PT-2022-27444 · Unknown · Web-Based Student Clearance System

Name of the Vulnerable Software and Affected Versions: Web-Based Student Clearance System version 1.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtfullname parameter in the Admin/add-admin.php file. This enables the...

PT-2022-24377 · WordPress · Google Forms

Name of the Vulnerable Software and Affected Versions: Google Forms WordPress plugin versions 0.95 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed,...

PT-2022-24334 · WordPress · Video Thumbnails

Name of the Vulnerable Software and Affected Versions: Video Thumbnails WordPress plugin versions 2.12.3 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...

PT-2022-23190 · WordPress · Jeeng Push Notifications

Name of the Vulnerable Software and Affected Versions: Jeeng Push Notifications WordPress plugin versions prior to 2.0.4 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...

PT-2022-27682 · Unknown · Esl Protocol

Name of the Vulnerable Software and Affected Versions: ESL protocol versions affected versions not specified Description: The issue concerns the lack of authentication in the ESL protocol, which can be exploited by attackers to change label values using 433 MHz RF signals. This has been...

PT-2022-26181 · Mpxj · Mpxj

Name of the Vulnerable Software and Affected Versions: MPXJ versions prior to 10.14.1 Description: MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems, MPXJ's use of File.createTempFile.. results in temporary...

PT-2022-26183 · Unknown · Super-Xray

Name of the Vulnerable Software and Affected Versions: super-xray versions prior to 0.7 Description: The issue concerns a web vulnerability scanning tool that assumed trusted input for the program config stored in a yaml file. An attacker with local access to the file could exploit this and...

PT-2022-27053 · Unknown · Browsershot

Name of the Vulnerable Software and Affected Versions: Browsershot version 3.57.2 Description: The issue allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the HTML content passed to the Browsershot::html method do...

PT-2022-24909 · Nextcloud · User Oidc

Name of the Vulnerable Software and Affected Versions: user oidc versions prior to 1.2.1 Description: The issue concerns the user oidc OpenID Connect user backend for Nextcloud, where sensitive information such as OIDC client credentials and tokens are sent in plain text over HTTP without TLS in...

PT-2023-2661

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u361, 8u361-perf, 11.0.18, 17.0.6 Oracle GraalVM Enterprise Edition versions 20.3.9, 21.3.5, 22.3.1 Description A difficult to exploit vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition allows an...

PT-2022-26156 · Nextcloud · Nextcloud Talk Android

Name of the Vulnerable Software and Affected Versions: Nextcloud Talk Android versions prior to 14.1.0 Description: The issue affects the Nextcloud Talk Android, which is the Android OS implementation of the Nextcloud Talk chat system. In affected versions, the receiver is not protected by...

PT-2022-19863 · Mitsubishi · Gx Works3

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric Corporation GX Works3 versions 1.015R and later Description: The issue allows a remote unauthenticated attacker to disclose sensitive information, enabling unauthenticated users to access MELSEC safety CPU modules illegall...

CVE-2022-26885 Apache DolphinScheduler config file read by task risk

When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher...

CVE-2022-42895 Info Leak in l2cap_core in the Linux Kernel

There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2capcore.c's l2capparseconfreq function which can be used to leak kernel pointers remotely. We recommend upgrading past commit https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435a732b4e62ba3157a2e...

CVE-2022-1038

A potential security vulnerability has been identified in the HP Jumpstart software, which might allow escalation of privilege. HP is recommending that customers uninstall HP Jumpstart and use myHP software...

PT-2022-27367 · Wbce Cms · Wbce Cms

Name of the Vulnerable Software and Affected Versions: WBCE CMS version 1.5.4 Description: A cross-site scripting XSS issue in the Modify Page module allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Source field. Recommendations: For WBCE CMS versi...

PT-2022-23686 · WordPress · Popup Maker

Name of the Vulnerable Software and Affected Versions: Popup Maker WordPress plugin versions prior to 1.16.11 Description: The issue allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks, which could be used against admins, due to the plugin not sanitising...

CVE-2022-4087 iPXE TLS tls.c tls_new_ciphertext information exposure

A vulnerability was found in iPXE. It has been declared as problematic. This vulnerability affects the function tlsnewciphertext of the file src/net/tls.c of the component TLS. The manipulation of the argument padlen leads to information exposure through discrepancy. The name of the patch is...

PT-2022-26000 · Unknown · Accessibility Plugin

Name of the Vulnerable Software and Affected Versions: Accessibility plugin versions prior to 1.0.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For versions prior to 1.0.4, upda...

PT-2022-27292 · Unknown · Creative Mail

Name of the Vulnerable Software and Affected Versions: Creative Mail plugin versions prior to 1.5.5 Description: The issue concerns Multiple Cross-Site Request Forgery CSRF vulnerabilities. Recommendations: For versions prior to 1.5.5, update to version 1.5.5 or later to resolve the issue...