PT-2022-22224 · Unknown · Dptech Vpn

Name of the Vulnerable Software and Affected Versions: DPTech VPN version 8.1.28.0 Description: The issue is related to an arbitrary file read vulnerability. Recommendations: For DPTech VPN version 8.1.28.0, at the moment, there is no information about a newer version that contains a fix for this...

CSRF vulnerability and missing permission check in openshift-deployer

openshift-deployer 1.2.0 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password. Additionally, this form validation method...

PT-2022-13612 · Zephyr · Zephyr

Name of the Vulnerable Software and Affected Versions: Zephyr affected versions not specified Description: An out-of-bound write issue can be triggered in the Zephyr bluetooth mesh core stack during provisioning. Recommendations: At the moment, there is no information about a newer version that...

PT-2022-8894 · Unknown · Deferred-Exec

Name of the Vulnerable Software and Affected Versions: deferred-exec affected versions not specified Description: A command injection issue affects the package. The injection point is located in line 42 in lib/deferred-exec.js. Recommendations: At the moment, there is no information about a newer...

PT-2022-8901 · Unknown · Markdown-It-Toc

Name of the Vulnerable Software and Affected Versions: markdown-it-toc versions affected versions not specified Description: The issue affects the generation of the table of contents toc in markdown-it-toc, where the title of the generated toc and the contents of the header are not properly...

PT-2022-21333 · Digiwin · Digiwin Bpm

Name of the Vulnerable Software and Affected Versions: Digiwin BPM affected versions not specified Description: The issue is related to a XML External Entity Injection XXE vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform an XML injection...

PT-2022-21331 · Unknown · Digiwin Bpm

Name of the Vulnerable Software and Affected Versions: Digiwin BPM affected versions not specified Description: The issue is related to insufficient validation for user input in a function of Digiwin BPM. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially...

PT-2022-20161 · Unknown · Octopus Deploy

Name of the Vulnerable Software and Affected Versions: Octopus Deploy affected versions not specified Description: The issue concerns the lack of logging for changes made to artifacts within the system. There is no information provided about the estimated number of potentially affected devices...

PT-2022-16457 · Pegasystems · Pega Platform

Name of the Vulnerable Software and Affected Versions: Pega Platform affected versions not specified Description: The issue arises when an on-premise installation of the Pega Platform has the JMX interface port exposed to the Internet without proper port filtering configuration. This could allow...

PT-2022-9903 · Arista · Arista Eos

Name of the Vulnerable Software and Affected Versions: Arista EOS affected versions not specified Description: The issue affects the security ACL bypass in Arista EOS. It occurs when a NAT ACL rule filter with permit action matches the packet flow, potentially bypassing the security ACL drop rule...

PT-2022-4077 · Samba +10 · Samba +10

Name of the Vulnerable Software and Affected Versions: Samba affected versions not specified Description: The issue is related to a use-after-free problem in the Samba AD LDAP server, specifically in the AD DC database audit logging module. This module can access LDAP message values that have bee...

Apache Tapestry 5.8.1 vulnerable to ReDoS via Content Types causing catastrophic backtracking

Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service ReDoS in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on...

PT-2022-6619 · Pdf Xchange · Pdf-Xchange Editor

Name of the Vulnerable Software and Affected Versions: PDF-XChange Editor affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a...

PT-2022-3715 · Microsoft · Windows Performance Counters +1

Name of the Vulnerable Software and Affected Versions: Windows Performance Counters affected versions not specified Description: The issue is related to insufficient access restrictions in Windows Performance Counters, allowing an attacker to elevate their privileges. This can affect the system,...

PT-2022-3750 · Microsoft · Azure Site Recovery

Name of the Vulnerable Software and Affected Versions: Azure Site Recovery affected versions not specified Description: The issue is related to insufficient access controls in Azure Site Recovery, specifically in the VMWare to Azure component. This can allow a remote attacker to disclose protecte...

PT-2022-3755 · Microsoft · Azure Site Recovery

Name of the Vulnerable Software and Affected Versions: Azure Site Recovery affected versions not specified Description: The issue is related to insufficient access restrictions in Azure Site Recovery, specifically in the VMWare to Azure component. It allows a remote attacker to bypass security...

PT-2022-3980 · Microsoft · Windows Hyper-V +1

Name of the Vulnerable Software and Affected Versions: Windows Hyper-V affected versions not specified Description: The issue is related to insufficient boundaries in the controlled area of the system, which can be exploited by a remote attacker to gain unauthorized access to protected informatio...

PT-2022-3723 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to an information disclosure vulnerability in the Windows Network File System. It allows a remote attacker to disclose protected information due to an error in the data...

PT-2022-3848 · Microsoft · Azure Site Recovery

Name of the Vulnerable Software and Affected Versions: Azure Site Recovery affected versions not specified Description: The issue is related to insufficient access controls in Azure Site Recovery, specifically in the VMWare to Azure component. This can allow a remote attacker to elevate their...

PT-2022-3713 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to the Windows Advanced Local Procedure Call ALPC and is associated with insufficient access control. It allows an attacker to elevate their privileges. Recommendations...