PT-2022-2560

Name of the Vulnerable Software and Affected Versions UnRAR versions prior to 6.12 Description The issue allows directory traversal to write to files during an extract operation, as demonstrated by creating a /.ssh/authorized keys file. This can be exploited by remote attackers to execute arbitra...

PT-2022-19089 · Totolink · Totolink A7100Ru

Name of the Vulnerable Software and Affected Versions: TOTOlink A7100RU version 7.4cu.2313 b20191024 Description: A command injection issue is found in the setWiFiSignalCfg interface of the TOTOlink A7100RU router, allowing an attacker to execute arbitrary commands through a carefully constructed...

PT-2022-19084 · Totolink · Totolink A7100Ru

Name of the Vulnerable Software and Affected Versions: TOTOlink A7100RU version 7.4cu.2313 b20191024 Description: A command injection issue is found in the delParentalRules interface of the TOTOlink A7100RU router, allowing an attacker to execute arbitrary commands through a carefully constructed...

PT-2022-14877 · Npm · Libxmljs

Name of the Vulnerable Software and Affected Versions: libxmljs versions all Description: The issue arises when the libxmljs.parseXml function is invoked with a non-buffer argument. In such cases, the V8 code attempts to call the toString method of the argument. If the argument's toString value i...

GHSA-XG75-Q3Q5-CQMV Denial of Service in http-swagger

Impact Allows an attacker to perform a DOS attack consisting of memory exhaustion on the host system. Patches Yes. Please upgrade to v1.2.6. Workarounds A workaround is to restrict the path prefix to the "GET" method. As shown below func main r := mux.NewRouter...

PT-2022-2417 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 5.7.37 and prior MySQL Server versions 8.0.28 and prior Description: The issue exists due to insufficient input validation in the InnoDB component of MySQL Server. Exploitation of this issue may allow a remote attacker t...

PT-2022-2434

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 7u331, 8u321, 11.0.14, 17.0.2, 18 Oracle GraalVM Enterprise Edition versions 20.3.5, 21.3.1, 22.0.0.2 Description The issue is related to insufficient input validation in the Libraries component of Oracle Java SE and...

PT-2022-16915 · Fleetdm +1 · Fleet +1

Name of the Vulnerable Software and Affected Versions: fleetdm/fleet versions prior to 4.13 Description: The issue is an authorization bypass problem that affects all versions of fleetdm/fleet that use the teams feature. Fleet instances without teams or with teams but without restricted team...

PT-2022-16937 · Unknown · Http-Swagger

Name of the Vulnerable Software and Affected Versions: http-swagger versions prior to 1.2.6 Description: The issue allows an attacker to perform a denial of service attack consisting of memory exhaustion on the host system due to improper handling of HTTP methods. This can also lead to other...

PT-2022-18415 · Unknown · Chamilo Lms

Name of the Vulnerable Software and Affected Versions: Chamilo LMS version 1.11.13 Description: The issue is related to a lack of validation on the user modification form, which allows attackers to escalate privileges to Platform Admin. Recommendations: For Chamilo LMS version 1.11.13, update to ...

PT-2022-15288 · Juniper Networks · Juniper Networks Paragon Active Assurance

Name of the Vulnerable Software and Affected Versions: Juniper Networks Paragon Active Assurance version 3.1.0 Description: An issue in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverage a crafted URL to generate PDF reports, potentially...

PT-2022-9209 · Accusoft · Accusoft Imagegear

Name of the Vulnerable Software and Affected Versions: Accusoft ImageGear version 19.10 Description: Two heap-based buffer overflow issues exist in the JPEG-JFIF lossless Huffman image parser functionality. A specially-crafted file can lead to a heap buffer overflow. An attacker can provide a...

PT-2022-12990 · WordPress · Visual Form Builder

Name of the Vulnerable Software and Affected Versions: Visual Form Builder WordPress plugin versions prior to 3.0.6 Description: The issue allows unauthenticated users to see form entries or export them as a CSV file due to a lack of access control on entry form export. This can be done using the...

PT-2022-3435 · Samsung · Galaxy Store

Name of the Vulnerable Software and Affected Versions: Galaxy Store versions prior to 4.5.36.4 Description: The issue is related to improper access control in the Galaxy Store, allowing an attacker to install applications without user interaction. This can be exploited by manipulating the intent...

PT-2022-18237 · Zbzcms · Zbzcms

Name of the Vulnerable Software and Affected Versions: zbzcms version 1.0 Description: The issue is related to incorrect access control at the /admin/run ajax.php endpoint, allowing attackers to add administrator accounts arbitrarily. Recommendations: For zbzcms version 1.0, as a temporary...

PT-2022-18389 · Unknown · Zoo Management System

Name of the Vulnerable Software and Affected Versions: Zoo Management System version 1.0 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability. This is possible through the "/public html/apply vacancy" API...

PT-2022-3642 · Swhkd · Swhkd

Name of the Vulnerable Software and Affected Versions: SWHKD version 1.1.5 Description: The issue is related to unsafe parsing via the -c option, which can lead to an information leak or a denial of service memory exhaustion when attempting to parse large or infinite files, such as block or...

PT-2022-6760 · Adobe · Acrobat Reader

Name of the Vulnerable Software and Affected Versions: Acrobat Reader DC versions 17.012.30205 through 22.001.20085 Acrobat Reader DC versions 20.005.3031x and earlier Description: A use-after-free vulnerability in Adobe Acrobat and Reader could result in arbitrary code execution in the context o...

PT-2022-17024 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions prior to 7055 Description: The issue allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response. Recommendations: For versions...

PT-2022-13461 · WordPress · Amelia

Name of the Vulnerable Software and Affected Versions: Amelia WordPress plugin versions prior to 1.0.48 Description: The issue allows any customer to send paid test SMS notifications and retrieve sensitive information about the admin, such as email, account balance, and payment history. A malicio...