PT-2022-8567

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned. Description The issue allows sensitive information to be obtained through the handling of serialized data due to the lack of proper authentication required to query the server. Recommendations At...

CVE-2022-26546

Hospital Management System v1.0 was discovered to lack an authorization component, allowing attackers to access sensitive information and obtain the admin password...

PT-2022-17928

Name of the Vulnerable Software and Affected Versions Hospital Management System version 1.0 Description The issue concerns a lack of an authorization component, allowing attackers to access sensitive information and obtain the admin password. Recommendations For Hospital Management System versio...

PT-2022-17042

Name of the Vulnerable Software and Affected Versions totolink EX300 v2 version 4.0.3c.140 B20210429 totolink EX1200T version 4.1.2cu.5230 B20210706 Description The issue is related to the lack of an authentication mechanism in the affected devices. Recommendations For totolink EX300 v2 version...

Microfinance Management System 1.0 SQL Injection Vulnerability

Microfinance Management System version suffers from multiple remote SQL injection vulnerabilities including one that allows for authentication bypass. Original discovery of SQL injection in this version is attributed to Hejap Zairy in March of 2022. Exploit Title: Microfinance Management System 1...

PT-2022-13445

Name of the Vulnerable Software and Affected Versions WooCommerce Affiliate Plugin versions prior to 4.16.4.5 Description The issue concerns a lack of authorization and CSRF checks on a specific action handler, as well as insufficient sanitization of settings. This enables an unauthenticated...

PT-2022-13217

Name of the Vulnerable Software and Affected Versions Sermon Browser WordPress plugin versions 0.45.22 and earlier Description The issue allows attackers to make a logged-in admin upload arbitrary files, such as PHP files, due to the lack of CSRF checks and file validation when uploading Sermon...

CVE-2021-44462

This vulnerability can be exploited by parsing maliciously crafted project files with Horner Automation Cscape EnvisionRV v4.50.3.1 and prior. The issues result from the lack of proper validation of user-supplied data, which can result in reads and writes past the end of allocated data structures...

Cross-site Scripting (XSS)

forkcms/forkcms is vulnerable to cross-site scriptingXSS attacks. A remote attacker is able to inject and execute malicious javascript via the description of a new module due to the lack of validations...

Adobe Acrobat Reader DC JP2 File Parsing Use-After-Free Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within th...

Denial Of Service (DoS)

bind9 is vulnerable to denial of service. The vulnerability exists due to a lack of sanitization causing the system to crash...

PT-2022-9825

Name of the Vulnerable Software and Affected Versions Philips Gemini PET/CT family software affected versions not specified Description The software stores sensitive information in a removable media device without built-in access control. Recommendations At the moment, there is no information abo...

PT-2022-9811

Name of the Vulnerable Software and Affected Versions GE UR firmware versions prior to 8.1x Description The issue concerns the web interface of the GE UR firmware, which has read-only access but fails to properly validate user input. This failure makes it possible to perform cross-site scripting...

(Pwn2Own) HP LaserJet Pro MFP M283fdw eContactRestore Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of HP LaserJet Pro MFP M283fdw printers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

Remote Code Execution

github.com/gogs/gogs is vulnerable to remote code execution. Lack of proper validations in UploadRepoFiles function allow remote attackers to upload and execute malicious code on the system...

PT-2025-8216

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a lack of protection against concurrent changes to PCM buffer preallocation via proc files in the Linux kernel, potentially leading to use-after-free UAF issues o...

The vulnerability of the Kylin data processing platform, related to the lack of measures for cleaning incoming data, allows a perpetrator to execute arbitrary commands.

The vulnerability of the Kylin data processing platform is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

Privilege Escalation

MariaDB is vulnerable to privilege escalation. The vulnerability exists due to a Use-After-Free Privilege due to a lack of sanitization of the existence of an object prior to performing operations on the object...

Remote Code Execution (RCE)

post-loader is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization in an unsecure parser which allows an attacker to execute maliciously crafted script in the system...

Prototype Pollution

argencoders-notevil is vulnerable to prototype pollution. The vulnerability exists due to a lack of sanitization to restrict access to the main context...