PT-2022-18132 · Percona · Percona Xtrabackup

Name of the Vulnerable Software and Affected Versions: Percona XtraBackup version 2.4.20 Description: The issue allows sensitive information, such as command line arguments, to be written to backup files and the PERCONA SCHEMA.xtrabackup history table when the --history option is used. This may...

PT-2022-16556

Name of the Vulnerable Software and Affected Versions ACEweb Online Portal version 3.5.065 Description The ACEweb Online Portal contains an issue that allows for unrestricted file upload via the attachments.awp endpoint. Recommendations For ACEweb Online Portal version 3.5.065, consider restricti...

PT-2022-23718 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche version 6.3.2.3490 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be...

PT-2022-13513

Name of the Vulnerable Software and Affected Versions DivvyDrive versions prior to 4.6.2.0 Description The issue is related to improper neutralization of input during web page generation, also known as cross-site scripting. This allows for stored XSS attacks. A stored cross-site scripting...

PT-2022-6271

Name of the Vulnerable Software and Affected Versions EMCO Software products, including MSI Package Builder for Windows version 9.1.4 Remote Installer for Windows version 6.0.13 Ping Monitor for Windows version 8.0.18 Remote Shutdown for Windows version 7.2.2 WakeOnLan version 2.0.8 Network...

CVE-2022-29215 Argument Injection in RegionProtect

RegionProtect is a plugin that allows users to manage certain events in certain regions of the world. Versions prior to 1.1.0 contain a YAML injection vulnerability that can cause an instant server crash if the passed arguments are not matched. Version 1.1.0 contains a patch for this issue. As a...

PT-2022-19345

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions prior to 6202 Description The issue allows attackers to perform username enumeration via a crafted POST request to "/ServletAPI/accounts/login". This enables attackers to identify valid usernames,...

PT-2022-19421

Name of the Vulnerable Software and Affected Versions Nextcloud Android versions prior to 3.19.0 Description The issue concerns the existence of sensitive tokens, images, and user-related details after the deletion of a user account in Nextcloud Android. This could lead to the misuse of the forme...

Typo3 Backend History Module Vulnerable to XSS

The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, which allows remote authenticated editors to read the history of arbitrary records via a crafted URL...

GHSA-2HP4-8H6H-93RR Typo3 Backend History Module Vulnerable to XSS

The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, which allows remote authenticated editors to read the history of arbitrary records via a crafted URL...

PT-2022-20427 · Jenkins · Jenkins Autocomplete Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Autocomplete Parameter Plugin versions 1.1 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the plugin references certain parameter names in an unsafe manner from...

PT-2022-19967 · Hms · Hms

Name of the Vulnerable Software and Affected Versions: HMS version 1.0 Description: The issue is related to a SQL injection vulnerability. When requesting "appointment.php" through POST, multiple parameters can lead to this vulnerability. Recommendations: For HMS version 1.0, as a temporary...

PT-2022-14072 · Drawio · Drawio

Name of the Vulnerable Software and Affected Versions: drawio versions prior to 18.0.5 Description: The issue allows for path traversal in the WellKnownServlet, enabling the reading of local files of the web application. This can potentially lead to sensitive information disclosure...

PT-2022-14071 · Trudesk · Trudesk

Name of the Vulnerable Software and Affected Versions: trudesk versions prior to 1.2.2 Description: The issue is related to a Reflected XSS in the ticket filter function, which can execute malicious javascript code in a web page. Recommendations: For versions prior to 1.2.2, update to version 1.2...

PT-2022-3245 · Ntfs-3G +6 · Ntfs-3G +6

Name of the Vulnerable Software and Affected Versions: NTFS-3G versions through 2021.8.22 Description: The issue is related to a buffer overflow vulnerability in the NTFS file system descriptor for the FUSE NTFS-3G module, allowing arbitrary memory read and write operations. This can be exploited...

PT-2022-3660

Name of the Vulnerable Software and Affected Versions formidable version 3.1.4 formidable version 3.2.4 Description An arbitrary file upload vulnerability in formidable allows attackers to execute arbitrary code via a crafted filename. Some third parties dispute this issue because the product has...

PT-2022-3032 · Ntfs-3G +9 · Ntfs-3G +9

Name of the Vulnerable Software and Affected Versions: NTFS-3G versions through 2021.8.22 Description: The issue is related to a heap-based buffer overflow in the ntfs names full collate function of the NTFS-3G module for the NTFS file system. This can be exploited by using a specially crafted NT...

PT-2022-6999 · Unknown +1 · Spring Framework +1

Name of the Vulnerable Software and Affected Versions: Spring Framework versions prior to 5.3.20 Spring Framework versions prior to 5.2.22 Spring Framework old unsupported versions Description: The application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an...

PT-2022-19362 · Unknown · Bus Pass Management System

Name of the Vulnerable Software and Affected Versions: Bus Pass Management System version 1.0 Description: An insecure direct object reference IDOR vulnerability in the viewid parameter allows attackers to access sensitive information. Recommendations: For Bus Pass Management System version 1.0,...

PT-2022-10526 · Mikrotik · Routeros +1

Name of the Vulnerable Software and Affected Versions: Mikrotik RouterOs versions prior to 6.48.2 Description: The issue is a memory corruption vulnerability in the ptp process. An authenticated remote attacker can cause a Denial of Service NULL pointer dereference. Recommendations: For versions...