PT-2022-19201 · Unknown · Aenrich Ehrd Learning Management Key Performance Indicator System

Name of the Vulnerable Software and Affected Versions: aEnrich eHRD Learning Management Key Performance Indicator System version 5+ Description: The issue concerns the exposure of sensitive information to unauthorized actors. Recommendations: For version 5+, consider restricting access to sensiti...

PT-2022-23176 · Oauthlib +5 · Oauthlib +5

Name of the Vulnerable Software and Affected Versions: OAuthLib versions 3.1.1 through 3.2.1 Description: The issue allows an attacker providing a malicious redirect uri to cause denial of service. An attacker can also leverage the usage of uri validate functions depending on where it is used...

PT-2022-23670 · Google · Android

Name of the Vulnerable Software and Affected Versions: Broadcaster in Group Sharing versions prior to 13.0.6.15 in Android S12 Broadcaster in Group Sharing versions prior to 13.0.6.14 in Android R11 and below Description: The issue is related to improper access control, allowing attackers to...

PT-2022-23676 · Samsung · Samsung Pay

Name of the Vulnerable Software and Affected Versions: Samsung Pay versions prior to 5.0.63 for KR and 5.1.47 for Global Description: The issue allows attackers to access files without permission via implicit Intent, exploiting a Pending Intent hijacking vulnerability in SpayNotification...

How Malicious Actors Abuse Native Linux Tools in Attacks

Through our honeypots and telemetry, we were able to observe instances in which malicious actors abused native Linux tools to launch attacks on Linux environments. In this blog entry, we discuss how these utilities were used and provide recommendations on how to minimize their impact...

PT-2022-20882 · Rdiffweb · Rdiffweb

Name of the Vulnerable Software and Affected Versions: rdiffweb versions prior to 2.4.1 Description: The issue is related to improper restriction of rendered UI layers or frames, allowing attackers to perform clickjacking attacks. This can trick victims into performing actions such as entering...

PT-2022-24321 · Unknown · Apartment Visitor Management System

Name of the Vulnerable Software and Affected Versions: Apartment Visitor Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the editid parameter at the "/avms/edit-apartment.php" API endpoint. There is no...

PT-2022-23185 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.10.5 and 14.3 Description: The issue allows for a Cross-Site Request Forgery CSRF attack, enabling the addition or removal of tags on XWiki pages. Recommendations: For versions prior to 13.10.5, update to...

Cisco Meraki MR Series Splash Page Insecure Configuration Option

A configuration option for the Splash Page feature also known as Captive Portal in Cisco Meraki MR Series devices may allow an administrator to configure an 802.11 WLAN in which traffic policies are not applied to clients that are connecting to the network. The insecure configuration is determine...

PT-2022-10328 · NetGear · Netgear R8000 Router

Name of the Vulnerable Software and Affected Versions: Netgear R8000 Router version 1.0.4.56 Description: A buffer overflow issue allows remote attackers to execute arbitrary code or cause a denial-of-service. This is achieved by sending a crafted POST to "/bd genie create account.cgi" with a...

PT-2022-24311 · Mtr +1 · Mtr +1

Name of the Vulnerable Software and Affected Versions: Nagios XI version 5.8.6 MTR component version 1.0.4 Description: A cross-site scripting XSS issue was found in Nagios XI via the MTR component. This allows for potential malicious script execution. Recommendations: For Nagios XI version 5.8.6...

PT-2022-24066 · Phicomm · Phicomm Fir303B A2 +3

Name of the Vulnerable Software and Affected Versions: Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers versions 3.0.1.17 and earlier Description: A remote command execution issue was found, which can be exploited via the trHops parameter of the tracert function. Recommendations: Fo...

PT-2022-14128 · Sophos · Sophos Firewall

Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 18.5 MR4 Sophos Firewall versions prior to 19.0 MR1 Description: The issue concerns multiple SQL injection vulnerabilities in the Webadmin component of Sophos Firewall. These vulnerabilities can be exploited ...

PT-2022-24314 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI version 5.8.6 Description: A cross-site scripting XSS issue was found in Nagios XI via the System Performance Settings page under the Admin panel. This allows for potential malicious script execution. Recommendations: For Nagios XI...

PT-2022-20581 · Xwiki · Xwiki Platform Security Parent Pom

Name of the Vulnerable Software and Affected Versions: XWiki Platform Security Parent POM versions 5.0 through 12.10.10 XWiki Platform Security Parent POM versions 13.0.0 through 13.4.5 XWiki Platform Security Parent POM versions 13.5.0 through 13.10.0 Description: A bug in the security cache...

PT-2022-16599 · WordPress · Download Manager

Name of the Vulnerable Software and Affected Versions: Download Manager plugin for WordPress versions up to, and including 3.2.50 Description: The issue arises from insufficient file type and path validation on the deleteFiles function found in the /Admin/Menu/Packages.php file. This function is...

PT-2022-25815 · Kitty +4 · Kitty +4

Name of the Vulnerable Software and Affected Versions: Kitty versions prior to 0.26.2 Description: The issue is related to insufficient validation in the desktop notification escape sequence, which can lead to arbitrary code execution. This occurs when a user displays attacker-controlled content ...

PT-2022-16193 · Aruba · Arubaos-Cx Switches

Name of the Vulnerable Software and Affected Versions: ArubaOS-CX Switches versions 10.06.0210 and below ArubaOS-CX Switches versions 10.08.1070 and below ArubaOS-CX Switches versions 10.09.1030 and below ArubaOS-CX Switches versions 10.10.0002 and below Description: Authenticated command injecti...

PT-2022-6606 · D Link · D-Link Dap-2020 +1

Name of the Vulnerable Software and Affected Versions: D-Link DAP-1360 affected versions not specified D-Link DAP-2020 affected versions not specified Description: This issue allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link routers...

PT-2022-13467 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: The issue was investigated and found not to be a security issue. It was withdrawn by its CNA. Recommendations: At the moment, there is no information about a newer version th...