PT-2022-3642 · Swhkd · Swhkd

Name of the Vulnerable Software and Affected Versions: SWHKD version 1.1.5 Description: The issue is related to unsafe parsing via the -c option, which can lead to an information leak or a denial of service memory exhaustion when attempting to parse large or infinite files, such as block or...

PT-2022-6760 · Adobe · Acrobat Reader

Name of the Vulnerable Software and Affected Versions: Acrobat Reader DC versions 17.012.30205 through 22.001.20085 Acrobat Reader DC versions 20.005.3031x and earlier Description: A use-after-free vulnerability in Adobe Acrobat and Reader could result in arbitrary code execution in the context o...

PT-2022-17024 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions prior to 7055 Description: The issue allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response. Recommendations: For versions...

PT-2022-13461 · WordPress · Amelia

Name of the Vulnerable Software and Affected Versions: Amelia WordPress plugin versions prior to 1.0.48 Description: The issue allows any customer to send paid test SMS notifications and retrieve sensitive information about the admin, such as email, account balance, and payment history. A malicio...

PT-2022-13540 · Unknown · Calibre-Web

Name of the Vulnerable Software and Affected Versions: calibre-web versions prior to 0.6.18 Description: The issue is related to Server-Side Request Forgery SSRF in the GitHub repository janeczku/calibre-web. SSRF is a type of attack where an attacker can trick a server into making requests to...

PT-2022-17976

Name of the Vulnerable Software and Affected Versions Online Banking System Protect version 1.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities are accessible via parameters on the user profile, system info, and accounts management pages...

PT-2022-17978

Name of the Vulnerable Software and Affected Versions Online Banking System Protect version 1.0 Description The issue is related to a local file inclusion LFI vulnerability. This vulnerability can be exploited via the pages parameter. Recommendations For Online Banking System Protect version 1.0,...

PT-2022-12498

Name of the Vulnerable Software and Affected Versions Totolink A3100R version 5.9c.4577 Description The issue concerns an unauthenticated API-like function in the "test.asp" file. This function allows an attacker to configure multiple settings without proper authentication. Recommendations For...

PT-2022-12705 · Emq · Emq X Dashboard

Name of the Vulnerable Software and Affected Versions: EMQ X Dashboard version 3.0.0 Description: The issue concerns username enumeration in the "/api/v3/auth" interface. When a user logs in, the application returns different results depending on whether the account is correct, allowing an attack...

PT-2022-2561

Name of the Vulnerable Software and Affected Versions D-Link DIR-820L version 1.05B03 Description The issue is related to a remote command execution vulnerability. It can be exploited via HTTP POST to get set ccp, allowing a remote attacker to execute arbitrary commands through the Device Name...

PT-2022-17371 · Motioneye · Motioneye

Name of the Vulnerable Software and Affected Versions: MotionEye versions 0.42.1 and below Description: The issue allows attackers to access sensitive information via a GET request to "/config/list". To exploit this, a regular user password must be unconfigured. Recommendations: For MotionEye...

PT-2022-16871

Name of the Vulnerable Software and Affected Versions Flask-AppBuilder versions prior to 3.4.5 Description Flask-AppBuilder contains an open redirect vulnerability when using the database authentication login page. This issue is fixed in version 3.4.5. There are currently no known workarounds...

PT-2022-13554 · Pimcore · Pimcore/Data-Hub

Name of the Vulnerable Software and Affected Versions: pimcore/data-hub versions prior to 1.2.4 Description: The issue is related to stored Cross-site Scripting XSS in the pimcore/data-hub GitHub repository. This type of attack occurs when an application stores user input data without proper...

PT-2022-17762 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: EyouCMS version 1.5.5 Description: The issue is related to a lack of access control in the component /data/sqldata. Recommendations: For EyouCMS version 1.5.5, consider restricting access to the /data/sqldata component until a patch is...

CLSA-2022-1648069165 Fix of CVE: CVE-2022-23307, CVE-2021-4104, CVE-2022-23305, CVE-2022-23302

CVE-2022-23302: remove JMSSink component entrirely - CVE-2022-23305: ensure security of JDBCAppender adding additional check-ups - CVE-2022-23307: restrict chainsaw access list to classes from SYSTEMALLOWEDCLASSES group - CVE-2021-4104: disable JMSAppender by default and add option to manually...

CLSA-2022-1648067792 Fix of CVE: CVE-2021-4104, CVE-2022-23305, CVE-2022-23302, CVE-2022-23307

CVE-2022-23302: remove JMSSink component entrirely - CVE-2022-23305: ensure security of JDBCAppender adding additional check-ups - CVE-2022-23307: restrict chainsaw access list to classes from SYSTEMALLOWEDCLASSES group - CVE-2021-4104: disable JMSAppender by default and add option to manually...

PT-2022-18210 · Tenda · Tenda M3

Name of the Vulnerable Software and Affected Versions: Tenda M3 version 1.10 V1.0.0.124856 Description: A command injection issue was found in the component "/goform/SetLanInfo" of the affected software. Recommendations: For version 1.10 V1.0.0.124856, consider restricting access to the...

PT-2022-18204 · Tenda · Tenda M3

Name of the Vulnerable Software and Affected Versions: Tenda M3 version 1.10 V1.0.0.124856 Description: A command injection issue was found in the component "/goform/delAd" of the affected software. Recommendations: For version 1.10 V1.0.0.124856, consider restricting access to the "/goform/delAd...

PT-2022-12418 · Unknown · Globalprotect-Openconnect

Name of the Vulnerable Software and Affected Versions: GlobalProtect-openconnect versions prior to 2.0.0 Description: The issue is related to incorrect access control in GPService through DBUS and GUI. This allows arbitrary users to start a VPN connection to arbitrary servers. An attacker can hos...

PT-2022-2681 · Pjsip +4 · Pjsip +4

Name of the Vulnerable Software and Affected Versions: PJSIP versions 2.12 and prior Description: The issue is related to a stack buffer overflow vulnerability in the PJSIP multimedia communication library, specifically affecting users of PJSUA2 or those who call the API endpoints pjmedia sdp pri...