PT-2022-26003 · WordPress · Contest Gallery Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Contest Gallery WordPress plugin versions prior to 19.1.5.1 Contest Gallery Pro WordPress plugin versions prior to 19.1.5.1 Description: The issue allows malicious users with at least author privilege to leak sensitive information from the...

PT-2022-25975 · WordPress · Contest Gallery Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Contest Gallery WordPress plugin versions prior to 19.1.5.1 Contest Gallery Pro WordPress plugin versions prior to 19.1.5.1 Description: The issue allows malicious users with at least author privilege to leak sensitive information from the...

PT-2022-23918 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.6 and earlier Description: The issue allows for XSS via a malicious capability to the metrics or help module. This can be demonstrated by a URI such as "/!!&app=io.ox/files&cap=". Recommendations: For versions 7.10....

PT-2022-25938 · WordPress · Contest Gallery Pro +1

Name of the Vulnerable Software and Affected Versions: Contest Gallery WordPress plugin versions prior to 19.1.5.1 Contest Gallery Pro WordPress plugin versions prior to 19.1.5.1 Description: The issue arises from the failure to escape the user id POST parameter before it is concatenated to an SQ...

PT-2022-25926 · WordPress · Contest Gallery Pro

Name of the Vulnerable Software and Affected Versions: Contest Gallery Pro WordPress plugin versions prior to 19.1.5 Description: The issue allows malicious users with administrator privileges to potentially leak sensitive information from the site's database. This is due to the failure to escape...

PT-2022-25906 · WordPress · Contest Gallery Pro +1

Name of the Vulnerable Software and Affected Versions: Contest Gallery WordPress plugin versions prior to 19.1.5 Contest Gallery Pro WordPress plugin versions prior to 19.1.5 Description: The issue allows malicious users with at least author privilege to leak sensitive information from the site's...

PT-2022-27203 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: Snipe-IT versions prior to 6.0.14 Description: The issue is related to Cross Site Scripting XSS for View Assigned Assets. This means an attacker could potentially inject malicious scripts into the website, which would then be executed by the...

Restrict access to Storefront via Gateway based on Login Username

This article will describe how to configure responder policy to restrict access to storefront via gateway based on login username, and also explain the difference between expression "AAA.USER.LOGINNAME" and "AAA.LOGIN.USERNAME"...

PT-2022-27675 · Unknown · Planet Estream

Name of the Vulnerable Software and Affected Versions: Planet eStream versions prior to 6.72.10.07 Description: The issue allows unauthenticated upload of arbitrary files, which can lead to remote code execution. This can be achieved through "Choose a Video / Related Media or Upload Document" or ...

PT-2022-28049 · Unknown · Asrashley Dash-Live

Name of the Vulnerable Software and Affected Versions: asrashley dash-live affected versions not specified Description: A problematic vulnerability was found in the function ready of the file static/js/media.js of the component DOM Node Handler. This issue leads to cross-site scripting and can be...

PT-2022-27078 · Microsoft · Mssql

Name of the Vulnerable Software and Affected Versions: Simmeth Lieferantenmanager versions prior to 5.6 Description: An issue was discovered that allows an attacker to inject raw SQL queries. By activating MSSQL features, the attacker can execute arbitrary commands on the MSSQL server via the xp...

CVE-2022-46175

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand e.g. for config files. The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named proto, allowing specially crafted strings t...

PT-2022-28040 · Unknown · Sourcecodester Sanitization Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Sanitization Management System version 1.0 Description: A critical vulnerability was found in the Admin Login component, where the manipulation of the username and password arguments leads to SQL injection. The attack can be...

PT-2022-9021 · Modern Tribe · Modern Tribe Panel Builder Plugin

Name of the Vulnerable Software and Affected Versions: Modern Tribe Panel Builder Plugin affected versions not specified Description: A critical vulnerability has been found in the Modern Tribe Panel Builder Plugin, affecting the add post content filtered to search sql function of the...

PT-2022-27252 · Rocket.Chat · Rocket.Chat-Desktop

Name of the Vulnerable Software and Affected Versions: Rocket.Chat-Desktop versions prior to 3.8.14 Description: A command injection issue exists that could allow an attacker to pass a malicious URL to shell.openExternal, potentially leading to remote code execution. This is because the...

PT-2022-28001 · Unknown · Usememos/Memos

Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.0 Description: The issue is related to stored Cross-site Scripting XSS in the usememos/memos GitHub repository. This repository is for an open-source, self-hosted memo hub that includes knowledge managemen...

PT-2022-27631 · Ip Com · Ip-Com M50

Name of the Vulnerable Software and Affected Versions: IP-COM M50 version 15.11.0.3310768 Description: A buffer overflow issue was discovered via the rules parameter in the formIPMacBindAdd function. This issue affects the specified version of the IP-COM M50 device. Recommendations: For IP-COM M5...

PT-2022-27932 · D Link · D-Link Dir-846

Name of the Vulnerable Software and Affected Versions: D-Link DIR-846 version A1 FW100A43 Description: A command injection issue was discovered via the lan0 dhcps staticlist parameter in the SetIpMacBindSettings function. This allows for potential command injection attacks. Recommendations: For...

PT-2022-27993 · Fortinet · Fortigate

Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.0 Description: The issue is related to improper access control in the usememos/memos GitHub repository. There have been real-world incidents where this issue was exploited, including a leak of data from ov...

PT-2022-27635 · Ip Com · Ip-Com M50

Name of the Vulnerable Software and Affected Versions: IP-COM M50 version 15.11.0.3310768 Description: A buffer overflow issue was discovered, which can be triggered via the picName parameter in the formDelWewifiPic function. Recommendations: For IP-COM M50 version 15.11.0.3310768, consider...