‼ CVE-2022-22367 ‼
📖 Read
via "National Vulnerability Database".
IBM UrbanCode Deploy (UCD) 6.2.7.15, 7.0.5.10, 7.1.2.6, and 7.2.2.1 could disclose sensitive database information to a local user in plain text. IBM X-Force ID: 221008.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32051 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc, week, sTime, eTime parameters in the function FUN_004133c4.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31604 ‼
📖 Read
via "National Vulnerability Database".
NVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe deserialization. The deserialization of Untrusted Data may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32049 ‼
📖 Read
via "National Vulnerability Database".
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the url parameter in the function FUN_00418540.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32036 ‼
📖 Read
via "National Vulnerability Database".
Tenda M3 V1.0.0.12 was discovered to contain multiple stack overflow vulnerabilities via the ssidList, storeName, and trademark parameters in the function formSetStoreWeb.📖 Read
via "National Vulnerability Database".
🕴 ICYMI: A Microsoft Warning, Follina, Atlassian, and More 🕴
📖 Read
via "Dark Reading".
Dark Reading's digest of the other don't-miss stories of the week, including YouTube account takeovers and a sad commentary on cyber-pro hopelessness.📖 Read
via "Dark Reading".
Dark Reading
ICYMI: A Microsoft Warning, Follina, Atlassian, and More
Dark Reading's digest of the other don't-miss stories of the week, including YouTube account takeovers and a sad commentary on cyber-pro hopelessness.
‼ CVE-2022-25876 ‼
📖 Read
via "National Vulnerability Database".
The package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. This is due to flawed DNS rebinding protection.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32095 ‼
📖 Read
via "National Vulnerability Database".
Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at orders.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25900 ‼
📖 Read
via "National Vulnerability Database".
All versions of package git-clone are vulnerable to Command Injection due to insecure usage of the --upload-pack feature of git.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31943 ‼
📖 Read
via "National Vulnerability Database".
MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32082 ‼
📖 Read
via "National Vulnerability Database".
MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32085 ‼
📖 Read
via "National Vulnerability Database".
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32384 ‼
📖 Read
via "National Vulnerability Database".
Tenda AC23 v16.03.07.44 was discovered to contain a stack overflow via the security_5g parameter in the function formWifiBasicSet.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32089 ‼
📖 Read
via "National Vulnerability Database".
MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32094 ‼
📖 Read
via "National Vulnerability Database".
Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at doctorlogin.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25758 ‼
📖 Read
via "National Vulnerability Database".
All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25898 ‼
📖 Read
via "National Vulnerability Database".
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT signature if it has Base64URL and dot safe string before executing JWS.verify() or JWS.verifyJWT() method.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32081 ‼
📖 Read
via "National Vulnerability Database".
MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32084 ‼
📖 Read
via "National Vulnerability Database".
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32083 ‼
📖 Read
via "National Vulnerability Database".
MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25896 ‼
📖 Read
via "National Vulnerability Database".
This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.📖 Read
via "National Vulnerability Database".