PT-2022-18993 · Verbatim · Verbatim Store 'N' Go Secure Portable Hdd +1

Name of the Vulnerable Software and Affected Versions: Verbatim Keypad Secure USB 3.2 Gen 1 Drive versions through 2022-03-31 Verbatim Store 'n' Go Secure Portable HDD GD25LK01-3637-C VER4.0 Description: An issue was discovered in certain Verbatim drives due to an insecure design, allowing an...

PT-2022-11729 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1200T version 4.1.2cu.5215 Description: The issue concerns a remote command injection vulnerability. It is located in the setDeviceMac function of the global.so file, allowing control over the deviceName to launch an attack...

PT-2022-11738 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1200T version 4.1.2cu.5215 Description: The issue allows an attacker to obtain sensitive information, such as wifikey, without authorization through the getSysStatusCfg function. Recommendations: For TOTOLINK EX1200T version...

PT-2022-18132 · Percona · Percona Xtrabackup

Name of the Vulnerable Software and Affected Versions: Percona XtraBackup version 2.4.20 Description: The issue allows sensitive information, such as command line arguments, to be written to backup files and the PERCONA SCHEMA.xtrabackup history table when the --history option is used. This may...

PT-2022-23718 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche version 6.3.2.3490 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be...

PT-2022-19421

Name of the Vulnerable Software and Affected Versions Nextcloud Android versions prior to 3.19.0 Description The issue concerns the existence of sensitive tokens, images, and user-related details after the deletion of a user account in Nextcloud Android. This could lead to the misuse of the forme...

PT-2022-19345

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions prior to 6202 Description The issue allows attackers to perform username enumeration via a crafted POST request to "/ServletAPI/accounts/login". This enables attackers to identify valid usernames,...

GHSA-2HP4-8H6H-93RR Typo3 Backend History Module Vulnerable to XSS

The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, which allows remote authenticated editors to read the history of arbitrary records via a crafted URL...

PT-2022-20427 · Jenkins · Jenkins Autocomplete Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Autocomplete Parameter Plugin versions 1.1 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the plugin references certain parameter names in an unsafe manner from...

PT-2022-3660 · Unknown +1 · Formidable +1

Name of the Vulnerable Software and Affected Versions: formidable version 3.1.4 formidable version 3.2.4 Description: An arbitrary file upload vulnerability in formidable allows attackers to execute arbitrary code via a crafted filename. Some third parties dispute this issue because the product h...

PT-2022-19967 · Hms · Hms

Name of the Vulnerable Software and Affected Versions: HMS version 1.0 Description: The issue is related to a SQL injection vulnerability. When requesting "appointment.php" through POST, multiple parameters can lead to this vulnerability. Recommendations: For HMS version 1.0, as a temporary...

PT-2022-14072 · Drawio · Drawio

Name of the Vulnerable Software and Affected Versions: drawio versions prior to 18.0.5 Description: The issue allows for path traversal in the WellKnownServlet, enabling the reading of local files of the web application. This can potentially lead to sensitive information disclosure...

PT-2022-14071 · Trudesk · Trudesk

Name of the Vulnerable Software and Affected Versions: trudesk versions prior to 1.2.2 Description: The issue is related to a Reflected XSS in the ticket filter function, which can execute malicious javascript code in a web page. Recommendations: For versions prior to 1.2.2, update to version 1.2...

PT-2022-6999 · Unknown +1 · Spring Framework +1

Name of the Vulnerable Software and Affected Versions: Spring Framework versions prior to 5.3.20 Spring Framework versions prior to 5.2.22 Spring Framework old unsupported versions Description: The application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an...

PT-2022-10526 · Mikrotik · Routeros +1

Name of the Vulnerable Software and Affected Versions: Mikrotik RouterOs versions prior to 6.48.2 Description: The issue is a memory corruption vulnerability in the ptp process. An authenticated remote attacker can cause a Denial of Service NULL pointer dereference. Recommendations: For versions...

PT-2022-19362 · Unknown · Bus Pass Management System

Name of the Vulnerable Software and Affected Versions: Bus Pass Management System version 1.0 Description: An insecure direct object reference IDOR vulnerability in the viewid parameter allows attackers to access sensitive information. Recommendations: For Bus Pass Management System version 1.0,...

PT-2022-19301 · Totolink · Totolink N600R

Name of the Vulnerable Software and Affected Versions: TOTOLink N600R version V5.3c.7159 B20190425 Description: A command injection issue was discovered via the langtype parameter in the "/setting/setLanguageCfg" API endpoint. This allows for potential command execution. No information is provide...

PT-2022-19308 · Totolink · Totolink N600R

Name of the Vulnerable Software and Affected Versions: TOTOLink N600R version V5.3c.7159 B20190425 Description: A command injection issue was found via the filename parameter in the "/setting/setUploadSetting" API endpoint. This allows for potential command execution. No information is provided...

PT-2022-2560

Name of the Vulnerable Software and Affected Versions UnRAR versions prior to 6.12 Description The issue allows directory traversal to write to files during an extract operation, as demonstrated by creating a /.ssh/authorized keys file. This can be exploited by remote attackers to execute arbitra...

PT-2022-19089 · Totolink · Totolink A7100Ru

Name of the Vulnerable Software and Affected Versions: TOTOlink A7100RU version 7.4cu.2313 b20191024 Description: A command injection issue is found in the setWiFiSignalCfg interface of the TOTOlink A7100RU router, allowing an attacker to execute arbitrary commands through a carefully constructed...