PT-2022-16566

Name of the Vulnerable Software and Affected Versions Extensis Portfolio version 4.0 Description The issue is related to an authenticated unrestricted file upload vulnerability. This vulnerability is exploited via the AdminFileTransferServlet component. Recommendations For Extensis Portfolio...

WordPress Restrict for Elementor plugin < 1.0.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Restrict for Elementor plugin versions 1.0.3. Solution Update the WordPress Restrict for Elementor plugin to the latest available version at least 1.0.3...

WordPress Restrict User Access – Membership Plugin with Force plugin <= 2.2.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Restrict User Access – Membership Plugin with Force plugin versions = 2.2.1. Solution Update the WordPress Restrict User Access – Membership Plugin with Force plugin plugin to the latest available version at least 2.2.2...

WordPress Restrict for Elementor plugin < 1.0.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Restrict for Elementor plugin versions 1.0.3. Solution Update the WordPress Restrict for Elementor plugin to the latest available version at least 1.0.3...

WordPress Restrict User Access – Membership Plugin with Force plugin <= 2.2.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Restrict User Access – Membership Plugin with Force plugin versions = 2.2.1. Solution Update the WordPress Restrict User Access – Membership Plugin with Force plugin plugin to the latest available...

WordPress "Restrict – membership, site, content and user access restrictions for WordPress" plugin < 2.1.9 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "Restrict – membership, site, content and user access restrictions for WordPress" plugin versions 2.1.9. Solution Update the WordPress "Restrict – membership, site, content and user access restrictions...

WordPress "Restrict – membership, site, content and user access restrictions for WordPress" plugin < 2.1.9 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress "Restrict – membership, site, content and user access restrictions for WordPress" plugin versions 2.1.9. Solution Update the WordPress "Restrict – membership, site, content and user access restrictions for WordPress" plugin to...

WordPress Restrict Posts based on Conditions – Conditional Post Restrictions plugin <= 1.1.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Restrict Posts based on Conditions – Conditional Post Restrictions plugin versions = 1.1.2. Solution Update the WordPress Restrict Posts based on Conditions – Conditional Post Restrictions plugin to the latest available versio...

File Descriptor Leak

Possible sensitive files Vulnerability description: A possible sensitive file has been found. This file is not directly linked from the website. This check looks for common sensitive resources like password files, configuration files, log files, include files, statistics data, database dumps. Eac...

PT-2022-17211

Name of the Vulnerable Software and Affected Versions ZEROF Web Server version 2.0 Description The issue allows for SQL Injection via the /HandleEvent endpoint. Recommendations For ZEROF Web Server version 2.0, consider restricting access to the /HandleEvent endpoint until a patch is available...

PT-2022-1643

Name of the Vulnerable Software and Affected Versions Redis versions prior to the fixed version Debian-specific Redis Server affected versions not specified Description A Lua sandbox escape vulnerability in Redis could result in remote code execution. The issue is related to a packaging problem a...

PT-2022-13318

Name of the Vulnerable Software and Affected Versions pollbot versions prior to 1.4.6 Description The issue is an open redirect in pollbot, affecting URLs such as https://pollbot.services.mozilla.com/ and https://pollbot.stage.mozaws.net/. An attacker can redirect users to malicious sites by...

PT-2022-7464 · Apache +3 · Apache Tomcat +3

Name of the Vulnerable Software and Affected Versions: pgjdbc versions prior to 42.3.3 Description: The issue is related to the creation of arbitrary files through the loggerFile and loggerLevel connection properties in the pgjdbc driver. An attacker who controls the jdbc URL or properties can ca...

PT-2022-2375 · Nginx · Nginx Njs

Name of the Vulnerable Software and Affected Versions: nginx njs version 0.7.2 Description: The issue is related to a Buffer Overflow in the Array.prototype.concat function of the njs interpreter in the nginx server. This occurs when a slow array appended element is a fast array, leading to a typ...

PT-2022-17145 · Jenkins · Jenkins Dbcharts Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins dbCharts Plugin versions 0.5.2 and earlier Description: A missing check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified database via JDBC using attacker-specified credentials...

PT-2022-17113 · Jenkins · Jenkins Pipeline: Shared Groovy Libraries Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Shared Groovy Libraries Plugin versions 552.vd9cc05b8a2e1 and earlier Jenkins Pipeline: Shared Groovy Libraries Plugin version 2.18.1 Jenkins Pipeline: Shared Groovy Libraries Plugin version 2.21.1 Description: The issue...

PT-2022-1945

Name of the Vulnerable Software and Affected Versions TP-LINK TL-WR840NES version V6.20 180709 Description The issue is related to a remote code execution vulnerability via the function oal wan6 setIpAddr. This vulnerability is associated with the lack of neutralization of special elements when...

PT-2022-7269 · Libde265 +3 · Libde265 +3

Name of the Vulnerable Software and Affected Versions: Libde265 version 1.0.8 Description: The issue is related to a segmentation violation via the apply sao internal function in sao.cc, which can be exploited to cause a Denial of Service DoS by using a crafted video file. This can be achieved by...

PT-2022-7271 · Libde265 +3 · Libde265 +3

Name of the Vulnerable Software and Affected Versions: Libde265 version 1.0.8 Description: The issue is related to a heap-buffer-overflow vulnerability in the put qpel 0 0 fallback 16 function, located in fallback-motion.cc, which is part of the Libde265 video codec implementation. This...

PT-2022-5106 · Moxa · Moxa Mxview

Name of the Vulnerable Software and Affected Versions: Moxa MXView version 3.2.4 Description: The issue is related to the use of hardcoded credentials in the web interface of Moxa MXView, allowing a remote attacker to gain full access to the device by sending a specially crafted HTTP request. Thi...