Access Restriction Bypass

asterisk:stretch is vulnerable to access restriction bypass. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result...

PT-2022-17942 · Mingsoft · Mingsoft Mcms

Name of the Vulnerable Software and Affected Versions: Mingsoft MCMS version 5.2.7 Description: A SQL injection issue was discovered in Mingsoft MCMS. The issue is related to the /cms/content/list API endpoint. Recommendations: For Mingsoft MCMS version 5.2.7, consider restricting access to the...

Schneider Electric SCADAPack Workbench isasln File Parsing XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Schneider Electric SCADAPack Workbench. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

PT-2022-11849 · Unknown · Rumble Mail Server

Name of the Vulnerable Software and Affected Versions: Rumble Mail Server version 0.51.3135 Description: A Cross Site Scripting XSS issue exists via the username parameter. Recommendations: For Rumble Mail Server version 0.51.3135, consider restricting access to the login functionality until a...

PT-2022-13714 · Libtiff +3 · Libtiff +3

Name of the Vulnerable Software and Affected Versions: LibTIFF version 4.3.0 Description: A problematic issue was found in the TIFF File Handler of tiff2ps. It allows for a denial of service when opening a malicious file. The attack can be launched remotely but requires user interaction...

PT-2022-2691

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.2 through 1.0.2zd OpenSSL versions 1.1.1 through 1.1.1n OpenSSL versions 3.0.0 through 3.0.2 Description The c rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is...

WordPress Advanced Custom Fields Plugin授权问题漏洞

WordPress is a set of Wordpress Foundation's blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Advanced Custom Fields Plugin is vulnerable...

CVE-2022-25915

Improper access control vulnerability in ELECOM LAN routers WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior,...

PT-2022-16268 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.7.0 through 3.10.6 Description: The issue is related to a lack of input validation, which could allow an XSS attack using com fields. Recommendations: For Joomla! versions 3.7.0 through 3.10.6, update to a version that...

PT-2022-18135 · Rsa · Archery

Name of the Vulnerable Software and Affected Versions: Archer versions 6.x through 6.9 SP2 P1 6.9.2.1 Description: The issue is related to improper access control on attachments, allowing a remote authenticated malicious user to potentially gain access to files that should only be allowed by extr...

PT-2022-13303 · WordPress · Database Peek

Name of the Vulnerable Software and Affected Versions: Database Peek WordPress plugin versions prior to 1.3 Description: The issue arises from the lack of proper sanitization and escaping of the match parameter, which is then outputted back in an admin page. This leads to a Reflected Cross-Site...

Sql injection

An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default...

PT-2022-11774 · Unknown · Dreamer Cms

Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.0.0 Description: An SQL Injection issue exists via the tableName parameter. Recommendations: For Dreamer CMS version 4.0.0, avoid using the tableName parameter until a fix is available. Consider restricting access to the...

PT-2022-17375 · Bluedon Information Security Technologies Co. · Internet Access Detector

Name of the Vulnerable Software and Affected Versions: Bluedon Information Security Technologies Co.,Ltd Internet Access Detector version 1.0 Description: The issue allows attackers to access the contents of the password file via unspecified vectors, resulting in an information leak...

PT-2022-4186 · Passwork · Passwork On-Premise Edition +1

Name of the Vulnerable Software and Affected Versions: Passwork On-Premise Edition versions prior to 4.6.13 Description: The issue is related to a CSRF vulnerability in the password manager Passwork. This vulnerability can be exploited by a remote attacker to perform a CSRF attack via the groups,...

PT-2022-17900 · Primekey · Primekey Signserver

Name of the Vulnerable Software and Affected Versions: PrimeKey SignServer versions prior to 5.8.1 Description: A cross-site scripting XSS issue was identified in the Admin Web interface. This issue can be exploited by using JavaScript code in a worker name before a Generate CSR request. It is...

Design/Logic Flaw

A permissions issue was addressed with improved validation. This issue is fixed in Security Update 2022-001 Catalina, macOS Monterey 12.2, macOS Big Sur 11.6.3. An application may be able to access restricted files...

PT-2022-2075

Name of the Vulnerable Software and Affected Versions Paramiko versions prior to 2.10.1 Description The issue is related to a race condition in the write private key file function, which could allow unauthorized information disclosure due to synchronization errors when using a shared resource. Th...

PT-2022-6932 · Mariadb +9 · Mariadb Server +9

Name of the Vulnerable Software and Affected Versions: MariaDB Server versions 10.6.3 and below Description: The issue is related to an use-after-free in the my mb wc latin1 component at /strings/ctype-latin1.c. This could potentially allow a remote attacker to cause a denial of service...

PT-2022-6936 · Mariadb +9 · Mariadb Server +9

Name of the Vulnerable Software and Affected Versions: MariaDB Server versions 10.9 and below Description: The issue is related to a segmentation fault in the sql/field conv.cc component of the MariaDB Server. This fault can be exploited by a remote attacker to cause a denial of service. The...