PT-2022-12906 · Antaris · Razorengine

Name of the Vulnerable Software and Affected Versions: Antaris RazorEngine versions through 4.5.1-alpha001 Description: An attacker can execute arbitrary .NET code in a sandboxed environment if users can externally control template contents. This issue affects products that are no longer supporte...

PT-2022-2920 · Google · Fuchsia

Name of the Vulnerable Software and Affected Versions: Fuchsia versions prior to 4.1.1 Description: The issue is related to information disclosure. An attacker can read the kernel log through exposed Zircon kernel addresses without the required capability ZX RSRC KIND ROOT. Recommendations: For...

PT-2022-16704 · Zoho · Zoho Manageengine Admanager Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Key Manager Plus versions prior to 6200 Description: An issue was discovered in the application where a service allows a user with the level Operator to access stored SSL certificates and associated key pairs during export...

PT-2022-10707 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.2 through 7.3.6 Liferay DXP 7.3 before fix pack 2 Description: A cross-site scripting XSS issue exists in the Blogs module's edit blog entry page, allowing remote attackers to inject arbitrary web script or HTML vi...

WordPress "Restrict – membership, site, content and user access restrictions for WordPress" plugin < 2.1.9 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "Restrict – membership, site, content and user access restrictions for WordPress" plugin versions 2.1.9. Solution Update the WordPress "Restrict – membership, site, content and user access restrictions...

WordPress Restrict User Access – Membership Plugin with Force plugin <= 2.2.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Restrict User Access – Membership Plugin with Force plugin versions = 2.2.1. Solution Update the WordPress Restrict User Access – Membership Plugin with Force plugin plugin to the latest available version at least 2.2.2...

WordPress Restrict User Access – Membership Plugin with Force plugin <= 2.2.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Restrict User Access – Membership Plugin with Force plugin versions = 2.2.1. Solution Update the WordPress Restrict User Access – Membership Plugin with Force plugin plugin to the latest available...

WordPress "Restrict – membership, site, content and user access restrictions for WordPress" plugin < 2.1.9 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress "Restrict – membership, site, content and user access restrictions for WordPress" plugin versions 2.1.9. Solution Update the WordPress "Restrict – membership, site, content and user access restrictions for WordPress" plugin to...

WordPress Restrict for Elementor plugin < 1.0.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Restrict for Elementor plugin versions 1.0.3. Solution Update the WordPress Restrict for Elementor plugin to the latest available version at least 1.0.3...

WordPress Restrict Posts based on Conditions – Conditional Post Restrictions plugin <= 1.1.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Restrict Posts based on Conditions – Conditional Post Restrictions plugin versions = 1.1.2. Solution Update the WordPress Restrict Posts based on Conditions – Conditional Post Restrictions plugin to the latest available versio...

WordPress Restrict for Elementor plugin < 1.0.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Restrict for Elementor plugin versions 1.0.3. Solution Update the WordPress Restrict for Elementor plugin to the latest available version at least 1.0.3...

File Descriptor Leak

Possible sensitive files Vulnerability description: A possible sensitive file has been found. This file is not directly linked from the website. This check looks for common sensitive resources like password files, configuration files, log files, include files, statistics data, database dumps. Eac...

PT-2022-17211

Name of the Vulnerable Software and Affected Versions ZEROF Web Server version 2.0 Description The issue allows for SQL Injection via the /HandleEvent endpoint. Recommendations For ZEROF Web Server version 2.0, consider restricting access to the /HandleEvent endpoint until a patch is available...

PT-2022-1643

Name of the Vulnerable Software and Affected Versions Redis versions prior to the fixed version Debian-specific Redis Server affected versions not specified Description A Lua sandbox escape vulnerability in Redis could result in remote code execution. The issue is related to a packaging problem a...

PT-2022-7464 · Apache +3 · Apache Tomcat +3

Name of the Vulnerable Software and Affected Versions: pgjdbc versions prior to 42.3.3 Description: The issue is related to the creation of arbitrary files through the loggerFile and loggerLevel connection properties in the pgjdbc driver. An attacker who controls the jdbc URL or properties can ca...

PT-2022-17113 · Jenkins · Jenkins Pipeline: Shared Groovy Libraries Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Shared Groovy Libraries Plugin versions 552.vd9cc05b8a2e1 and earlier Jenkins Pipeline: Shared Groovy Libraries Plugin version 2.18.1 Jenkins Pipeline: Shared Groovy Libraries Plugin version 2.21.1 Description: The issue...

PT-2022-2375 · Nginx · Nginx Njs

Name of the Vulnerable Software and Affected Versions: nginx njs version 0.7.2 Description: The issue is related to a Buffer Overflow in the Array.prototype.concat function of the njs interpreter in the nginx server. This occurs when a slow array appended element is a fast array, leading to a typ...

PT-2022-17145 · Jenkins · Jenkins Dbcharts Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins dbCharts Plugin versions 0.5.2 and earlier Description: A missing check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified database via JDBC using attacker-specified credentials...

PT-2022-1945

Name of the Vulnerable Software and Affected Versions TP-LINK TL-WR840NES version V6.20 180709 Description The issue is related to a remote code execution vulnerability via the function oal wan6 setIpAddr. This vulnerability is associated with the lack of neutralization of special elements when...

PT-2022-7271 · Libde265 +3 · Libde265 +3

Name of the Vulnerable Software and Affected Versions: Libde265 version 1.0.8 Description: The issue is related to a heap-buffer-overflow vulnerability in the put qpel 0 0 fallback 16 function, located in fallback-motion.cc, which is part of the Libde265 video codec implementation. This...