PT-2022-5981 · Unknown +10 · Gd Extension +10

Name of the Vulnerable Software and Affected Versions: PHP versions prior to 7.4.33, 8.0.25 and 8.1.12 Description: The issue is related to the imageloadfont function in the gd extension, which can be exploited by providing a specially crafted font file. When the loaded font is used with the...

PT-2022-27029 · Delta Electronics · Diaenergy

Name of the Vulnerable Software and Affected Versions: Delta Electronics DIAEnergy version 1.9 Description: The issue is related to a SQL Injection flaw in the HICT Loop class. This flaw could potentially allow an attacker to gain code execution on a remote system. Recommendations: For Delta...

PT-2022-21919 · Bestwebsoft · Post To Csv

Name of the Vulnerable Software and Affected Versions: Post to CSV by BestWebSoft WordPress plugin versions 1.4.0 and earlier Description: The issue arises from the plugin's failure to properly escape fields when exporting data as CSV, leading to a CSV injection. Recommendations: For Post to CSV ...

PT-2022-21602

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 16.1 iPadOS versions prior to 16.1 macOS Ventura versions prior to 13 watchOS versions prior to 9.1 Description: The issue was addressed with improved memory handling. An application may be able to execute arbitrary co...

PT-2022-26078 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to 5.1.4 GROWI versions prior to 4.5.25 Description: The issue allows a remote authenticated attacker to bypass access restrictions and download markdown data from pages set to private by other users. Recommendations: For...

Authorization Bypass

github.com/relatedcode/messenger is vulnerable to authorization bypass. The vulnerability exists because the application permissions are not properly handled which allows an attacker to access internal chat logs of any registered user on the server...

Information Disclosure

reactor-netty is vulnerable to information disclosure. A remote attacker is able to request log headers in some cases of invalid HTTP requests which may reveal valid access tokens when WARN level is enabled, resulting in disclosure of sensitive information...

Sql injection

Best Student Result Management System v1.0 is vulnerable to SQL Injection via /upresult/upresult/notice-details.php?nid=...

PT-2022-13870 · Red Hat · 3Scale Api Management 2

Name of the Vulnerable Software and Affected Versions: 3scale API Management 2 Description: The issue arises from inadequate sanitation of user input in multiple fields, allowing an authenticated user to inject scripts. This could potentially lead to access to sensitive information or further...

PT-2022-26702 · Opencats · Opencats

Name of the Vulnerable Software and Affected Versions: OpenCATS version 0.9.6 Description: A reflected cross-site scripting XSS issue was found, which can be exploited via the entriesPerPage parameter. Recommendations: For OpenCATS version 0.9.6, avoid using the entriesPerPage parameter until a f...

PT-2022-22968 · Sourcecodester · Sourcecodester Canteen Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Canteen Management System version 1.0 Description: A critical issue affects the processing of the file edituser.php, where the manipulation of the id argument leads to SQL injection. This issue can be initiated remotely...

PT-2022-24703 · Unknown · Rava Certificate Validation System

Name of the Vulnerable Software and Affected Versions: RAVA certification validation system affected versions not specified Description: The RAVA certification validation system has a path traversal issue. This allows an unauthenticated remote attacker to bypass authentication and access arbitrar...

PT-2022-26815 · Tenda · Tenda Ac18

Name of the Vulnerable Software and Affected Versions: Tenda AC18 version 15.03.05.196318 Description: A stack overflow issue was discovered via the time parameter in the fromSetSysTime function. This issue can be exploited, potentially allowing for unauthorized access or control. Recommendations...

PT-2022-26691 · Goadmin · Go-Admin

Name of the Vulnerable Software and Affected Versions: go-admin aka GO Admin version 2.0.12 Description: The issue concerns the use of a hardcoded string 'go-admin' as a production JWT key in go-admin. Recommendations: For go-admin version 2.0.12, update the JWT key to a secure, randomly generate...

PT-2022-25865 · Xzs · Xzs

Name of the Vulnerable Software and Affected Versions: xzs version 3.8.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title text field in the /admin/question/edit API endpoint. This enables the execution of malicious code...

PT-2022-22944 · Zimbra · Zimbra Collaboration Suite

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite versions prior to 9.0.0 Description: The issue is related to incorrect sudo permissions, allowing a local privilege escalation where the zimbra user can coerce postfix into running arbitrary commands as root...

PT-2022-25927 · Devhub · Devhub

Name of the Vulnerable Software and Affected Versions: devhub version 0.102.0 Description: The issue is related to broken session control in the software. Recommendations: For devhub version 0.102.0, at the moment, there is no information about a newer version that contains a fix for this...

PT-2022-22520 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC commit 617837b Description: A heap buffer overflow issue was discovered in OTFCC. The issue occurs via the /release-x64/otfccdump+0x6b5567 endpoint. Recommendations: For OTFCC commit 617837b, consider restricting access to the...

PT-2022-25921 · Unknown · Open Source Sacco Management System

Name of the Vulnerable Software and Affected Versions: Open Source SACCO Management System version 1.0 Description: A SQL injection issue was found in the id parameter at the /sacco shield/manage borrower.php API endpoint. Recommendations: For Open Source SACCO Management System version 1.0, avoi...

PT-2022-8825 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about a specific vulnerability. It appears to be a notification about a rejected candidate...