PT-2022-26653 · Linaro · Lava

Name of the Vulnerable Software and Affected Versions: Linaro Automated Validation Architecture LAVA versions prior to 2022.10 Description: The issue is related to dynamic code execution in lava server/lavatable.py due to improper input sanitization. This allows an anonymous user to force the...

PT-2022-21712 · Robustel · Robustel R1510

Name of the Vulnerable Software and Affected Versions: Robustel R1510 version 3.1.16 Description: A command injection issue exists in the js package install functionality, allowing arbitrary command execution via a specially-crafted network request. An attacker can exploit this by sending a...

PT-2022-25888 · Tenda · Tenda Ac1200

Name of the Vulnerable Software and Affected Versions: Tenda AC1200 version US AC6V2.0RTL V15.03.06.51 multi TDE01 Description: A buffer overflow was discovered in the 0x4a12cc function, allowing attackers to cause a Denial of Service DoS via a crafted request. Recommendations: For Tenda AC1200...

PT-2022-22435 · Sourcecodester · Sourcecodester Human Resource Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Human Resource Management System version 1.0 Description: A critical issue was found in the Profile Photo Handler component, where manipulation of the argument parameter leads to os command injection. This issue can be initiate...

PT-2022-5201 · Juniper Networks · Junos Evolved

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS Evolved on PTX Series versions prior to 20.4R3-S4-EVO Juniper Networks Junos OS Evolved on PTX Series version 21.1R1-EVO and later versions Juniper Networks Junos OS Evolved on PTX Series version 21.2R1-EVO and later...

PT-2022-26211 · Unknown · Wedding Planner

Name of the Vulnerable Software and Affected Versions: Wedding Planner version 1.0 Description: The issue allows for arbitrary code execution via the users profile.php file. Recommendations: For Wedding Planner version 1.0, consider restricting access to the users profile.php file until a patch i...

PT-2022-25918 · Unknown · Open Source Sacco Management System

Name of the Vulnerable Software and Affected Versions: Open Source SACCO Management System version 1.0 Description: A SQL injection issue was found in the id parameter at the /sacco shield/ajax.php?action=delete plan API endpoint. This allows for potential exploitation. Recommendations: For Open...

CVE-2022-39296 Path traversal in MelisAssetManager

MelisAssetManager provides deliveries of Melis Platform's assets located in every module's public folder. Attackers can read arbitrary files on affected versions of melisplatform/melis-asset-manager, leading to the disclosure of sensitive information. Conducting this attack does not require...

PT-2022-5053 · Sap · Sap Manufacturing Execution

Name of the Vulnerable Software and Affected Versions: SAP Manufacturing Execution versions 15.1 through 15.3 Description: The issue allows an attacker to exploit insufficient validation of a file path request parameter, enabling arbitrary traversal of directories on the remote server. This can...

CVE-2022-39296 Path traversal in MelisAssetManager

MelisAssetManager provides deliveries of Melis Platform's assets located in every module's public folder. Attackers can read arbitrary files on affected versions of melisplatform/melis-asset-manager, leading to the disclosure of sensitive information. Conducting this attack does not require...

PT-2022-25294 · Siemens · Sicam P855 +1

Name of the Vulnerable Software and Affected Versions: SICAM P850 versions prior to V3.10 SICAM P855 versions prior to V3.10 Description: A vulnerability has been identified in the affected devices, which accept user-defined session cookies and do not renew the session cookie after login/logout...

PT-2022-6442 · Nokia · Netact

Name of the Vulnerable Software and Affected Versions: Nokia NetAct versions prior to 22 FP2211 Description: The issue is related to the lack of input validation when creating a working set in the NetAct system, allowing an attacker to inject a client-side template payload. This can lead to the...

PT-2022-34789 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.12 Description: The issue is related to a possible overflow in the amu fie setup function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions pri...

PT-2022-25565 · Unknown · Codeigniter

Name of the Vulnerable Software and Affected Versions: CodeIgniter versions =3.1.13 Description: The issue concerns SQL Injection via the having function in the system/database/DB query builder.php file. Note that the validity of this issue has been disputed by multiple third parties...

PT-2022-23615 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue allows an authenticated user to obtain sensitive information that should only be available to a privileged user. Recommendations: For IBM InfoSphere Information Server...

PT-2022-23518 · Zkteco · Zkbio Cvsecurity V5000

Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBioSecurity V5000 version 3.0.5 r Description: An access control issue allows attackers to arbitrarily create admin users via a crafted HTTP request. Recommendations: For ZKTeco ZKBioSecurity V5000 version 3.0.5 r, consider restricti...

PT-2022-26236 · Unknown · Online Diagnostic Lab Management System

Name of the Vulnerable Software and Affected Versions: Online Diagnostic Lab Management System version 1.0 Description: The issue concerns SQL Injection, which can be exploited via the /diagnostic/editcategory.php?id= endpoint. This allows for potential manipulation of database queries by injecti...

Weseek GROWI 安全漏洞

Weseek GROWI is a suite of team collaboration software from Weseek Japan. A security vulnerability exists in Weseek GROWI v5 series versions prior to v5.1.4 and v4 series versions prior to v4.5.25, which stems from an access restriction failure and can be exploited by an attacker to view...

PT-2022-25900 · Unknown · Online Diagnostic Lab Management System

Name of the Vulnerable Software and Affected Versions: Online Diagnostic Lab Management System version 1.0 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability in the /php action/editFile.php component...

PT-2022-25613 · Nedi · Nedi

Name of the Vulnerable Software and Affected Versions: NeDi versions 1.0.7 and earlier Description: A vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity of a device via a User Enumeration vulnerability. This is due t...