product: V-Server

vendor: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd.

product: v-server

vendor: fujielectric

summary: Stack-based buffer overflow vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by having a user to open a specially crafted project file.

title: Fujielectric V-Server security vulnerability


default_status: unaffected

product: Checkmk

status: affected

version_type: semver

ecosystem: software/application

metric_type: Primary

severity: high

metric_type: Secondary

severity: medium

part: a

product: checkmk

vendor: checkmk

quality: metadata-backed

recipe_kind: composed

status: Modified

summary: Livestatus Query Language (LQL) injection in the AuthUser HTTP query header of Tribe29's Checkmk <= 2.1.0p11, Checkmk <= 2.0.0p28, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to perform direct queries to the application's core from localhost.

title: Checkmk security vulnerability


product: RTLS Studio

vendor: Sewio

version_type: custom

severity: critical

vendor: sewio

summary: Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system commands.

title: Sewio Real-Time Location System Studio security vulnerability


product: macOS

vendor: Apple

version: unspecified

ecosystem: apple/platform

part: o

product: macos

vendor: apple

summary: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.


summary: Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to several modules and services of the software. This could allow an attacker to delete arbitrary files and cause a denial-of-service condition.


product: csaf-validator-lib

vendor: Secvisogram

summary: An high privileged attacker may pass crafted arguments to the validate function of csaf-validator-lib of a locally installed Secvisogram in versions < 0.1.0 wich can result in arbitrary code execution and DoS once the users triggers the validation.

title: Csaf-Validator-Lib Project Csaf-Validator-Lib security vulnerability


product: csaf-validator-service

summary: The validate JSON endpoint of the Secvisogram csaf-validator-service in versions < 0.1.0 processes tests with unexpected names. This insufficient input validation of requests by an unauthenticated remote user might lead to a partial DoS of the service. Only the request of the attacker is affected by this vulnerability.


product: ayacms

summary: AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/admin/fst_del.inc.php


product: mediawiki

vendor: mediawiki

product: fedora

vendor: fedoraproject

summary: An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pre-existing data directory that has weak permissions, the SQLite files are created with file mode 0644, i.e., world readable to local users. These files include credentials data.


product: misp

vendor: misp-project

summary: In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/upload_file.ctp.


ecosystem: linux/kernel

vendor: linux

vendor: debian

summary: In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with "tc qdisc" and "tc class" commands. This affects qdisc_graft in net/sched/sch_api.c.

title: Linux Linux Kernel security vulnerability


product: tss-lib

vendor: iofinnet

summary: An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session id, context, or random nonce in the generation of the challenge. This could allow a malicious user or an eavesdropper to replay a valid proof sent in the past.


summary: IO FinNet tss-lib before 2.0.0 allows a collision of hash values.


product: brave

vendor: brave

summary: Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This vulnerability is caused by an incomplete fix for CVE-2022-47933.

title: Brave security vulnerability


summary: Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme. This vulnerability is caused by an uncaught exception in the function ipfs::OnBeforeURLRequest_IPFSRedirectWork() in ipfs_redirect_network_delegate_helper.cc.


ecosystem: windows/system

summary: Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This is caused by an incomplete fix for CVE-2022-47932 and CVE-2022-47934.

title: Brave security vulnerability


default_status: unknown

product: JT Open

vendor: Siemens

version: All versions < V11.1.1.0

product: JT Utilities

version: All versions < V13.1.1.0

product: Solid Edge

version: All versions < V2023

vendor: siemens

summary: A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versions < V2023). The Jt1001.dll contains a memory corruption vulnerability while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-19078)

title: Siemens Jt Open Toolkit security vulnerability


version: All versions < V11.2.3.0

version: All versions < V13.2.3.0

product: Parasolid V34.0

version: All versions < V34.0.252

product: Parasolid V34.1

version: All versions < V34.1.242

product: Parasolid V35.0

version: All versions < V35.0.170

product: Parasolid V35.1

version: All versions < V35.1.150

product: parasolid

summary: A vulnerability has been identified in JT Open (All versions < V11.2.3.0), JT Utilities (All versions < V13.2.3.0), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Parasolid V35.1 (All versions < V35.1.150). The affected application contains a stack overflow vulnerability while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.


vendor: Apache Software Foundation

vendor: apache

summary: Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. The org.apache.sling.commons.json bundle has been deprecated as of March 2017 and should not be used anymore. Consumers are encouraged to consider the Apache Sling Commons Johnzon OSGi bundle provided by the Apache Sling project, but may of course use other JSON libraries.

title: Apache Sling Commons Json security vulnerability


summary: An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2misc.c has an out-of-bounds read and OOPS for SMB2_TREE_CONNECT.


summary: An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c has a use-after-free and OOPS for SMB2_TREE_DISCONNECT.


summary: An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.18 before 5.18.18. fs/ksmbd/smb2pdu.c lacks length validation in the non-padding case in smb2_write.


summary: An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c omits a kfree call in certain smb2_handle_negotiate error conditions, aka a memory leak.


summary: An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is a heap-based buffer overflow in set_ntacl_dacl, related to use of SMB2_QUERY_INFO_HE after a malformed SMB2_SET_INFO_HE command.


summary: An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is an out-of-bounds read and OOPS for SMB2_WRITE, when there is a large length in the zero DataOffset case.


product: thinkphp

vendor: thinkphp

summary: ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.

title: Thinkphp security vulnerability


summary: An issue was discovered in the Linux kernel 5.10.x before 5.10.155. A use-after-free in io_sqpoll_wait_sq in fs/io_uring.c allows an attacker to crash the kernel, resulting in denial of service. finish_wait can be skipped. An attack can occur in some situations by forking a process and then quickly terminating it. NOTE: later kernel versions, such as the 5.15 longterm series, substantially changed the implementation of io_sqpoll_wait_sq.


vendor: nintendo

product: arms

product: splatoon

summary: The Nintendo NetworkBuffer class, as used in Animal Crossing: New Horizons before 2.0.6 and other products, allows remote attackers to execute arbitrary code via a large UDP packet that causes a buffer overflow, aka ENLBufferPwn. The victim must join a game session with the attacker. Other affected products include Mario Kart 7 before 1.2, Mario Kart 8, Mario Kart 8 Deluxe before 2.1.0, ARMS before 5.4.1, Splatoon, Splatoon 2 before 5.5.1, Splatoon 3 before late 2022, Super Mario Maker 2 before 3.0.2, and Nintendo Switch Sports before late 2022.

title: Nintendo Animal Crossing: New Horizons security vulnerability


product: swift

vendor: openstack

summary: An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).


product: cinder

product: glance

product: nova

summary: An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.

title: Openstack Cinder security vulnerability


product: macOS

vendor: Apple

product: macos

summary: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.


business_risk: Critical unauthenticated remote code execution in affected ManageEngine on-premise products. Exploitation can lead to arbitrary code execution with potential confidentiality, integrity, and availability impact. CISA lists CVE-2022-47966 as a known exploited vulnerability, so internet-facing or otherwise reachable installations should be prioritized immediately.

claim: The vulnerability affects multiple ManageEngine on-premise products, including the products and builds listed in the vendor advisory.

claim: The vendor advisory identifies the impacted version ranges for each covered ManageEngine product.

claim: Applicability depends on SAML-based SSO: for some products it must be currently active, while for others it must have been configured at least once.

kind: exposure

claim: The vendor advisory specifies concrete fixed builds, including Access Manager Plus 4308, ServiceDesk Plus 14004, Endpoint Central 10.1.2228.11, and product-specific fixed builds for the other covered products.

claim: ManageEngine states that the issue was fixed by updating the affected third-party module to a recent version.

kind: remediation

claim: Comparing the deployed product build with the vendor’s impacted and fixed-version table provides an inert version-based remediation check.

kind: verification

claim: NVD describes the issue as remote code execution and states that exploitation depends on SAML SSO having been configured, with current activation required for some products.

exposure_conditions: The deployment is a ManageEngine on-premise product covered by the vendor advisory and is running an impacted version.

exposure_conditions: For Access Manager Plus, Analytics Plus, Application Control Plus, Browser Security Plus, Device Control Plus, Endpoint Central, Endpoint Central MSP, Endpoint DLP, Key Manager Plus, OS Deployer, PAM 360, Password Manager Pro, Patch Manager Plus, Remote Access Plus, Remote Monitoring and Management, or Vulnerability Manager Plus, SAML-based SSO is configured and currently active.

exposure_conditions: For Active Directory 360, ADAudit Plus, ADManager Plus, ADSelfService Plus, Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, or SupportCenter Plus, SAML-based SSO was configured at least once, regardless of its current status.

exposure_conditions: ManageEngine On-Demand/cloud products are not affected according to the vendor advisory.

recipe_specificity: specific

remediation_steps: Identify each deployed ManageEngine on-premise product and its installed build.

remediation_steps: Upgrade Access Manager Plus to build 4308 or later; Active Directory 360 to 4310 or later; ADAudit Plus to 7081 or later; ADManager Plus to 7162 or later; ADSelfService Plus to 6211 or later; Analytics Plus to 5150 or later; Application Control Plus to 10.1.2220.18 or later; Asset Explorer to 6983 or later; Browser Security Plus to 11.1.2238.6 or later; Device Control Plus to 10.1.2220.18 or later; Endpoint Central and Endpoint Central MSP to 10.1.2228.11 or later; Endpoint DLP to 10.1.2137.6 or later; Key Manager Plus to 6401 or later; OS Deployer to 1.1.2243.1 or later; PAM 360 to 5713 or l…

remediation_steps: Apply the update using the applicable ManageEngine vendor-supported update procedure. The vendor states that the fix updates the affected third-party module.

remediation_steps: If immediate updating is not possible, prioritize affected systems for compensating controls and incident review, particularly systems exposed to untrusted networks. The provided authoritative sources do not specify a complete vendor-approved mitigation procedure.

status: complete

uncertainty: The supplied source record reports product and version as n/a and truncates the product list; the exact affected product inventory must therefore be established separately.

uncertainty: The vendor advisory provides fixed builds and SAML applicability conditions but does not provide a universal verification command or a product-independent validation procedure.

uncertainty: A version at or above the listed fixed build is evidence of remediation for the corresponding product, but product-specific upgrade paths or later superseding releases should be confirmed through ManageEngine support documentation.

verification_steps: Confirm the installed product and build is at or above the corresponding fixed version in the ManageEngine advisory.

verification_steps: Confirm whether SAML-based SSO is currently active or was previously configured, using the product’s administrative configuration or deployment records; use the applicable condition for the specific product.

verification_steps: Reassess the vulnerability after updating with an approved authenticated inventory or vulnerability-management check. Do not conduct exploit-based testing against production systems.

verification_steps: Review relevant authentication, administrative, and endpoint telemetry for signs of unauthorized activity because the vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog.

ecosystem: java/maven

known_ransomware_campaign_use: Known

product: ManageEngine

required_action: Apply updates per vendor instructions.

vendor_project: Zoho

vulnerability_name: Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

author: Codex

description: CVE-2022-47966 is CISA KEV ManageEngine leftover. NVD last-affects ServiceDesk 14003. Vendor names 14004. Endpoint Central has no NVD CPE.

maturity: development

title: CVE-2022-47966: ManageEngine pre-auth RCE

vendor: zohocorp

recipe_kind: markdown-draft

status: Analyzed

summary: Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41.


version: All versions < V2023 MP1

summary: A vulnerability has been identified in Solid Edge (All versions < V2023 MP1). The DOCMGMT.DLL contains a memory corruption vulnerability that could be triggered while parsing files in different file formats such as PAR, ASM, DFT. This could allow an attacker to execute code in the context of the current process.


vendor: linuxserver

summary: Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The stored XSS will be triggered in the "Application list" page.


product: HarmonyOS

vendor: Huawei

product: EMUI

ecosystem: operating-system

product: emui

vendor: huawei

product: harmonyos

summary: The Bluetooth AVRCP module has a vulnerability that can lead to DoS attacks.Successful exploitation of this vulnerability may cause the Bluetooth process to restart.

title: Huawei Emui security vulnerability


summary: The DUBAI module has a double free vulnerability. Successful exploitation of this vulnerability may affect system availability.


summary: The DMSDP module of the distributed hardware has a vulnerability that may cause imposter control connections.Successful exploitation of this vulnerability may disconnect normal service connections.

title: Huawei Emui security vulnerability


product: JT Open

product: JT Utilities

summary: A vulnerability has been identified in JT Open (All versions < V11.2.3.0), JT Utilities (All versions < V13.2.3.0). The affected application contains a memory corruption vulnerability while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.


product: InfoSphere Information Server

vendor: IBM

ecosystem: javascript/npm

vendor: ibm

summary: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 243161.


summary: IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 243163.


product: Aspera Faspex

version: 4.4.2 Patch Level 1 and earlier

business_risk: Critical remote code execution risk in IBM Aspera Faspex. The vulnerability is remotely exploitable without authentication and can affect confidentiality, integrity, and availability. It is listed in CISA's Known Exploited Vulnerabilities Catalog, so remediation should be prioritized.

claim: The affected product is IBM Aspera Faspex.

claim: IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier are affected.

claim: A remote attacker may execute arbitrary code by sending a specially crafted obsolete API call; the issue is a YAML deserialization flaw.

claim: The obsolete API call was removed and the vulnerability was remediated in IBM Aspera Faspex 4.4.2 PL2.

claim: IBM recommends applying the fix as soon as possible; the listed fixing release is IBM Aspera Faspex 4.4.2 PL2 for Linux and Windows.

claim: A deployment can be considered remediated when its installed Faspex version is confirmed to be 4.4.2 PL2 or later through an approved non-invasive version-inventory process.

exposure_conditions: IBM Aspera Faspex 4.4.2 Patch Level 1 or earlier is deployed.

exposure_conditions: The Faspex service is reachable by an attacker over the network.

exposure_conditions: The obsolete API call remains available, as in affected releases.

remediation_steps: Upgrade IBM Aspera Faspex to version 4.4.2 PL2 or later using IBM's vendor-provided installation guidance.

remediation_steps: Prioritize internet-facing or otherwise remotely reachable Faspex instances.

remediation_steps: If immediate upgrade is not possible, apply organizational compensating controls to restrict network access to the Faspex service; IBM lists no specific workaround.

uncertainty: The authoritative sources identify 4.4.2 PL2 as the fixing release but do not establish whether later Faspex release branches retain equivalent remediation; follow IBM guidance for versions newer than 4.4.2 PL2.

uncertainty: The sources do not provide a product-specific, non-invasive command or UI procedure for determining the installed version.

uncertainty: The sources confirm KEV listing and active exploitation assessment but do not provide campaign-specific indicators for an individual deployment.

verification_steps: Using an approved, non-invasive asset or product-version inventory process, confirm the deployed Faspex version is 4.4.2 PL2 or later.

verification_steps: Record the updated version and deployment status for each Faspex instance, including Linux and Windows deployments.

verification_steps: Do not perform exploit attempts or invoke the obsolete API as a verification method.

vendor_project: IBM

vulnerability_name: IBM Aspera Faspex Code Execution Vulnerability

summary: IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.


product: AIX

product: vios

product: aix

summary: IBM AIX 7.1, 7.2, 7.3 and VIOS , 3.1 could allow a non-privileged local user to exploit a vulnerability in X11 to cause a buffer overflow that could result in a denial of service or arbitrary code execution. IBM X-Force ID: 243556.

title: Ibm Vios security vulnerability