PT-2022-27738 · Ayacms · Ayacms

Name of the Vulnerable Software and Affected Versions: AyaCMS version 3.1.2 Description: The issue is related to a code flaw in the ust sql.inc.php file, which allows attackers to cause command execution by inserting malicious code. Recommendations: For AyaCMS version 3.1.2, consider restricting...

Priva TopControl Suite

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Priva Equipment: TopControl Suite Vulnerability: Use of Password Hash with Insufficient Computational Effort 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...

PT-2022-7108 · Systemd +9 · Systemd +9

Name of the Vulnerable Software and Affected Versions: systemd versions 247 and later, with affected builds including those with libacl support Description: A security flaw in systemd-coredump can cause a local information leak due to not respecting the fs.suid dumpable kernel setting. This issue...

PT-2022-27800 · Unknown · Daloradius

Name of the Vulnerable Software and Affected Versions: daloradius versions prior to master Description: The issue concerns a sensitive cookie without the 'HttpOnly' flag in the GitHub repository lirantal/daloradius. This could potentially allow unauthorized access to sensitive information...

PT-2022-27897 · Tenda · Tenda F1203

Name of the Vulnerable Software and Affected Versions: Tenda F1203 version 2.0.1.6 Description: A buffer overflow issue was discovered via the mitInterface parameter at the "/goform/addressNat" API endpoint. Recommendations: For Tenda F1203 version 2.0.1.6, as a temporary workaround, consider...

PT-2022-27718 · Wbce Cms · Wbce Cms

Name of the Vulnerable Software and Affected Versions: WBCE CMS version 1.5.4 Description: The issue allows for getshell by modifying the upload file type, potentially leading to unauthorized access and control. Recommendations: For WBCE CMS version 1.5.4, consider restricting the upload file typ...

Fuji Electric Tellus Lite V-Simulator

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Fuji Electric Equipment: Tellus Lite V-Simulator Vulnerabilities: Out-of-bounds Write, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to execute...

PT-2022-27799 · Unknown · Denshi Nyusatsu Core System

Name of the Vulnerable Software and Affected Versions: DENSHI NYUSATSU CORE SYSTEM versions prior to v6 R4 Description: The issue allows a remote unauthenticated attacker to redirect a user to an arbitrary web site, potentially leading to phishing attacks. This can be achieved by having the user...

PT-2022-25854 · Unknown · Blogengine.Net

Name of the Vulnerable Software and Affected Versions: BlogEngine.NET version 3.3.8.0 Description: An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs allows attackers to execute arbitrary code via uploading a crafted PNG file. Recommendations: For BlogEngine.NET...

PT-2022-27717 · Shoplazza · Shoplazza Lifestyle

Name of the Vulnerable Software and Affected Versions: Shoplazza LifeStyle version 1.1 Description: A vulnerability was found in the Review Flow Handler component, affecting the processing of the file "/admin/api/theme-edit/". The manipulation of the Title argument leads to cross-site scripting...

Akamai’s Perspective on December’s Patch Tuesday 2022

Every Patch Tuesday stirs up the community. See Akamai's December insights and recommendations on what to focus on, and patch, patch, patch!...

PT-2022-26473 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a possible out of bounds read in the VsimOperationDataExt::encode function of vsimdata.cpp due to a missing bounds check. This could lead to local information disclosure, requiring System...

PT-2022-26186 · Unknown · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: BigBlueButton versions prior to 2.4-rc-6 BigBlueButton versions prior to 2.5-alpha-1 Description: BigBlueButton is an open source web conferencing system. The issue concerns Incorrect Authorization for setting emoji status. A user with...

PT-2022-14804 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to an integer overflow in the ppmpu set of ppmpu.c, which could lead to a local escalation of privilege with no additional execution privileges needed. User interaction is not required for...

PT-2022-14750 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: A missing permission check in the createDialog of WifiScanModeActivity.java allows a Guest user to enable location-sensitive settings. This could lead to local escalation of privilege from the Guest us...

PT-2022-26478 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a possible out of bounds read in the MiscService::DoOemSetTcsFci function of miscservice.cpp due to a missing bounds check. This could lead to local information disclosure, requiring System...

PT-2022-10042 · Unknown · Sourcecodester Online Grading System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Online Grading System version 1.0 Description: A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the uname parameter. Recommendations: For Sourcecodester Online Grading System version 1.0,...

PT-2022-25116 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about a specific vulnerability. It appears to be a notification about a rejected CVE candidate...

PT-2022-27451 · Unknown · Django-Photologue

Name of the Vulnerable Software and Affected Versions: django-photologue versions up to 3.15.1 Description: A vulnerability was found in the Default Template Handler component, specifically in the file photologue/templates/photologue/photo detail.html. The manipulation of the object.caption...

PT-2022-10521 · Feehicms · Feehicms

Name of the Vulnerable Software and Affected Versions: Feehi CMS versions 2.1.1 and earlier Description: The issue allows attackers to run arbitrary code via the user name field of the "/login" API endpoint. This is a Cross Site Scripting XSS issue, which means attackers can inject malicious...