PT-2022-13513

Name of the Vulnerable Software and Affected Versions DivvyDrive versions prior to 4.6.2.0 Description The issue is related to improper neutralization of input during web page generation, also known as cross-site scripting. This allows for stored XSS attacks. A stored cross-site scripting...

CVE-2022-29215 Argument Injection in RegionProtect

RegionProtect is a plugin that allows users to manage certain events in certain regions of the world. Versions prior to 1.1.0 contain a YAML injection vulnerability that can cause an instant server crash if the passed arguments are not matched. Version 1.1.0 contains a patch for this issue. As a...

PT-2022-19345

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions prior to 6202 Description The issue allows attackers to perform username enumeration via a crafted POST request to "/ServletAPI/accounts/login". This enables attackers to identify valid usernames,...

PT-2022-19421

Name of the Vulnerable Software and Affected Versions Nextcloud Android versions prior to 3.19.0 Description The issue concerns the existence of sensitive tokens, images, and user-related details after the deletion of a user account in Nextcloud Android. This could lead to the misuse of the forme...

Typo3 Backend History Module Vulnerable to XSS

The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, which allows remote authenticated editors to read the history of arbitrary records via a crafted URL...

GHSA-2HP4-8H6H-93RR Typo3 Backend History Module Vulnerable to XSS

The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, which allows remote authenticated editors to read the history of arbitrary records via a crafted URL...

PT-2022-20427 · Jenkins · Jenkins Autocomplete Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Autocomplete Parameter Plugin versions 1.1 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the plugin references certain parameter names in an unsafe manner from...

PT-2022-3032 · Ntfs-3G +9 · Ntfs-3G +9

Name of the Vulnerable Software and Affected Versions: NTFS-3G versions through 2021.8.22 Description: The issue is related to a heap-based buffer overflow in the ntfs names full collate function of the NTFS-3G module for the NTFS file system. This can be exploited by using a specially crafted NT...

PT-2022-3660 · Unknown +1 · Formidable +1

Name of the Vulnerable Software and Affected Versions: formidable version 3.1.4 formidable version 3.2.4 Description: An arbitrary file upload vulnerability in formidable allows attackers to execute arbitrary code via a crafted filename. Some third parties dispute this issue because the product h...

PT-2022-19967 · Hms · Hms

Name of the Vulnerable Software and Affected Versions: HMS version 1.0 Description: The issue is related to a SQL injection vulnerability. When requesting "appointment.php" through POST, multiple parameters can lead to this vulnerability. Recommendations: For HMS version 1.0, as a temporary...

PT-2022-14072 · Drawio · Drawio

Name of the Vulnerable Software and Affected Versions: drawio versions prior to 18.0.5 Description: The issue allows for path traversal in the WellKnownServlet, enabling the reading of local files of the web application. This can potentially lead to sensitive information disclosure...

PT-2022-3245 · Ntfs-3G +6 · Ntfs-3G +6

Name of the Vulnerable Software and Affected Versions: NTFS-3G versions through 2021.8.22 Description: The issue is related to a buffer overflow vulnerability in the NTFS file system descriptor for the FUSE NTFS-3G module, allowing arbitrary memory read and write operations. This can be exploited...

PT-2022-14071 · Trudesk · Trudesk

Name of the Vulnerable Software and Affected Versions: trudesk versions prior to 1.2.2 Description: The issue is related to a Reflected XSS in the ticket filter function, which can execute malicious javascript code in a web page. Recommendations: For versions prior to 1.2.2, update to version 1.2...

PT-2022-6999 · Unknown +1 · Spring Framework +1

Name of the Vulnerable Software and Affected Versions: Spring Framework versions prior to 5.3.20 Spring Framework versions prior to 5.2.22 Spring Framework old unsupported versions Description: The application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an...

PT-2022-20195 · Litespeed · Litespeed Quic

Name of the Vulnerable Software and Affected Versions: LiteSpeed QUIC aka LSQUIC versions prior to 3.1.0 Description: The issue arises from the mishandling of MAX TABLE CAPACITY in liblsquic/lsquic qenc hdl.c. No information is provided about the estimated number of potentially affected devices...

PT-2022-10526 · Mikrotik · Routeros +1

Name of the Vulnerable Software and Affected Versions: Mikrotik RouterOs versions prior to 6.48.2 Description: The issue is a memory corruption vulnerability in the ptp process. An authenticated remote attacker can cause a Denial of Service NULL pointer dereference. Recommendations: For versions...

PT-2022-19362 · Unknown · Bus Pass Management System

Name of the Vulnerable Software and Affected Versions: Bus Pass Management System version 1.0 Description: An insecure direct object reference IDOR vulnerability in the viewid parameter allows attackers to access sensitive information. Recommendations: For Bus Pass Management System version 1.0,...

PT-2022-13939 · Gruntjs +3 · Gruntjs +3

Name of the Vulnerable Software and Affected Versions: GruntJS versions prior to 1.5.3 Description: The issue concerns a TOCTOU Time-of-Check-to-Time-of-Use race condition in file.copy operations. This can lead to arbitrary file writes, potentially resulting in local privilege escalation if a...

PT-2022-19301 · Totolink · Totolink N600R

Name of the Vulnerable Software and Affected Versions: TOTOLink N600R version V5.3c.7159 B20190425 Description: A command injection issue was discovered via the langtype parameter in the "/setting/setLanguageCfg" API endpoint. This allows for potential command execution. No information is provide...

PT-2022-19308 · Totolink · Totolink N600R

Name of the Vulnerable Software and Affected Versions: TOTOLink N600R version V5.3c.7159 B20190425 Description: A command injection issue was found via the filename parameter in the "/setting/setUploadSetting" API endpoint. This allows for potential command execution. No information is provided...