PT-2022-26306 · Unknown · Simple Exam Reviewer Management System

Name of the Vulnerable Software and Affected Versions: Simple Exam Reviewer Management System version 1.0 Description: The issue concerns an insecure file upload in the User List function. Recommendations: For Simple Exam Reviewer Management System version 1.0, consider restricting file uploads t...

PT-2022-26709 · Tenda · Tenda Tx3

Name of the Vulnerable Software and Affected Versions: Tenda TX3 US TX3V1.0br V16.03.13.11 multi TDE01 Description: A stack overflow issue was discovered via the startIp parameter at the "/goform/SetPptpServerCfg" API endpoint. Recommendations: For Tenda TX3 US TX3V1.0br V16.03.13.11 multi TDE01,...

PT-2022-26702 · Opencats · Opencats

Name of the Vulnerable Software and Affected Versions: OpenCATS version 0.9.6 Description: A reflected cross-site scripting XSS issue was found, which can be exploited via the entriesPerPage parameter. Recommendations: For OpenCATS version 0.9.6, avoid using the entriesPerPage parameter until a f...

PT-2022-8690 · Asus · Asus Rt-N12+

Name of the Vulnerable Software and Affected Versions: Asus RT-N12E version 2.0.0.39 Description: The issue is related to incorrect access control. An attacker can change the administrator password without authentication through the "system.asp" and "start apply.htm" API endpoints. Recommendation...

PT-2022-26719 · Bento4 · Bento4

Name of the Vulnerable Software and Affected Versions: Bento4 version 1.6.0-639 Description: An issue was discovered in Bento4, leading to a Denial of Service DoS. The issue is caused by a heap-buffer-overflow in AP4 Dec3Atom::AP4 Dec3Atom at Ap4Dec3Atom.cpp, as demonstrated by mp42aac...

PT-2023-2657

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u361, 8u361-perf, 11.0.18, 17.0.6, 20 Oracle GraalVM Enterprise Edition versions 20.3.9, 21.3.5, 22.3.1 Description The issue exists due to insufficient input validation in the Swing component of Oracle Java SE and...

PT-2022-5315 · Asus +1 · Asussoftwaremanager.Exe +3

Name of the Vulnerable Software and Affected Versions: ASUS System Control Interface versions prior to 3.1.5.0 AsusSoftwareManager.exe versions prior to 1.0.53.0 AsusLiveUpdate.dll versions prior to 1.0.45.0 Description: The issue is related to incorrect default permissions in the System Control...

PT-2022-26260 · Liferay · Liferay Portal

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.3.4 through 7.4.3.36 Description: A cross-site scripting issue exists in the Object module's edit object details page, allowing remote attackers to inject arbitrary web script or HTML via a crafted payload injected...

PT-2022-26302 · Lavalite · Lavalite

Name of the Vulnerable Software and Affected Versions: Lavalite version 9.0.0 Description: The issue allows for path traversal attacks through the XSRF-TOKEN cookie, enabling read access to arbitrary files on the server. Recommendations: For Lavalite version 9.0.0, consider restricting access to...

PT-2022-26813 · Tenda · Tenda Ac15

Name of the Vulnerable Software and Affected Versions: Tenda AC15 version 15.03.05.18 Description: A stack overflow issue was discovered via the timeZone parameter in the form fast setting wifi set function. Recommendations: For Tenda AC15 version 15.03.05.18, consider restricting access to the...

PT-2022-6036 · Advantech · Advantech R-Seenet

Name of the Vulnerable Software and Affected Versions: Advantech R-SeeNet versions 2.4.17 and prior Description: The issue is related to a stack-based buffer overflow in Advantech R-SeeNet. This can be exploited by an unauthorized attacker to remotely overflow the stack buffer, enabling remote co...

PT-2022-25897 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: EyouCMS version 1.5.9 Description: The issue concerns multiple Cross-Site Request Forgery CSRF vulnerabilities found in EyouCMS. These vulnerabilities are present in the Members Center, Editorial Membership, and Points Recharge components...

PT-2022-5236 · Adobe · Illustrator

Name of the Vulnerable Software and Affected Versions: Adobe Illustrator versions 26.4 and earlier Adobe Illustrator versions 25.4.7 and earlier Description: The issue is related to an out-of-bounds read when parsing a crafted file, potentially allowing an attacker to execute code in the context ...

PT-2022-6113 · Tp Link · Tp-Link Ax10V1

Name of the Vulnerable Software and Affected Versions: TP-Link AX10v1 version V1 211117 Description: The issue allows attackers to execute a replay attack by using a previously transmitted encrypted authentication message and valid authentication token, enabling them to login to the web applicati...

PT-2022-21588 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 9.3 through 15.2.4 GitLab EE versions 15.3 through 15.3.3 GitLab EE versions 15.4 through 15.4.0 Description: Email addresses were leaked in WebHook logs. The issue affects GitLab EE, with the leak occurring in the logs...

PT-2022-20196 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to the fixed version Description: The issue is related to improper control of a resource identifier in Error Tracking, allowing an authenticated attacker to generate content that could cause a victim to make...

PT-2022-21570 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 14.9 through 15.2.4 GitLab EE versions 15.3 through 15.3.3 GitLab EE versions 15.4 through 15.4.0 Description: The issue concerns the serialization of sensitive data in GitLab EE, which can lead to the leakage of sensitive...

PT-2022-25879 · 74Cmsse · 74Cmsse

Name of the Vulnerable Software and Affected Versions: 74cmsSE version 3.12.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field. This is achieved through the /api/admin/notice/add API endpoint. Recommendations: For...

PT-2022-25865 · Xzs · Xzs

Name of the Vulnerable Software and Affected Versions: xzs version 3.8.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title text field in the /admin/question/edit API endpoint. This enables the execution of malicious code...

PT-2022-22944 · Zimbra · Zimbra Collaboration Suite

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite versions prior to 9.0.0 Description: The issue is related to incorrect sudo permissions, allowing a local privilege escalation where the zimbra user can coerce postfix into running arbitrary commands as root...