PT-2022-10462 · Unknown · Hospital Management System

Name of the Vulnerable Software and Affected Versions: Hospital Management System version 4.0 Description: The issue concerns a Cross Site Scripting XSS vulnerability. It can be exploited via the /hospital/hms/admin/patient-search.php API endpoint. Recommendations: For Hospital Management System...

PT-2022-25641 · Unknown · Diaenergie

Name of the Vulnerable Software and Affected Versions: DIAEnergie versions prior to v1.9.01.002 Description: The issue concerns a stored cross-site scripting vulnerability. This vulnerability can be exploited through the "PostEnergyType API" endpoint. Recommendations: For versions prior to...

PT-2022-19642 · Abode Systems · Iota All-In-One Security Kit

Name of the Vulnerable Software and Affected Versions: Abode Systems, Inc. iota All-In-One Security Kit versions 6.9X and 6.9Z Description: An authentication bypass issue exists in the web interface, specifically in the /action/factory functionality. This can be triggered by a specially-crafted...

PT-2022-11614 · Stmicroelectronics +2 · Stm32 Mw Usb Host +2

Name of the Vulnerable Software and Affected Versions: stm32 mw usb host versions prior to 3.5.1 Description: A buffer overflow issue allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH MAX NUM ENDPOINTS. This typically occurs when using a RTOS such ...

PT-2022-24829 · Tuleap +1 · Tuleap +1

Name of the Vulnerable Software and Affected Versions: Tuleap versions 12.9.99.228 through 14.0.99.23 Description: The issue concerns improper verification of authorizations when updating the branch prefix used by the GitLab repository integration. Authenticated users can change the branch prefix...

PT-2022-25542 · Ocomon · Ocomon

Name of the Vulnerable Software and Affected Versions: OcoMon version 4.0RC1 Description: The issue is related to Incorrect Access Control. Through a request, a user can obtain the real email, and by sending the same request with the correct email, it is possible to perform an account takeover...

PT-2022-26290 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version 15.03.06.23 Description: The issue is related to a stack overflow vulnerability. This vulnerability can be exploited via the "/goform/formSetClientState" API endpoint. Recommendations: For Tenda AC10 version 15.03.06.23, as...

PT-2022-25592 · Tenda · Tenda W20E

Name of the Vulnerable Software and Affected Versions: Tenda W20E router version 15.11.0.6 Description: The issue is a stack overflow vulnerability in the formIPMacBindDel function, which is triggered by the request "/goform/delIpMacBind/". This vulnerability can be exploited, potentially allowin...

PT-2022-22542 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC commit 617837b Description: A heap buffer overflow issue was discovered in OTFCC via the /release-x64/otfccdump+0x6e412a endpoint. This issue can be exploited, but no details are provided about the estimated number of potentially affect...

PT-2022-24340 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinal CMS version 5.1.0 Description: The issue is related to SQL Injection, which can be exploited via the /system/menu/list API endpoint. This allows for potential unauthorized access to sensitive data. Recommendations: For JFinal CMS versi...

PT-2022-23606 · Unknown · Expense Management System

Name of the Vulnerable Software and Affected Versions: Expense Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the id parameter at the "/Home/debit credit p" API endpoint. Recommendations: For Expense Management System...

PT-2022-23572 · Unknown · Library Management System

Name of the Vulnerable Software and Affected Versions: Library Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/staff/edit book details.php" API endpoint. Recommendations: For Librar...

PT-2022-23465 · Seiko · Seiko Skybridge Mb-A100/A110

Name of the Vulnerable Software and Affected Versions: Seiko SkyBridge MB-A100/A110 versions 4.2.0 and below Description: A command injection issue was discovered via the ipAddress parameter at the "/07system08execute ping 01" endpoint. This allows for potential command injection attacks...

PT-2022-23584 · Unknown · Library Management System

Name of the Vulnerable Software and Affected Versions: Library Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the title parameter at the "/librarian/history.php" API endpoint. Recommendations: For Library...

PT-2022-24264 · Esri · Esri Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS versions prior to 10.9.0 Description: The issue allows an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs because the "sharing/rest/content/features/analyze" endpoint is always accessibl...

PT-2022-6404 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.3-p2 and earlier Adobe Commerce versions 2.3.7-p3 and earlier Adobe Commerce versions 2.4.4 and earlier Description: The issue is related to insufficient input validation, allowing a remote attacker to potentially...

PT-2022-18262 · Apache · Apache Jspwiki

Name of the Vulnerable Software and Affected Versions: Apache JSPWiki versions up to and including 2.11.2 Description: A carefully crafted request on the "XHRHtml2Markup.jsp" endpoint could trigger an issue, allowing an attacker to execute javascript in the victim's browser and potentially obtain...

PT-2022-22473 · Unknown · Fruits Bazar

Name of the Vulnerable Software and Affected Versions: Fruits Bazar version 1.0 Description: A SQL injection issue was found in Fruits Bazar via the recover email parameter at the "user password recover.php" endpoint. Recommendations: For Fruits Bazar version 1.0, as a temporary workaround,...

PT-2022-21200

Name of the Vulnerable Software and Affected Versions Grafana version 8.4.3 Description The issue allows unauthenticated access via a "/dashboard/snapshot/?orgId=0" URI. The vendor considers this a UI bug, not a vulnerability. Recommendations For Grafana version 8.4.3, consider restricting access...

PT-2022-2827 · Grafana · Grafana

Name of the Vulnerable Software and Affected Versions: Grafana version 8.4.3 Description: The issue in Grafana is related to the possibility of bypassing the authentication procedure. Exploitation of this issue may allow a remote attacker to elevate their privileges by sending a specially crafted...