PT-2022-14049 · WordPress · Realty Workstation

Name of the Vulnerable Software and Affected Versions: The Realty Workstation WordPress plugin versions prior to 1.0.15 Description: The issue arises from the lack of sanitization and escaping of the trans edit parameter before its use in a SQL statement when an agent edits a transaction, leading...

PT-2022-19829 · Libmobi · Libmobi

Name of the Vulnerable Software and Affected Versions: libmobi versions prior to 0.10 Description: The issue allows attackers to cause a Denial of Service DoS via a crafted mobi file, due to a NULL pointer dereference in the mobi buffer getpointer component. Recommendations: For versions prior to...

PT-2022-12: Post-authentication command injection in ZoneMinder

The vulnerability was identified in ZoneMinder versions up to 1.36.14. The «Path Traversal» vulnerability allow a remote attacker to execute arbitrary code on the host running the software. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 27.05.2022 Recommendations:...

PT-2022-18073 · Apple · Itunes

Name of the Vulnerable Software and Affected Versions: Apple iTunes versions prior to 12.12.4 for Windows Description: A logic issue was addressed with improved state management, allowing an application to potentially delete files for which it does not have permission. Recommendations: For Apple...

PT-2022-10570 · WordPress · Mc4Wp

Name of the Vulnerable Software and Affected Versions: MC4WP plugin versions = 4.8.6 Description: The issue is an Authenticated Stored Cross-Site Scripting XSS vulnerability. It affects users with admin or higher roles. There is no information provided about the estimated number of potentially...

PT-2022-20418 · Jenkins · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins Global Variable String Parameter Plugin versions 1.2 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability, which is exploitable by attackers with Item/Configure permission. This occurs because...

PT-2022-19105 · Hewlett Packard · Hpe Oneview

Name of the Vulnerable Software and Affected Versions: HPE OneView versions prior to 7.0 Description: A remote bypass security restrictions issue was discovered. HPE has provided a software update to resolve this issue. Recommendations: For HPE OneView versions prior to 7.0, update to version 7.0...

PT-2022-18067 · Apple · Macos Monterey +4

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.4 watchOS versions prior to 8.6 tvOS versions prior to 15.5 macOS Big Sur versions prior to 11.6.6 Description: A memory corruption issue was addressed with improved state management, which may allow an application ...

PT-2022-21462 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.4 Description: The issue allows an app with root privileges to potentially access private information. This was addressed by enabling hardened runtime. Recommendations: For versions prior to 12.4, update to macOS...

PT-2022-18076 · Apple · Macos Monterey +2

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.4 macOS Big Sur versions prior to 11.6.6 Description: This issue was addressed with improved checks. An attacker may be able to cause unexpected application termination or arbitrary code execution. Recommendations:...

PT-2022-19709 · Konica Minolta · Konica Minolta Bizhub Mfp

Name of the Vulnerable Software and Affected Versions: Konica Minolta bizhub MFP devices before 2022-04-14 Description: The issue allows a Sandbox Escape. To exploit this, an attacker must attach a keyboard to a USB port, press F12, and then escape from the kiosk mode. Recommendations: For Konica...

PT-2022-2958 · Sonicwall · Sonicwall Sma1000

Name of the Vulnerable Software and Affected Versions: SonicWall SMA1000 series firmware versions 12.4.0, 12.4.1-02965 and earlier Description: The issue is related to the use of a shared and hard-coded encryption key to store data. This could allow an attacker to disclose protected information...

PT-2022-6736 · Offis +5 · Offis Dcmtk +5

Name of the Vulnerable Software and Affected Versions: OFFIS DCMTK versions prior to 3.6.7 Description: The issue is related to a path traversal vulnerability in the service class provider SCP of OFFIS DCMTK, allowing an attacker to write DICOM files into arbitrary directories under controlled...

PT-2022-11312 · Geoserver · Geoserver

Name of the Vulnerable Software and Affected Versions: GeoServer versions 2.18.5 and earlier GeoServer versions 2.19.x through 2.19.2 Description: The issue allows for Server-Side Request Forgery SSRF via the option for setting a proxy host. This means an attacker could potentially force the serv...

PT-2022-5036 · Hitachi Energy · Hitachi Energy Microscada X Sys600

Name of the Vulnerable Software and Affected Versions: Hitachi Energy MicroSCADA Pro SYS600 versions 9.0 through 9.4 FP2 Hotfix 4 Hitachi Energy MicroSCADA X SYS600 versions 10 through 10.3.1 Description: The issue is caused by improper input validation in the handling of a malformed IEC 104 TCP...

PT-2022-13925 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: snipe/snipe-it versions prior to 5.4.4 Description: The issue is related to Missing Authorization or Improper Access Control in the snipe/snipe-it GitHub repository. No information is provided about the estimated number of potentially affecte...

PT-2022-19843 · Hashicorp · Go-Getter

Name of the Vulnerable Software and Affected Versions: Hashicorp go-getter library versions prior to 1.5.11 Description: The issue concerns the Hashicorp go-getter library, where SSH credentials could be written into its logfile. This exposes sensitive credentials to local users who have the...

PT-2022-16962

Name of the Vulnerable Software and Affected Versions ESAPI versions prior to 2.3.0.0 Description There is a potential for a cross-site scripting vulnerability in ESAPI caused by an incorrect regular expression for onsiteURL in the antisamy-esapi.xml configuration file. This can cause javascript:...

PT-2022-3560 · Aethon · Tug Home Base Server

Name of the Vulnerable Software and Affected Versions: Aethon TUG Home Base Server versions prior to version 24 Description: The issue is related to the lack of input data sanitization in the "Reports" component of the TUG Home Base Server, which can allow a remote attacker to conduct a cross-sit...

PT-2022-3549 · Aethon · Aethon Tug Home Base Server

Name of the Vulnerable Software and Affected Versions: Aethon TUG Home Base Server versions prior to version 24 Description: The issue is related to weaknesses in the authorization procedure of the server. It allows a remote attacker to gain unauthorized access to hashed user credentials...