PT-2022-17211

Name of the Vulnerable Software and Affected Versions ZEROF Web Server version 2.0 Description The issue allows for SQL Injection via the /HandleEvent endpoint. Recommendations For ZEROF Web Server version 2.0, consider restricting access to the /HandleEvent endpoint until a patch is available...

PT-2022-15506 · Sap · Sap 3D Visual Enterprise Viewer

Name of the Vulnerable Software and Affected Versions: SAP 3D Visual Enterprise Viewer version 9.0 Description: The issue occurs when a user opens a manipulated Tagged Image File Format .tiff, 2d.x3d received from untrusted sources, causing the application to crash and become temporarily...

PT-2022-5417 · Corel · Coreldraw Graphics Suite

Name of the Vulnerable Software and Affected Versions: Corel CorelDRAW Graphics Suite version 23.5.0.506 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a...

PT-2022-10512 · Gpac · Gpac

Name of the Vulnerable Software and Affected Versions: GPAC version 1.0.1 Description: A heap-based buffer overflow issue exists in MP4Box via the gp rtp builder do mpeg12 video function, allowing attackers to have unspecified impact through a crafted file in the MP4Box command. Recommendations:...

PT-2022-12519 · Gpac · Gpac

Name of the Vulnerable Software and Affected Versions: GPAC version 1.0.1 Description: A Pointer Dereference issue exists in the unlink chunk.isra file, causing a Denial of Service that is context-dependent. Recommendations: For GPAC version 1.0.1, consider restricting access to the unlink...

PT-2022-12201

Name of the Vulnerable Software and Affected Versions Opmantek Open-AudIT version 4.2.0 Description An information exposure issue has been discovered, allowing an authenticated attacker to read files outside of the restricted directory. Recommendations For Opmantek Open-AudIT version 4.2.0,...

PT-2021-13384 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-12 Description: The issue is related to a side channel information disclosure in the getSerialForPackage method of DeviceIdentifiersPolicyService.java. This could allow an attacker to determine whether an app is...

PT-2021-5529 · Adobe · Media Encoder

Name of the Vulnerable Software and Affected Versions: Adobe Media Encoder versions 22.0, 15.4.2 and earlier Description: The issue is related to an out-of-bounds read vulnerability in Adobe Media Encoder when processing 3GP files. This could lead to the disclosure of sensitive memory. An attacke...

PT-2021-6941 · Microsoft · Office Web Apps +4

Name of the Vulnerable Software and Affected Versions: Microsoft Excel affected versions not specified Microsoft 365 affected versions not specified Microsoft Office affected versions not specified Microsoft Office Online Server affected versions not specified Microsoft Office Web Apps affected...

PT-2021-7645 · Openbmc · Openbmc

Name of the Vulnerable Software and Affected Versions: OpenBMC version 2.9 Description: The issue is related to the netipmid interface IPMI lan+ in the OpenBMC embedded operating system, which is associated with errors during the authentication procedure. An attacker can exploit this issue by...

PT-2021-9654 · Unknown · Rukovoditel Project Management App

Name of the Vulnerable Software and Affected Versions: Rukovoditel Project Management App version 2.7.2 Description: An exploitable SQL injection issue exists in the 'entities/fields' page. The heading field id parameter in this page is vulnerable to authenticated SQL injection. An attacker can...

PT-2021-3041 · Microsoft · Office Web Apps Server +3

Name of the Vulnerable Software and Affected Versions: Microsoft Office affected versions not specified Microsoft 365 Apps for Enterprise affected versions not specified Microsoft Excel affected versions not specified Microsoft Office Web Apps Server affected versions not specified Description: T...

PT-2021-9653 · Unknown · Rukovoditel Project Management App

Name of the Vulnerable Software and Affected Versions: Rukovoditel Project Management App version 2.7.2 Description: An exploitable SQL injection issue exists in the "forms fields rules/rules" page. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated...

PT-2021-2506 · Cisco · Cisco Aironet Access Points

Name of the Vulnerable Software and Affected Versions: Cisco Aironet Access Points affected versions not specified Description: The issue is related to insufficient input validation for a specific command in the implementation of a CLI command, which could allow an authenticated, local attacker t...

WordPress Backup by Supsystic plugin <= 2.3.12 - Local File Inclusion (LFI) vulnerability

Local File Inclusion LFI vulnerability found by Erik David Martin in WordPress Backup by Supsystic plugin versions = 2.3.12. Solution 2021-02-08 - we were unable to find a patched version of this plugin. Notice from WordPress plugin repository: "This plugin has been closed as of December 1, 2020...

PT-2021-10918

Name of the Vulnerable Software and Affected Versions zzcms version ver201910 Description A blind SQL injection issue exists, based on time, and is related to cookie injection. Recommendations For zzcms version ver201910, consider restricting access to sensitive areas of the application to minimi...

PT-2020-4583 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.0 and 2.3.5p1 and earlier Description: The issue is related to an unsafe file upload vulnerability, which could result in arbitrary code execution. This could be exploited by authenticated users with administrative...

PT-2020-15384

Name of the Vulnerable Software and Affected Versions Gazie version 7.29 Description The issue allows for Cross Site Scripting XSS via the "http://192.168.100.7/gazie/modules/config/admin utente.php" endpoint, specifically through the user name variable. An attacker can inject JavaScript code,...

GHSA-224H-P7P5-RH85 Directory Traversal in wenluhong1

Affected versions of wenluhong1 resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system. Example...

windows-selenium-chromedriver downloads Resources over HTTP

Affected versions of windows-selenium-chromedriver insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code...