PT-2022-12936 · Unknown · Goanywhere Mft

Name of the Vulnerable Software and Affected Versions: GoAnywhere MFT versions prior to 6.8.3 Description: A path traversal issue exists that could allow an external user who self-registers with specific username and/or profile information to access files at a higher directory level than intended...

PT-2022-4024 · Jenkins · Jenkins Coverity Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Coverity Plugin versions 1.11.4 and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturing credentials stor...

PT-2022-3952 · Unknown · Ossn Open Source Social Network

Name of the Vulnerable Software and Affected Versions: Open Source Social Network version 6.3 LTS Description: The issue is related to an arbitrary file upload vulnerability in the /ossn/administrator/com installer component. This vulnerability allows attackers to execute arbitrary code via a...

PT-2022-5004 · Hitachi Energy · Hitachi Energy Msm

Name of the Vulnerable Software and Affected Versions: Hitachi Energy MSM versions V2.2 and prior Description: A vulnerability exists in the HTTP web interface where it does not validate data in an HTTP header, leading to a possible HTTP response splitting. This could allow an attacker to channel...

PT-2022-8903 · Js-Ini · Js-Ini

Name of the Vulnerable Software and Affected Versions: js-ini versions prior to 1.3.0 Description: The issue arises when an attacker submits a malicious INI file to an application that uses the parse function to parse it. This can lead to prototype pollution on the application, which can be furth...

PT-2022-22210 · Wavlink · Wavlink Wifi-Repeater Rpta2-77W

Name of the Vulnerable Software and Affected Versions: Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 Description: An access control issue allows attackers to obtain system key information and execute arbitrary commands by accessing the page "syslog.shtml". Recommendations: For Wavlink...

PT-2022-22011 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: Dataease version 1.11.1 Description: An issue in the component "/api/plugin/upload" of Dataease allows attackers to execute arbitrary code via a crafted plugin. Recommendations: For Dataease version 1.11.1, update to version 1.11.2 to resolve...

PT-2022-22013 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase version 1.11.1 Description: The issue is related to a SQL injection vulnerability. It occurs via the parameter dataSourceId. There is no information about the estimated number of potentially affected devices worldwide or real-world...

PT-2022-5232

Name of the Vulnerable Software and Affected Versions SQLite versions 1.0.12 through 3.39.x before 3.39.2 Description The issue is related to an array-bounds overflow in the SQLite API library, which can be triggered by a remote attacker using a long sequence of string data processed by the print...

PT-2022-19152

Name of the Vulnerable Software and Affected Versions YIKES Inc. Custom Product Tabs for WooCommerce plugin version 1.7.7 and earlier Description The issue is related to a Broken Access Control vulnerability, which allows for the update of the yikes-the-content-toggle option. This vulnerability...

PT-2022-21523 · Apple · Apple Macos +1

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 11.6.8 macOS versions prior to 12.5 Description: An out-of-bounds read issue was addressed with improved input validation. Processing a maliciously crafted AppleScript binary may result in unexpected termination or...

PT-2022-18401 · Shanghai Feixun Data Communication Technology Co. · Fir302B

Name of the Vulnerable Software and Affected Versions: Shanghai Feixun Data Communication Technology Co., Ltd router fir302b version A2 Description: The issue is related to a remote command execution vulnerability via the Ping function. This allows for potential unauthorized access and control...

PT-2022-3739 · Oracle · Mysql Cluster

Name of the Vulnerable Software and Affected Versions: MySQL Cluster versions 8.0.29 and prior Description: The issue is related to insufficient input validation in the MySQL Cluster product, which can be exploited by a remote attacker to cause a denial of service. This can result in the ability ...

PT-2022-22197 · Digital Watchdog · Dw Megapix Ip Cameras

Name of the Vulnerable Software and Affected Versions: Digital Watchdog DW MEGApix IP cameras version A7.2.2 20211029 Description: A command injection issue was found in the /admin/vca/bia/addacph.cgi component. This issue can be exploited through a crafted POST request. Recommendations: For...

PT-2022-16353 · Puppet · Puppet Bolt

Name of the Vulnerable Software and Affected Versions: Puppet Bolt versions prior to 3.24.0 Description: The issue allows sensitive parameters to be printed when planning a run, potentially resulting in them being logged when executed programmatically, such as through Puppet Enterprise...

PT-2022-16649 · WordPress · Feed Them Social

Name of the Vulnerable Software and Affected Versions: Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress versions up to, and including 2.9.8.5 Description: The issue allows deserialization of untrusted input via the fts url parameter. This enables unauthenticated attacker...

PT-2022-14189 · WordPress · Button Widget Smartsoft

Name of the Vulnerable Software and Affected Versions: The Button Widget Smartsoft plugin for WordPress versions up to, and including, 1.0.1 Description: The issue is due to missing nonce validation on the smartsoftbutton settings page, making it possible for unauthenticated attackers to update t...

PT-2022-14857 · WordPress · Woocommerce

Name of the Vulnerable Software and Affected Versions: WooCommerce WordPress plugin versions prior to 6.6.0 Description: The issue is related to stored HTML injection due to a lack of escaping and sanitizing in the payment gateway titles. This allows for potential malicious code injection...

PT-2022-8002 · Itech · Tech Dating Script

Name of the Vulnerable Software and Affected Versions: Itech Dating Script version 3.26 Description: A critical issue was found in the file /see more details.php, where the manipulation of the id argument leads to sql injection. The attack can be launched remotely. The exploit has been disclosed ...

PT-2022-22984 · Inductive Automation · Inductive Automation Ignition

Name of the Vulnerable Software and Affected Versions: Inductive Automation Ignition version 8.1.15 b2022030114 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a...