PT-2022-10902 · Philips · Philips Vue Myvue Pacs

Name of the Vulnerable Software and Affected Versions: Philips Vue MyVue PACS versions prior to 12.2.x.x Description: The issue allows authenticated users to perform Path Traversal, accessing files stored outside of the web root through the VideoStream function. Recommendations: For Philips Vue...

Vulnerability fixed in Exact Synergy

A vulnerability has been fixed in Exact Synergy Enterprise. The vulnerability allows a malicious party to use Cross-Site Scripting XSS to execute arbitrary code under the rights of the user. A malicious party needs to be authenticated to be able to see within the application a profile picture, in...

CVE-2022-45338

An arbitrary file upload vulnerability in the profile picture upload function of Exact Synergy Enterprise 267 before 267SP13 and Exact Synergy Enterprise 500 before 500SP6 allows attackers to execute arbitrary code via a crafted SVG file...

Design/Logic Flaw

An arbitrary file upload vulnerability in the profile picture upload function of Exact Synergy Enterprise 267 before 267SP13 and Exact Synergy Enterprise 500 before 500SP6 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2022-45338

The CVE-2022-45338 issue affects Exact Synergy Enterprise 267 (pre-267SP13) and 500 (pre-500SP6). It is an arbitrary file upload vulnerability in the profile picture upload function that permits executing arbitrary code via a crafted SVG file. Affected component: profile picture upload handler; r...

CVE-2022-45338: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the profile picture upload function of Exact Synergy Enterprise 267 before 267SP13 and Exact Synergy Enterprise 500 before 500SP6 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2022-45338

An arbitrary file upload vulnerability in the profile picture upload function of Exact Synergy Enterprise 267 before 267SP13 and Exact Synergy Enterprise 500 before 500SP6 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2022-24188

The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices. The deviceVideoCallPassword and mqttPassword are returned in clear-text. The lack of sessions management and presence of insecure direct...

CVE-2022-24188: Cleartext Storage of Sensitive Information

The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices. The deviceVideoCallPassword and mqttPassword are returned in clear-text. The lack of sessions management and presence of insecure direct...

CVE-2022-24188

The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices. The deviceVideoCallPassword and mqttPassword are returned in clear-text. The lack of sessions management and presence of insecure direct...

CVE-2022-4111 Improper Validation of Specified Quantity in Input in tooljet/tooljet

Unrestricted file size limit can lead to DoS in tooljet/tooljet 1.27 by allowing a logged in attacker to upload profile pictures over 2MB...

CVE-2022-4111 Improper Validation of Specified Quantity in Input in tooljet/tooljet

Unrestricted file size limit can lead to DoS in tooljet/tooljet 1.27 by allowing a logged in attacker to upload profile pictures over 2MB...

CVE-2022-40471

Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.php...

CVE-2022-40471

Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.php...

CVE-2022-40471

Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.php...

PT-2022-25396

Name of the Vulnerable Software and Affected Versions Clinic's Patient Management System version 1.0 Description The issue allows an attacker to upload an arbitrary PHP webshell via the profile picture upload functionality in users.php. This enables remote code execution. Recommendations For...

CVE-2022-40471

Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.php...

CVE-2022-40471: Unrestricted Upload of File with Dangerous Type

Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.php...

Clinic’s Patient Management System 代码问题漏洞

Clinic's Patient Management System is a patient management system for Carlo Montero's clinic. A security vulnerability exists in Clinic's Patient Management System v 1.0 that could allow an attacker to upload an arbitrary php webshell via the profile picture upload function in users.php...

CVE-2022-39977

Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the User module. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file uploaded through the picture upload point...