PowerCMS XMLRPC API vulnerable to command injection

Overview PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability CWE-74. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. According to the...

PT-2022-23503 · Unknown · Clinic'S Patient Management System

Name of the Vulnerable Software and Affected Versions: Clinic's Patient Management System version 1.0 Description: A SQL injection issue was found in the system, specifically via the id parameter at the "/pms/update patient.php" API endpoint. Recommendations: For Clinic's Patient Management Syste...

PT-2022-8647 · Unknown +1 · Modsecurity +2

Name of the Vulnerable Software and Affected Versions: Modsecurity owasp-modsecurity-crs version 3.2.0 Description: The issue allows attackers to bypass Modsecurity WAF protection using comment characters and variable assignments in SQL syntax, enabling them to implement SQL injection attacks on...

PT-2022-23861 · Unknown · Garage Management System

Name of the Vulnerable Software and Affected Versions: Garage Management System version 1.0 Description: The application manage website.php is vulnerable to Shell File Upload. An already authenticated malicious user can upload a dangerous Remote Code Execution RCE or Local Code Execution LCE...

PT-2022-23599 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: LibreNMS version 22.6.0 Description: A cross-site scripting XSS issue was found in LibreNMS via the component oxidized-cfg-check.inc.php. This allows for potential malicious script execution. Recommendations: For LibreNMS version 22.6.0, as a...

PT-2022-23473 · Wamp · Wamp

Name of the Vulnerable Software and Affected Versions: Wamp versions 3.2.6 and below Description: The issue is related to incorrect access control in the install directory of Wamp, allowing authenticated attackers to execute arbitrary code by overwriting binaries in the directory. Recommendations...

PT-2022-23880 · Unknown · Zlmediakit

Name of the Vulnerable Software and Affected Versions: ZLMediaKit versions below commit 7d8b212a3c3368bc2f6507cb74664fc419eb9327 Description: An attacker can send malicious RTMP requests to make the ZLMediaKit server crash remotely. Recommendations: For versions below commit...

PT-2022-23602 · Unknown · Rpi-Jukebox-Rfid

Name of the Vulnerable Software and Affected Versions: RPi-Jukebox-RFID version 2.3.0 Description: A command injection issue was discovered in the /htdocs/utils/Files.php component. This issue is exploited via a crafted payload injected into the file name of an uploaded file. Recommendations: For...

PT-2022-21923 · Dell Emc · Dell Emc Data Protection Advisor

Name of the Vulnerable Software and Affected Versions: Dell EMC Data Protection Advisor versions 19.6 and earlier Description: The issue is a Stored Cross Site Scripting, where an attacker could potentially exploit this to store malicious HTML or JavaScript codes in a trusted application data...

PT-2022-23854 · Vim · Gvim

Name of the Vulnerable Software and Affected Versions: gvim version 9.0.0000 Description: An issue in the installer of gvim allows authenticated attackers to execute arbitrary code via a binary hijacking attack on C:Program.exe. Recommendations: For gvim version 9.0.0000, consider restricting...

PT-2022-23471 · Unknown · Rubyinstaller2

Name of the Vulnerable Software and Affected Versions: Rubyinstaller2 versions 3.1.2 and below Description: The issue is related to incorrect access control in the install directory of Rubyinstaller2, specifically the C:RailsInstaller directory. This allows authenticated attackers to execute...

PT-2022-23598 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: LibreNMS version 22.6.0 Description: The issue is a cross-site scripting XSS vulnerability. It was discovered in the component print-customoid.php. Recommendations: For LibreNMS version 22.6.0, update to a version that fixes the XSS...

PT-2022-17431 · Npm · @Pendo324/Get-Process-By-Name

Name of the Vulnerable Software and Affected Versions: @pendo324/get-process-by-name versions all Description: The issue is related to Arbitrary Code Execution due to improper sanitization of the getProcessByName function. This allows for potential code execution without proper validation...

PT-2022-24489 · Patlite · Patlite Nh-Fb

Name of the Vulnerable Software and Affected Versions: Patlite NH-FB versions 1.46 and below Description: The issue is related to insufficient firmware validation during the upgrade firmware file upload process. This allows authenticated attackers to create and upload their own custom-built...

PT-2022-4462 · Unknown · Library Management System

Name of the Vulnerable Software and Affected Versions: Library Management System version 1.0 Description: The issue is related to a SQL injection vulnerability in the /librarian/bookdetails.php component of the Library Management System. This vulnerability allows a remote attacker to execute...

PT-2022-23509 · Totolink · Totolink A3000Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3000RU version 4.1.2cu.5185 B20201128 Description: A hardcoded password for the root user was found in the /etc/shadow.sample file. This issue allows unauthorized access to the device. Recommendations: For TOTOLINK A3000RU version...

PT-2022-24571 · Zaver · Zaver

Name of the Vulnerable Software and Affected Versions: Zaver versions through 2020-12-15 Description: The issue allows directory traversal via the GET /.. substring. This can be exploited through the "GET /.. substring" API endpoint. Recommendations: For versions through 2020-12-15, consider...

PT-2022-23403 · Totolink · Totolink N350Rt

Name of the Vulnerable Software and Affected Versions: TOTOLINK N350RT version 9.3.5u.6139 B20201216 Description: A command injection issue was found via the ip parameter in the setDiagnosisCfg function, allowing potential exploitation. Recommendations: For TOTOLINK N350RT version 9.3.5u.6139...

PT-2022-24076 · Tenda · Tenda Ac1206

Name of the Vulnerable Software and Affected Versions: Tenda AC1206 version 15.03.06.23 Description: A stack overflow issue was discovered via the time parameter at the setSmartPowerManagement function. Recommendations: For Tenda AC1206 version 15.03.06.23, consider restricting access to the...

PT-2022-24097 · Tenda · Tenda Ax1803

Name of the Vulnerable Software and Affected Versions: Tenda AX1803 version 1.0.0.1 Description: A stack overflow issue was discovered in the Tenda AX1803, specifically via the timezone parameter in the fromSetSysTime function. Recommendations: For Tenda AX1803 version 1.0.0.1, consider restricti...