PT-2022-1938 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.27 and prior Description: The issue is related to insufficient input validation in the Server: Optimizer component of the MySQL Server product. It allows a low-privileged attacker with network access via multiple...

PT-2022-12020

Name of the Vulnerable Software and Affected Versions Ericsson CodeChecker versions prior to 6.18.2 Description A Stored Cross-site scripting XSS vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of...

PT-2022-1880 · Edgerover · Edgerover

Name of the Vulnerable Software and Affected Versions: EdgeRover versions prior to 1.5.1-594 Description: The issue is related to insufficient permission assignment checks for a critical resource in the EdgeRover application, which can be exploited by a remote attacker to elevate privileges or...

PT-2022-15858 · Jenkins · Jenkins Batch Task Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins batch task Plugin versions 1.19 and earlier Description: The issue allows attackers with Overall/Read access to perform certain actions due to cross-site request forgery CSRF vulnerabilities. These actions include retrieving logs,...

PT-2022-15861 · Jenkins · Jenkins Debian Package Builder Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Debian Package Builder Plugin versions 1.6.11 and earlier Description: The issue allows agents to invoke command-line git at an attacker-specified path on the controller. This enables attackers who can control agent processes to invok...

PT-2022-12304 · Cobbler +2 · Cobbler +2

Name of the Vulnerable Software and Affected Versions: Cobbler versions prior to 3.3.1 Description: An issue was discovered where files in /etc/cobbler are world readable, exposing sensitive information to local users with non-privileged access. The users.digest file contains the sha2-512 digest ...

PT-2022-11969 · Apache +1 · Apache Guacamole +1

Name of the Vulnerable Software and Affected Versions: Apache Guacamole versions 1.2.0 through 1.3.0 Description: The issue concerns the improper validation of responses from a SAML identity provider. If SAML support is enabled, a malicious user may assume the identity of another Guacamole user...

PT-2022-15022 · Unknown · Puddingbot

Name of the Vulnerable Software and Affected Versions: PuddingBot versions 0.0.6-b933652 and prior Description: PuddingBot is a group management bot. In the affected versions, the bot token is publicly exposed in main.py, making it accessible to malicious actors. The bot token has been revoked an...

PT-2022-15544 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 15.2.1 iPadOS versions prior to 15.2.1 Description: A resource exhaustion issue was addressed with improved input validation. Processing a maliciously crafted HomeKit accessory name may cause a denial of service. The iss...

PT-2022-2181 · Pjsip +1 · Pjsip +1

Name of the Vulnerable Software and Affected Versions: PJSIP versions up to and including 2.11.1 Description: The issue is related to synchronization errors when using shared resources in the PJSIP library. When an error or failure occurs in various parts of PJSIP, the function returns without...

PT-2023-1653 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.17 Description: The issue is related to an error path in the dwc3 qcom acpi register core function in the Linux kernel, specifically in the drivers/usb/dwc3/dwc3-qcom.c file. This error path lacks certain...

PT-2021-24296 · Unknown · Metersphere

Name of the Vulnerable Software and Affected Versions: Metersphere version 1.15.4 Description: Time-based SQL Injection vulnerabilities were found via the orders parameter. Recommendations: For Metersphere version 1.15.4, avoid using the orders parameter until a fix is available. Consider...

PT-2021-14830 · Garrett Metal Detectors · Ic Module Cma

Name of the Vulnerable Software and Affected Versions: iC Module CMA version 5.0 Description: A directory traversal vulnerability exists in the CMA CLI setenv command of Garrett Metal Detectors’ iC Module CMA. An attacker can provide malicious input to trigger this vulnerability. Recommendations:...

PT-2022-11995 · Spip +2 · Spip +2

Name of the Vulnerable Software and Affected Versions: SPIP version 4.0.0 Description: The issue concerns a Cross Site Scripting XSS vulnerability in the ecrire/public/interfaces.php file, specifically affecting the "Who are you" and "Website Name" fields. An editor can modify their personal...

PT-2021-13405 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-12 Description: In the PVInitVideoEncoder function of mp4enc api.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution...

PT-2021-22829 · Unknown · Securitashome

Name of the Vulnerable Software and Affected Versions: SecuritasHome home alarm system version HPGW-G 0.0.2.23F BG U-ITR-F1-BD BL.A30.20181117 Description: The issue concerns the absence of notifications for ongoing RF jamming attacks in the system. This allows an attacker to block legitimate...

PT-2021-7803 · Siemens · Syngo Fastview

Name of the Vulnerable Software and Affected Versions: syngo fastView All versions Description: A vulnerability has been identified in the affected application, which lacks proper validation of user-supplied data when parsing BMP files. This could result in a write-what-where condition, allowing ...

CVE-2021-39941

An information disclosure vulnerability in GitLab CE/EE versions 12.0 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed non-project members to see the default branch name for projects that restrict access to the repository to project members...

PT-2021-23729 · Kaseya · Kaseya Unitrends Backup Appliance

Name of the Vulnerable Software and Affected Versions: Kaseya Unitrends Backup Appliance versions prior to 10.5.5 Description: An issue was discovered where the privileged vaultServer could be leveraged to create arbitrary writable files, leading to privilege escalation. Recommendations: For...

Vulnerability fixed in Zoho ManageEngine Desktop Central

Zoho has fixed a vulnerability in ManageEngine Desktop Central. Desktop Central is a solution used by administrators to remotely manage devices within an organization. manage. The vulnerability makes it possible for a malicious person to bypass authentication and execute arbitrary code. It is goo...