PT-2022-5208 · Adobe · Photoshop

Name of the Vulnerable Software and Affected Versions: Adobe Photoshop versions 22.5.8 and earlier Adobe Photoshop versions 23.4.2 and earlier Description: The issue is related to an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an...

PT-2022-24761 · Siemens · Parasolid +1

Name of the Vulnerable Software and Affected Versions: Parasolid versions prior to V33.1.262 Parasolid versions prior to V34.0.252 Parasolid versions prior to V34.1.242 Parasolid versions prior to V35.0.161 Simcenter Femap versions prior to V2022.1.3 Simcenter Femap versions prior to V2022.2.2...

PT-2022-24779 · Siemens · Parasolid +1

Name of the Vulnerable Software and Affected Versions: Parasolid versions prior to V33.1.263 Parasolid V34.0 versions prior to V34.0.252 Parasolid V34.1 versions prior to V34.1.242 Parasolid V35.0 versions prior to V35.0.164 Simcenter Femap V2022.1 versions prior to V2022.1.3 Simcenter Femap...

PT-2022-24770 · Siemens · Parasolid +1

Name of the Vulnerable Software and Affected Versions: Parasolid versions prior to V33.1.263 Parasolid V34.0 versions prior to V34.0.252 Parasolid V34.1 versions prior to V34.1.242 Parasolid V35.0 versions prior to V35.0.164 Simcenter Femap V2022.1 versions prior to V2022.1.3 Simcenter Femap...

PT-2022-24777 · Siemens · Parasolid +1

Name of the Vulnerable Software and Affected Versions: Parasolid versions prior to V33.1.263 Parasolid V34.0 versions prior to V34.0.252 Parasolid V34.1 versions prior to V34.1.242 Parasolid V35.0 versions prior to V35.0.164 Simcenter Femap V2022.1 versions prior to V2022.1.3 Simcenter Femap...

PT-2022-25011 · Nokia · Nokia 1350 Oms

Name of the Vulnerable Software and Affected Versions: NOKIA 1350 OMS version R14.2 Description: The issue involves insufficiently protected credentials, specifically a cleartext administrator password, found on the edit configuration page. This can be exploited by an authenticated attacker. The...

PT-2022-23865 · Cuppacms · Cuppacms

Name of the Vulnerable Software and Affected Versions: CuppaCMS version 1.0 Description: The issue allows an authenticated user to read system files via a crafted POST request. This is achieved by using the function parameter value as a Local File Inclusion LFI payload in the "cuppa/api/index.php...

PT-2022-24354 · Unknown · Online Leave Management System

Name of the Vulnerable Software and Affected Versions: Online Leave Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/maintenance/manage leave type.php" API endpoint. Recommendations:...

PT-2022-24352 · Unknown · Online Leave Management System

Name of the Vulnerable Software and Affected Versions: Online Leave Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/maintenance/manage department.php" API endpoint. Recommendations:...

PT-2022-22007 · Micro Star International · Msi Feature Navigator

Name of the Vulnerable Software and Affected Versions: MSI Feature Nagivator version 1.0.1808.0901 Description: The issue in the Feature Navigator of Micro-Star International MSI Feature Nagivator allows attackers to cause a Denial of Service DoS via a crafted image or video file. Recommendations...

PT-2022-12118 · Anydesk · Anydesk

Name of the Vulnerable Software and Affected Versions: AnyDesk versions prior to 6.2.6 AnyDesk versions 6.3.x prior to 6.3.3 Description: An issue was discovered in the AnyDesk software, where an unnecessarily open listening port is created on a machine in the LAN of an attacker when the tunnelin...

PT-2022-23670 · Google · Android

Name of the Vulnerable Software and Affected Versions: Broadcaster in Group Sharing versions prior to 13.0.6.15 in Android S12 Broadcaster in Group Sharing versions prior to 13.0.6.14 in Android R11 and below Description: The issue is related to improper access control, allowing attackers to...

PT-2022-23676 · Samsung · Samsung Pay

Name of the Vulnerable Software and Affected Versions: Samsung Pay versions prior to 5.0.63 for KR and 5.1.47 for Global Description: The issue allows attackers to access files without permission via implicit Intent, exploiting a Pending Intent hijacking vulnerability in SpayNotification...

PT-2022-19201 · Unknown · Aenrich Ehrd Learning Management Key Performance Indicator System

Name of the Vulnerable Software and Affected Versions: aEnrich eHRD Learning Management Key Performance Indicator System version 5+ Description: The issue concerns the exposure of sensitive information to unauthorized actors. Recommendations: For version 5+, consider restricting access to sensiti...

PT-2022-23176 · Oauthlib +5 · Oauthlib +5

Name of the Vulnerable Software and Affected Versions: OAuthLib versions 3.1.1 through 3.2.1 Description: The issue allows an attacker providing a malicious redirect uri to cause denial of service. An attacker can also leverage the usage of uri validate functions depending on where it is used...

PT-2022-24321 · Unknown · Apartment Visitor Management System

Name of the Vulnerable Software and Affected Versions: Apartment Visitor Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the editid parameter at the "/avms/edit-apartment.php" API endpoint. There is no...

PT-2022-23185 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.10.5 and 14.3 Description: The issue allows for a Cross-Site Request Forgery CSRF attack, enabling the addition or removal of tags on XWiki pages. Recommendations: For versions prior to 13.10.5, update to...

PT-2022-20882 · Rdiffweb · Rdiffweb

Name of the Vulnerable Software and Affected Versions: rdiffweb versions prior to 2.4.1 Description: The issue is related to improper restriction of rendered UI layers or frames, allowing attackers to perform clickjacking attacks. This can trick victims into performing actions such as entering...

How Malicious Actors Abuse Native Linux Tools in Attacks

Through our honeypots and telemetry, we were able to observe instances in which malicious actors abused native Linux tools to launch attacks on Linux environments. In this blog entry, we discuss how these utilities were used and provide recommendations on how to minimize their impact...

Cisco Meraki MR Series Splash Page Insecure Configuration Option

A configuration option for the Splash Page feature also known as Captive Portal in Cisco Meraki MR Series devices may allow an administrator to configure an 802.11 WLAN in which traffic policies are not applied to clients that are connecting to the network. The insecure configuration is determine...