name of the Vulnerable Software and Affected Versions: camel-ldap versions prior to 3.14.6 camel-ldap versions prior to 3.18.4 Description: The camel-ldap component is affected by an LDAP Injection issue when using the filter option. This allows for potential security breaches. Users are advised ...

PT-2022-27780 · Nodebb · Nodebb

Name of the Vulnerable Software and Affected Versions: NodeBB versions prior to 2.6.1 Description: The issue arises from a plain object with a prototype being used in socket.io message handling, allowing a specially crafted payload to impersonate other users and takeover accounts. Recommendations...

PT-2022-27284 · Crowdstrike · Crowdstrike Falcon

Name of the Vulnerable Software and Affected Versions: CrowdStrike Falcon version 6.44.15806 Description: The issue allows an administrative attacker to uninstall Falcon Sensor, bypassing the intended protection mechanism that requires possessing a one-time token. The sensor is managed at the...

CVE-2022-46145

authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified...

CVE-2022-46145 authentik vulnerable to unauthorized user creation and potential account takeover

authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified...

CVE-2022-46145 authentik vulnerable to unauthorized user creation and potential account takeover

authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified...

PT-2022-27598 · Tenda · Tenda Ac6V1.0

Name of the Vulnerable Software and Affected Versions: Tenda AC6V1.0 version 15.03.05.19 Description: A buffer overflow issue was discovered via the time parameter in the fromSetSysTime function. This issue may be exploited, potentially leading to unintended consequences. Recommendations: For Ten...

PT-2022-27611 · Tenda · Tenda I22

Name of the Vulnerable Software and Affected Versions: Tenda i22 version 1.0.0.34687 Description: A buffer overflow issue was discovered via the index parameter in the formWifiMacFilterGet function. This allows for potential exploitation. Recommendations: For Tenda i22 version 1.0.0.34687, as a...