🚨 CVE-2022-29866
OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to exhaust the memory resources of a server via a crafted request that triggers Uncontrolled Resource Consumption.
🎖@cveNotify
OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to exhaust the memory resources of a server via a crafted request that triggers Uncontrolled Resource Consumption.
🎖@cveNotify
OPC Foundation
Security - OPC Foundation
April 14th, 2026 The members of the “Industrial Security Harmonization Group” (ISHG), are pleased to share the Joint Working Group paper “Secure Deployment of Industrial Communication Protocols – A Risk Management Based Approach” Feb 10, 2026: As a contributor…
🚨 CVE-2022-29864
OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to cause a server to crash via a large number of messages that trigger Uncontrolled Resource Consumption.
🎖@cveNotify
OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to cause a server to crash via a large number of messages that trigger Uncontrolled Resource Consumption.
🎖@cveNotify
OPC Foundation
Security - OPC Foundation
April 14th, 2026 The members of the “Industrial Security Harmonization Group” (ISHG), are pleased to share the Joint Working Group paper “Secure Deployment of Industrial Communication Protocols – A Risk Management Based Approach” Feb 10, 2026: As a contributor…
🚨 CVE-2022-29863
OPC UA .NET Standard Stack 1.04.368 allows remote attacker to cause a crash via a crafted message that triggers excessive memory allocation.
🎖@cveNotify
OPC UA .NET Standard Stack 1.04.368 allows remote attacker to cause a crash via a crafted message that triggers excessive memory allocation.
🎖@cveNotify
OPC Foundation
Security - OPC Foundation
April 14th, 2026 The members of the “Industrial Security Harmonization Group” (ISHG), are pleased to share the Joint Working Group paper “Secure Deployment of Industrial Communication Protocols – A Risk Management Based Approach” Feb 10, 2026: As a contributor…
🚨 CVE-2021-41487
NOKIA VitalSuite SPM 2020 is affected by SQL injection through UserName'.
🎖@cveNotify
NOKIA VitalSuite SPM 2020 is affected by SQL injection through UserName'.
🎖@cveNotify
Twitter
Exploit Database
[webapps] NOKIA VitalSuite SPM 2020 - 'UserName' SQL Injection dlvr.it/RXWP5h
🚨 CVE-2022-32158
Splunk Enterprise deployment servers in versions before 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal Forwarder endpoint could use the vulnerability to execute arbitrary code on all other Universal Forwarder endpoints subscribed to the deployment server.
🎖@cveNotify
Splunk Enterprise deployment servers in versions before 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal Forwarder endpoint could use the vulnerability to execute arbitrary code on all other Universal Forwarder endpoints subscribed to the deployment server.
🎖@cveNotify
🚨 CVE-2022-22374
The BMC (IBM Power 9 AC922 OP910, OP920, OP930, and OP940) may be subject to a firmware downgrade attack which may affect its ability to operate its host. IBM X-Force ID: 221442.
🎖@cveNotify
The BMC (IBM Power 9 AC922 OP910, OP920, OP930, and OP940) may be subject to a firmware downgrade attack which may affect its ability to operate its host. IBM X-Force ID: 221442.
🎖@cveNotify
Ibm
Security Bulletin: This Power System update is being released to address CVE-2022-22374
POWER9: In response to a security issue with firmware update, this security bulletin is being issued to address Common Vulnerabilities and Exposures issue number CVE 2022-22374. There is no Power System firmware update for this. Please follow the Remediation…
🚨 CVE-2022-27192
The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file download. An unauthenticated attacker can impersonate an administrator by reading administrative files.
🎖@cveNotify
The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file download. An unauthenticated attacker can impersonate an administrator by reading administrative files.
🎖@cveNotify
Asseco
DVS Avilys
Dokumentų ir procesų valdymo sistema „Avilys“Mažiau popieriaus, daugiau tvarkos!Įsivaizduokite programinę įrangą, kuri leidžia centralizuotai kaupti visus organizacijoje sukuriamus bei gaunamus dokumentus, įgalina nepasimesti tarp skirtingų jų versijų ir...
🚨 CVE-2022-26360
IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.
🎖@cveNotify
IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.
🎖@cveNotify
🚨 CVE-2022-31464
Insecure permissions configuration in Adaware Protect v1.2.439.4251 allows attackers to escalate privileges via changing the service binary path.
🎖@cveNotify
Insecure permissions configuration in Adaware Protect v1.2.439.4251 allows attackers to escalate privileges via changing the service binary path.
🎖@cveNotify
Medium
Adaware Protect Local Privilege Escalation through Insecure Service Permissions (CVE-2022–31464)
Introduction
🚨 CVE-2022-24562
In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote code execution.
🎖@cveNotify
In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote code execution.
🎖@cveNotify
Medium
Exploiting IOTransfer insecure API CVE-2022–24562
Background
🚨 CVE-2020-35597
Victor CMS 1.0 is vulnerable to SQL injection via c_id parameter of admin_edit_comment.php, p_id parameter of admin_edit_post.php, u_id parameter of admin_edit_user.php, and edit parameter of admin_update_categories.php.
🎖@cveNotify
Victor CMS 1.0 is vulnerable to SQL injection via c_id parameter of admin_edit_comment.php, p_id parameter of admin_edit_post.php, u_id parameter of admin_edit_user.php, and edit parameter of admin_update_categories.php.
🎖@cveNotify
Cxsecurity
Victor CMS 1.0 Multiple SQL Injection (Authenticated) - CXSecurity.com
Furkan Göksel has realised a new security note Victor CMS 1.0 Multiple SQL Injection (Authenticated)
🚨 CVE-2022-31295
An issue in the delete_post() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily delete posts.
🎖@cveNotify
An issue in the delete_post() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily delete posts.
🎖@cveNotify
GitHub
GitHub - bigzooooz/CVE-2022-31295: Online Discussion Forum Site 1.0 - IDOR / Delete any post
Online Discussion Forum Site 1.0 - IDOR / Delete any post - bigzooooz/CVE-2022-31295
🚨 CVE-2022-26361
IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.
🎖@cveNotify
IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.
🎖@cveNotify
🚨 CVE-2021-38267
Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_blogs_web_portlet_BlogsAdminPortlet_title and _com_liferay_blogs_web_portlet_BlogsAdminPortlet_subtitle parameter.
🎖@cveNotify
Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_blogs_web_portlet_BlogsAdminPortlet_title and _com_liferay_blogs_web_portlet_BlogsAdminPortlet_subtitle parameter.
🎖@cveNotify
Liferay
Headless & Composable DXP | AI, CMS, DAM, Portals, Commerce
Digital Experience Platform designed for complexity. Integrates with everything: CMS ✓ DAM ✓ Commerce ✓ AI ✓ Low Code ✓ Search ✓ and more!
🚨 CVE-2021-40157
A user may be tricked into opening a malicious FBX file which may exploit an Untrusted Pointer Dereference vulnerability in FBX’s Review version 1.5.0 and prior causing it to run arbitrary code on the system.
🎖@cveNotify
A user may be tricked into opening a malicious FBX file which may exploit an Untrusted Pointer Dereference vulnerability in FBX’s Review version 1.5.0 and prior causing it to run arbitrary code on the system.
🎖@cveNotify
Autodesk
Security Advisories | Autodesk Trust Center
Autodesk applies cloud-computing security best practices in data center location, operations, facility characteristics, software controls, and risk mitigation.
🚨 CVE-2022-27512
Temporary disruption of the ADM license service. The impact of this includes preventing new licenses from being issued or renewed by Citrix ADM.
🎖@cveNotify
Temporary disruption of the ADM license service. The impact of this includes preventing new licenses from being issued or renewed by Citrix ADM.
🎖@cveNotify
🚨 CVE-2022-21125
Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
🎖@cveNotify
Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
🎖@cveNotify
Intel
INTEL-SA-00615
🚨 CVE-2022-33756
CA Automic Automation 12.2 and 12.3 contain an entropy weakness vulnerability in the Automic AutomationEngine that could allow a remote attacker to potentially access sensitive data.
🎖@cveNotify
CA Automic Automation 12.2 and 12.3 contain an entropy weakness vulnerability in the Automic AutomationEngine that could allow a remote attacker to potentially access sensitive data.
🎖@cveNotify
🚨 CVE-2022-33755
CA Automic Automation 12.2 and 12.3 contain an insecure input handling vulnerability in the Automic Agent that could allow a remote attacker to potentially enumerate users.
🎖@cveNotify
CA Automic Automation 12.2 and 12.3 contain an insecure input handling vulnerability in the Automic Agent that could allow a remote attacker to potentially enumerate users.
🎖@cveNotify
🚨 CVE-2022-33754
CA Automic Automation 12.2 and 12.3 contain an insufficient input validation vulnerability in the Automic agent that could allow a remote attacker to potentially execute arbitrary code.
🎖@cveNotify
CA Automic Automation 12.2 and 12.3 contain an insufficient input validation vulnerability in the Automic agent that could allow a remote attacker to potentially execute arbitrary code.
🎖@cveNotify
🚨 CVE-2022-33753
CA Automic Automation 12.2 and 12.3 contain an insecure file creation and handling vulnerability in the Automic agent that could allow a user to potentially elevate privileges.
🎖@cveNotify
CA Automic Automation 12.2 and 12.3 contain an insecure file creation and handling vulnerability in the Automic agent that could allow a user to potentially elevate privileges.
🎖@cveNotify