PT-2022-7856 · Unknown · Kippo-Graph

Name of the Vulnerable Software and Affected Versions: kippo-graph versions prior to 1.5.1 Description: The issue is related to a cross-site scripting vulnerability in the $file link variable within the class/KippoInput.class.php file. Recommendations: For versions prior to 1.5.1, update to versi...

PT-2022-4016 · Jenkins · Jenkins Coverity Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Coverity Plugin versions 1.11.4 and earlier Description: A missing permission check in the Jenkins Coverity Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. This issue...

PT-2022-21929 · WordPress · Bxslider Wp

Name of the Vulnerable Software and Affected Versions: BxSlider WP plugin versions = 2.0.0 Description: The issue is an Authenticated Cross-Site Scripting XSS vulnerability. It affects users with contributor or higher roles. There is no information provided about the estimated number of potential...

PT-2022-4033 · Jenkins · Jenkins Compuware Xpediter Code Coverage Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Compuware Xpediter Code Coverage Plugin versions 1.0.7 and earlier Description: The issue is related to a missing permission check in the plugin, which can be exploited by attackers with Overall/Read permission to enumerate hosts and...

PT-2022-12936 · Unknown · Goanywhere Mft

Name of the Vulnerable Software and Affected Versions: GoAnywhere MFT versions prior to 6.8.3 Description: A path traversal issue exists that could allow an external user who self-registers with specific username and/or profile information to access files at a higher directory level than intended...

PT-2022-4012 · Jenkins · Jenkins Openstack Heat Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Openstack Heat Plugin versions 1.5 and earlier Description: The issue is related to insufficient authorization procedures in the Jenkins Openstack Heat Plugin, allowing a remote attacker to perform URL redirection. A missing permissio...

PT-2022-4024 · Jenkins · Jenkins Coverity Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Coverity Plugin versions 1.11.4 and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturing credentials stor...

PT-2022-22210 · Wavlink · Wavlink Wifi-Repeater Rpta2-77W

Name of the Vulnerable Software and Affected Versions: Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 Description: An access control issue allows attackers to obtain system key information and execute arbitrary commands by accessing the page "syslog.shtml". Recommendations: For Wavlink...

PT-2022-3952 · Unknown · Ossn Open Source Social Network

Name of the Vulnerable Software and Affected Versions: Open Source Social Network version 6.3 LTS Description: The issue is related to an arbitrary file upload vulnerability in the /ossn/administrator/com installer component. This vulnerability allows attackers to execute arbitrary code via a...

PT-2022-8903 · Js-Ini · Js-Ini

Name of the Vulnerable Software and Affected Versions: js-ini versions prior to 1.3.0 Description: The issue arises when an attacker submits a malicious INI file to an application that uses the parse function to parse it. This can lead to prototype pollution on the application, which can be furth...

PT-2022-5004 · Hitachi Energy · Hitachi Energy Msm

Name of the Vulnerable Software and Affected Versions: Hitachi Energy MSM versions V2.2 and prior Description: A vulnerability exists in the HTTP web interface where it does not validate data in an HTTP header, leading to a possible HTTP response splitting. This could allow an attacker to channel...

PT-2022-22011 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: Dataease version 1.11.1 Description: An issue in the component "/api/plugin/upload" of Dataease allows attackers to execute arbitrary code via a crafted plugin. Recommendations: For Dataease version 1.11.1, update to version 1.11.2 to resolve...

PT-2022-22013 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase version 1.11.1 Description: The issue is related to a SQL injection vulnerability. It occurs via the parameter dataSourceId. There is no information about the estimated number of potentially affected devices worldwide or real-world...

PT-2022-5232

Name of the Vulnerable Software and Affected Versions SQLite versions 1.0.12 through 3.39.x before 3.39.2 Description The issue is related to an array-bounds overflow in the SQLite API library, which can be triggered by a remote attacker using a long sequence of string data processed by the print...

PT-2022-19152

Name of the Vulnerable Software and Affected Versions YIKES Inc. Custom Product Tabs for WooCommerce plugin version 1.7.7 and earlier Description The issue is related to a Broken Access Control vulnerability, which allows for the update of the yikes-the-content-toggle option. This vulnerability...

PT-2022-21523 · Apple · Apple Macos +1

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 11.6.8 macOS versions prior to 12.5 Description: An out-of-bounds read issue was addressed with improved input validation. Processing a maliciously crafted AppleScript binary may result in unexpected termination or...

PT-2022-3739 · Oracle · Mysql Cluster

Name of the Vulnerable Software and Affected Versions: MySQL Cluster versions 8.0.29 and prior Description: The issue is related to insufficient input validation in the MySQL Cluster product, which can be exploited by a remote attacker to cause a denial of service. This can result in the ability ...

PT-2022-22197 · Digital Watchdog · Dw Megapix Ip Cameras

Name of the Vulnerable Software and Affected Versions: Digital Watchdog DW MEGApix IP cameras version A7.2.2 20211029 Description: A command injection issue was found in the /admin/vca/bia/addacph.cgi component. This issue can be exploited through a crafted POST request. Recommendations: For...

PT-2022-16353 · Puppet · Puppet Bolt

Name of the Vulnerable Software and Affected Versions: Puppet Bolt versions prior to 3.24.0 Description: The issue allows sensitive parameters to be printed when planning a run, potentially resulting in them being logged when executed programmatically, such as through Puppet Enterprise...

PT-2022-18401 · Shanghai Feixun Data Communication Technology Co. · Fir302B

Name of the Vulnerable Software and Affected Versions: Shanghai Feixun Data Communication Technology Co., Ltd router fir302b version A2 Description: The issue is related to a remote command execution vulnerability via the Ping function. This allows for potential unauthorized access and control...