PT-2022-24446 · Archery · Archery

Name of the Vulnerable Software and Affected Versions: Archery versions 1.4.0 through 1.8.5 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the ThreadIDs parameter in the create kill session interface. Recommendations: For Archery versions 1.4.0 through...

PT-2022-24563 · Transtek · Transtek Mojodat Fam

Name of the Vulnerable Software and Affected Versions: Transtek Mojodat FAM Fixed Asset Management version 2.4.6 Description: The issue allows remote attackers to send SCRIPT tags as injected input to the API request, potentially leading to security issues. Recommendations: For version 2.4.6,...

PT-2022-25009 · Nokia · Nokia 1350 Oms

Name of the Vulnerable Software and Affected Versions: NOKIA 1350 OMS version R14.2 Description: An Open Redirect issue occurs on the login page via the next HTTP GET parameter. Recommendations: For NOKIA 1350 OMS version R14.2, consider restricting access to the login page or validating the next...

PT-2022-24352 · Unknown · Online Leave Management System

Name of the Vulnerable Software and Affected Versions: Online Leave Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/maintenance/manage department.php" API endpoint. Recommendations:...

PT-2022-22009 · Micro Star International · Msi Feature Navigator

Name of the Vulnerable Software and Affected Versions: Micro-Star International MSI Feature Navigator version 1.0.1808.0901 Description: An issue in the software allows attackers to download arbitrary files, regardless of the file type or size. Recommendations: For version 1.0.1808.0901, consider...

PT-2022-23193 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 5.7.15 Description: The issue allows users to bypass the Access Control List ACL if backend admin controllers are called with a certain notation, enabling them to execute actions they are normally not able to do...

PT-2022-24475 · Unknown · Church Management System

Name of the Vulnerable Software and Affected Versions: Church Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/admin/edit event.php" API endpoint. Recommendations: For Church...

PT-2022-24476 · Unknown · Garage Management System

Name of the Vulnerable Software and Affected Versions: Garage Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/garage/editcategory.php" API endpoint. Recommendations: For Garage...

PT-2022-24478 · Unknown · Garage Management System

Name of the Vulnerable Software and Affected Versions: Garage Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/garage/editclient.php" API endpoint. Recommendations: For Garage...

PT-2022-23275 · Unknown · Sazanrjb Inventorymanagementsystem

Name of the Vulnerable Software and Affected Versions: sazanrjb InventoryManagementSystem version 1.0 Description: A SQL injection issue in Stocks.java allows attackers to execute arbitrary SQL commands via parameters such as productcode. This enables unauthorized access and manipulation of...

PT-2022-24353 · Unknown · Online Leave Management System

Name of the Vulnerable Software and Affected Versions: Online Leave Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/employees/manage leave type.php" API endpoint. Recommendations: F...

PT-2022-24345 · Cuppacms · Cuppacms

Name of the Vulnerable Software and Affected Versions: Cuppa CMS version 1.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Add New Group function at the "/table manager/view/cu user groups" API endpoin...

PT-2022-25349 · Sysaid · Sysaid Help Desk

Name of the Vulnerable Software and Affected Versions: SysAid Help Desk versions prior to 22.1.65 Description: The issue allows for XSS via the Linked SRs field. Recommendations: For versions prior to 22.1.65, update to version 22.1.65 or later to resolve the issue. As a temporary workaround,...

PT-2022-24074 · Unknown · Simple Online Book Store System

Name of the Vulnerable Software and Affected Versions: Simple Online Book Store System version 1.0 Description: The issue concerns Cross Site Scripting XSS in the /admin book.php file, where the Title, Author, and Description parameters are vulnerable. This allows for potential malicious script...

PT-2022-17191 · Gophish · Gophish

Name of the Vulnerable Software and Affected Versions: gophish versions prior to 0.12.0 Description: The issue exists in the next query parameter, where the application uses url.Parser.FormValue"next" to extract the path and redirect the user to a relative URL. However, if the next parameter star...

PT-2022-6559 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2022 Description: The issue is related to a SQL injection vulnerability in the ZZCMS system, specifically in the admin/sendmailto.php component. This vulnerability arises from the lack of protection against SQL query structure...

CVE-2022-36109

CVE-2022-36109 concerns a bug in Moby/Docker Engine where supplementary groups are not set up correctly inside a container. An attacker with access to a container could manipulate supplementary group access to bypass primary group restrictions, potentially exposing sensitive information or enabli...

PT-2022-17824 · Baxter · Baxter Spectrum Wbm

Name of the Vulnerable Software and Affected Versions: Baxter Spectrum WBM versions v16 through v17 Baxter Spectrum WBM versions v20D29 through v20D32 Description: The issue allows for format string attacks via application messaging when in superuser mode, potentially enabling an attacker to read...

PT-2022-24480 · Unknown · Smartvista Cardgen

Name of the Vulnerable Software and Affected Versions: SmartVista Cardgen version 3.28.0 Description: A Path Traversal issue allows authenticated attackers to read arbitrary files in the system. Recommendations: For SmartVista Cardgen version 3.28.0, consider restricting access to sensitive files...

PT-2022-23651 · Unknown · Mtp Driver

Name of the Vulnerable Software and Affected Versions: MTP driver versions prior to SMR Sep-2022 Release 1 Description: The issue is related to a use after free vulnerability in the mtp send signal function of the MTP driver. This vulnerability allows attackers to perform malicious actions...