PT-2022-6585 · Apache · Apache Streampark

Name of the Vulnerable Software and Affected Versions: Apache StreamPark versions 1.0.0 through 2.0.0 Description: The issue is related to an LDAP injection vulnerability, which is an attack used to exploit web-based applications that construct LDAP statements based on user input. When an...

PT-2022-27114 · Dedecmdv6 · Dedecmdv6

Name of the Vulnerable Software and Affected Versions: dedecmdv6 version 6.1.9 Description: The issue allows for Remote Code Execution RCE via the file manage control.php endpoint. Recommendations: For dedecmdv6 version 6.1.9, consider restricting access to the file manage control.php endpoint...

PT-2022-27659 · Percona · Percona Xtrabackup

Name of the Vulnerable Software and Affected Versions: qpress versions before 11.3 qpress before PierreLvx/qpress 20220819 Description: The issue allows directory traversal via ../ in a .qp file. This can be exploited in products that use qpress, such as Percona XtraBackup. Recommendations: For...

PT-2022-6499 · Abb · Abb Rccmd

Name of the Vulnerable Software and Affected Versions: ABB RCCMD versions prior to 4.40 230207 Description: The issue is related to the use of default passwords in the ABB RCCMD client-server application for managing uninterruptible power supplies. This could allow a remote attacker to execute...

PT-2022-26172 · Sourcegraph · Sourcegraph

Name of the Vulnerable Software and Affected Versions: Sourcegraph versions prior to 4.1.0 Description: The issue is a command injection vulnerability in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host paramete...

PT-2022-27570 · Aerocms · Aerocms

Name of the Vulnerable Software and Affected Versions: AeroCMS version 0.0.1 Description: The issue allows attackers to access database information through a SQL Injection vulnerability. This vulnerability is exploited via the id parameter at the "admin/post comments.php" endpoint. Recommendation...

PT-2022-13170 · WordPress · Five Star Restaurant Reservations

Name of the Vulnerable Software and Affected Versions: Five Star Restaurant Reservations WordPress plugin versions prior to 2.4.12 Description: The issue allows unauthenticated users to change the payment status of arbitrary bookings due to a lack of authorization. Additionally, it enables...

PT-2022-26168 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.10.8 XWiki Platform versions prior to 14.6 Description: The XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with view...

PT-2022-24956 · Alibaba · Aliyun-Oss-Client

Name of the Vulnerable Software and Affected Versions: aliyun-oss-client versions prior to 0.8.1 Description: The aliyun-oss-client unintentionally divulges the authentication secret. Users of this library will be affected, as the incoming secret will be disclosed unintentionally. Recommendations...

PT-2022-27218 · Unknown · Automotive Shop Management System

Name of the Vulnerable Software and Affected Versions: Automotive Shop Management System version 1.0 Description: The issue is related to SQL Injection. It can be exploited via the /asms/admin/mechanics/view mechanic.php endpoint, specifically through the id parameter. Recommendations: For...

PT-2022-27216 · Unknown · Automotive Shop Management System

Name of the Vulnerable Software and Affected Versions: Automotive Shop Management System version 1.0 Description: The issue is related to SQL Injection. It can be exploited via the /asms/admin/mechanics/manage mechanic.php endpoint, specifically through the id parameter. Recommendations: For...

PT-2022-25983 · Unknown · Bp Better Messages

Name of the Vulnerable Software and Affected Versions: Better Messages plugin version 1.9.10.68 Description: The issue is related to an Authenticated Server-Side Request Forgery SSRF vulnerability. This means that an attacker could potentially forge requests to internal or external services, but...

PT-2022-23327 · WordPress · Ultimate Tables

Name of the Vulnerable Software and Affected Versions: ULTIMATE TABLES plugin versions = 1.6.5 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability affects the ULTIMATE TABLES plugin on WordPress, allowing for reflected cross-site...

PT-2022-24794 · Unknown · College Management System

Name of the Vulnerable Software and Affected Versions: College Management System version 1.0 Description: The issue allows for SQL Injection SQLi by inserting SQL commands into the username and password fields in the "login.php" page. Recommendations: For College Management System version 1.0, as...

PT-2022-27290 · Unknown · Chameleon Plugin

Name of the Vulnerable Software and Affected Versions: Chameleon plugin versions 1.4.3 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability requires authentication with admin or higher privileges. The estimated number of potentially...

PT-2022-24793 · Unknown · College Management System

Name of the Vulnerable Software and Affected Versions: College Management System version 1.0 Description: The issue allows an admin user to upload a .php file containing malicious code via the student.php file, potentially leading to remote code execution. The authentication required for this...

PT-2022-26780 · Unknown · Online Diagnostic Lab Management System

Name of the Vulnerable Software and Affected Versions: Online Diagnostic Lab Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/clients/view client.php" API endpoint. Recommendations:...

PT-2022-23625 · D Link · Dlink Router

Name of the Vulnerable Software and Affected Versions: DLINK router version 3.0.8 Description: The issue allows for command injection through the interface used to configure NTP servers via jsonrpc API, potentially running commands with ROOT permissions on the router. This is made possible by...

PT-2022-26646 · Siemens · Syngo Dynamics

Name of the Vulnerable Software and Affected Versions: syngo Dynamics versions prior to VA40G HF01 Description: A vulnerability has been identified in the syngo Dynamics application server, which hosts a web service using an operation with improper write access control. This could allow directory...

PT-2022-6232 · Apple +1 · Mdnsresponder.Exe +1

Name of the Vulnerable Software and Affected Versions: mDNSResponder.exe affected versions not specified Audinate Dante Application Library version le1.2.0 Description: The issue is related to a DLL Sideloading attack, where the executable improperly specifies how to load the DLL, from which fold...