PT-2022-26298 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version 15.03.06.23 Description: The issue is related to a stack overflow vulnerability. This vulnerability can be exploited via the "/goform/saveParentControlInfo" API endpoint. Recommendations: For Tenda AC10 version 15.03.06.23,...

PT-2022-26289 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version 15.03.06.23 Description: The issue is related to a stack overflow that can be triggered via the "/goform/fromNatStaticSetting" API endpoint. Recommendations: For Tenda AC10 version 15.03.06.23, consider restricting access t...

PT-2022-26294 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version 15.03.06.23 Description: The issue is related to a stack overflow vulnerability. This vulnerability can be exploited via the API endpoint "/goform/fromSetIpMacBind". Recommendations: For Tenda AC10 version 15.03.06.23, as a...

PT-2022-25865 · Xzs · Xzs

Name of the Vulnerable Software and Affected Versions: xzs version 3.8.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title text field in the /admin/question/edit API endpoint. This enables the execution of malicious code...

PT-2022-26297 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version 15.03.06.23 Description: The issue is related to a stack overflow vulnerability. This vulnerability can be exploited via the API endpoint "/goform/formWifiWpsStart". Recommendations: For Tenda AC10 version 15.03.06.23, as a...

PT-2022-26291 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version 15.03.06.23 Description: The issue is related to a stack overflow vulnerability. This vulnerability can be exploited via the "/goform/formSetDeviceName" API endpoint. Recommendations: For Tenda AC10 version 15.03.06.23, as ...

CVE-2022-2992

CVE-2022-2992 is a GitLab GitHub Import API deserialization flaw that enables authenticated users to trigger remote code execution. Affected products are GitLab CE/EE with versions 11.10–11.10.x? (per the wording) and all releases prior to 15.1.6, 15.2 up to 15.2.4, and 15.3 up to 15.3.2. The roo...

PT-2022-25892 · Unknown · Clippercms

Name of the Vulnerable Software and Affected Versions: ClipperCMS version 1.3.3 Description: The issue is related to a Server-Side Request Forgery SSRF that can be exploited via the rss url news parameter at the "/manager/index.php" API endpoint. Recommendations: For ClipperCMS version 1.3.3, avo...

PT-2022-21973 · Unknown · Resiot Iot Platform +1

Name of the Vulnerable Software and Affected Versions: ResIOT IOT Platform + LoRaWAN Network Server versions through 4.1.1000114 Description: The issue is related to a SQL injection vulnerability. It can be exploited via a crafted POST request to the "/ResiotQueryDBActive" API endpoint. This allo...

Moderators can perform Time based SQL injection attack.

The API endpoint /api/chat/users/setenabled POST is vulnerable to a Time based blind SQL injection attack via body parameter ‘userId’. It allows a Moderator to read, modify or delete the entries in the sqlite database. Moderator can leak the streamkey to access admin dashboard. Proof of concept...

PT-2022-26319 · Unknown · Simple Cold Storage Management System

Name of the Vulnerable Software and Affected Versions: Simple Cold Storage Management System version 1.0 Description: The issue allows for SQL Injection via the "/csms/admin/?page=user/manage user&id=" API endpoint, specifically targeting the id variable. This could potentially lead to unauthoriz...

PT-2022-25847 · Unknown · Online Pet Shop We App

Name of the Vulnerable Software and Affected Versions: Online Pet Shop We App version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/admin/?page=orders/view order" API endpoint. Recommendations: For Online...

Bytebase allows low-privilege users to view admin projects

Overview The "Bytebase" application does not restrict low privilege user from accessing admin projects Details The "Bytebase" application does not restrict low privilege user from accessing admin projects for which an unauthorized user can view the "projects" created by "Admin". The affected...

PT-2022-25221 · Unknown · Online Banking System

Name of the Vulnerable Software and Affected Versions: Online Banking System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the cust id parameter at the "/net-banking/send funds action.php" API endpoint. Recommendations: For...

PT-2022-25588 · Tenda · Tenda Ac15 +1

Name of the Vulnerable Software and Affected Versions: Tenda AC15 and AC18 router version V15.03.05.19 Description: The issue is related to a stack overflow in the fromNatStaticSetting function when handling requests to the "/goform/NatStaticSetting" API endpoint. Recommendations: For Tenda AC15...

PT-2022-25389 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2022 Description: A full path disclosure issue was discovered in ZZCMS 2022. This issue can be exploited via the "/admin/index.PHP? server" API endpoint. Recommendations: For ZZCMS version 2022, consider restricting access to th...

CVE-2022-41232

A cross-site request forgery CSRF vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.xml file on the Jenkins controller file system with an empty file by providing a crafted file name to an API endpoint...

CVE-2022-41232

A cross-site request forgery CSRF vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.xml file on the Jenkins controller file system with an empty file by providing a crafted file name to an API endpoint...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.xml file on the Jenkins controller file system with an empty file by providing a crafted file name to an API endpoint...

Design/Logic Flaw

Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins controller file system by providing a crafted file name to an API endpoint...