PT-2022-17611 · WordPress · Advanced Custom Fields Pro

Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields WordPress plugin versions prior to 5.12.3 Advanced Custom Fields Pro WordPress plugin versions prior to 5.12.3 Description: The issue allows unauthenticated users to upload files, limited to those allowed in a default...

PT-2022-7545 · Hdf5 +2 · Hdf5 +2

Name of the Vulnerable Software and Affected Versions: HDF5 versions prior to 1.14.4 Description: The issue is related to a buffer overflow in the H5Z filter fletcher32 function of the HDF5 library, which can lead to corruption of the instruction pointer. This can cause denial of service or...

PT-2022-17339

Name of the Vulnerable Software and Affected Versions Duplicator WordPress plugin versions prior to 1.4.7 Description The issue allows unauthenticated visitors to access the main installer endpoint of the plugin and download the full site backup without authentication, if the installer script has...

PT-2022-22633 · Unknown · Ecommerce-Codeigniter-Bootstrap

Name of the Vulnerable Software and Affected Versions: Ecommerce-CodeIgniter-Bootstrap versions before commit 56465f Description: A cross-site scripting XSS issue was found in the function base url at the /blog/blogpublish.php endpoint. This allows for potential exploitation. Recommendations: For...

Vulnerability fixed in Yokogawa Centum controller FCS products

Yokogawa has fixed a vulnerability in Centum controller FCS products. A malicious party could potentially exploit it to cause a denial-of-service. To exploit the vulnerability, the malicious party needs access to the production infrastructure. It is good practice not to have such infrastructure...

PT-2022-20183 · Tibco Software · Tibco Statistica Trial +3

Name of the Vulnerable Software and Affected Versions: TIBCO Data Science - Workbench versions 14.0.0 and below TIBCO Statistica versions 14.0.0 and below TIBCO Statistica - Estore Edition versions 14.0.0 and below TIBCO Statistica Trial versions 14.0.0 and below Description: The Web Console...

PT-2022-22485 · Pngdec · Pngdec

Name of the Vulnerable Software and Affected Versions: PNGDec version prior to the version that includes commit 8abf6be Description: A stack overflow issue was discovered in PNGDec. The issue is related to the /linux/main.cpp file. Recommendations: For versions prior to the version that includes...

PT-2022-23076 · Minetest +2 · Minetest +2

Name of the Vulnerable Software and Affected Versions: Minetest versions prior to 5.6.1 Description: The issue concerns a security vulnerability in Minetest, a free open-source voxel game engine, where a mod in single-player mode can set a global setting to control the Lua script loaded for the...

PT-2022-22911 · Fork Cms · Fork Cms

Name of the Vulnerable Software and Affected Versions: ForkCMS versions prior to 5.11.0 Description: A stored cross-site scripting XSS issue allows remote attackers to inject JavaScript via the start date Parameter. This issue was patched in version 5.11.0. Recommendations: For ForkCMS versions...

PT-2022-22914 · Fork Cms · Fork Cms

Name of the Vulnerable Software and Affected Versions: ForkCMS version 5.9.3 Description: A cross-site scripting XSS issue allows remote attackers to inject JavaScript via the end date Parameter. This issue was patched in version 5.11.0, which implies that versions prior to 5.11.0 are affected...

PT-2022-18575 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 1.3.1 Description: The issue is related to Cross-site Scripting XSS - Stored. In the GitHub repository microweber/microweber, the title parameter in the body of a POST request when creating or editing a...

PT-2022-4221 · Intel · Intel E810 Ethernet Controllers

Name of the Vulnerable Software and Affected Versions: IntelR E810 Ethernet Controllers versions prior to 1.6.1.9 Description: The issue is related to improper access control in the firmware of some IntelR E810 Ethernet Controllers. This may allow a privileged user to potentially enable denial of...

PT-2022-16360 · WordPress · Weforms

Name of the Vulnerable Software and Affected Versions: weForms WordPress plugin versions prior to 1.6.14 Description: The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and escape its...

PT-2022-16476 · WordPress · Better Tag Cloud

Name of the Vulnerable Software and Affected Versions: Better Tag Cloud WordPress plugin versions prior to 0.99.6 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is disallowed, for example in a...

PT-2022-16220 · WordPress · Yaysmtp

Name of the Vulnerable Software and Affected Versions: YaySMTP WordPress plugin versions prior to 2.2.1 Description: The issue concerns a lack of proper authorization when saving settings, allowing users with a low role, such as a subscriber, to modify them. This can be exploited to conduct a...

PT-2022-15636 · WordPress · Website File Changes Monitor

Name of the Vulnerable Software and Affected Versions: Website File Changes Monitor WordPress plugin versions prior to 1.8.3 Description: The issue arises from the plugin's failure to sanitise and escape user input before using it in a SQL statement. This occurs via an action available to users...

PT-2022-16067 · WordPress · Easy Username Updater

Name of the Vulnerable Software and Affected Versions: Easy Username Updater WordPress plugin versions prior to 1.0.5 Description: The issue is related to the lack of CSRF checks in the Easy Username Updater WordPress plugin. This could allow attackers to make a logged-in admin change any user's...

PT-2022-4440 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore versions prior to 10.5.4 Description: The issue is related to a stored Cross-site Scripting XSS in the pimcore/pimcore GitHub repository. This occurs due to inadequate protection of the web page structure, allowing a remote attacker t...

PostgreSQL JDBC Driver SQL Injection in ResultSet.refreshRow() with malicious column names

Impact What kind of vulnerability is it? Who is impacted? The PGJDBC implementation of the java.sql.ResultRow.refreshRow method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. ;, could lead to SQL injection. This could lead to...

PT-2022-23643 · Samsung · Samsung Checkout

Name of the Vulnerable Software and Affected Versions: Samsung Checkout versions prior to 5.0.53.1 Description: The issue allows attackers to access IAP information via SQL injection vulnerability in the IAPService of Samsung Checkout. Recommendations: For versions prior to 5.0.53.1, update to...