PT-2022-14726 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to a possible out of bounds read in the decrypt 1 2 function of CryptoPlugin.cpp due to a missing bounds check. This could lead to local information disclosure without requiring...

PT-2022-27755 · Aerocms · Aerocms

Name of the Vulnerable Software and Affected Versions: AeroCms version 0.0.1 Description: The issue is related to an arbitrary file upload vulnerability. This vulnerability is located at the "/admin/posts.php?source=edit post" API endpoint, which allows uploading a webshell and potentially...

PT-2022-14805 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to an integer overflow in the sec media protect function of media.c, which could lead to a local escalation of privilege in secure mode MFC Core. No additional execution privileges are needed,...

CVE-2022-47210

The default console presented to users over telnet when enabled is restricted to a subset of commands. Commands issued at this console, however, appear to be fed directly into a system call or other similar function. This allows any authenticated user to execute arbitrary commands on the device...

PT-2022-10042 · Unknown · Sourcecodester Online Grading System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Online Grading System version 1.0 Description: A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the uname parameter. Recommendations: For Sourcecodester Online Grading System version 1.0,...

PT-2022-23265 · Emby · Emby Server

Name of the Vulnerable Software and Affected Versions: Emby Server version 4.6.7.0 Description: The issue affects the playlist name field, which is vulnerable to stored XSS. This vulnerability allows for the potential theft of the administrator access token, enabling attackers to either flip or...

CVE-2022-20518

In query of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-224770203...

PT-2022-14789 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a possible out of bounds write due to improper input validation in the ppmp unprotect mfcfw buf function of drm fw.c. This could lead to local escalation of privilege in S-EL1 with System...

PT-2022-26196 · Unknown · Contiki-Ng

Name of the Vulnerable Software and Affected Versions: Contiki-NG versions prior to 4.9 Description: The Contiki-NG operating system for IoT devices contains a Bluetooth Low Energy stack that is vulnerable to a NULL Pointer Dereference in the BLE L2CAP module. An attacker can inject a packet into...

Apple Mac OS X Security Update (HT213532)

Apple Mac OS X is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Privilege Escalation

libnet-server-perl is vulnerable to privilege escalation. The vulnerability exists because the library does not check if the hostname resolves to the source IP address, allowing an attacker to bypass ACL restrictions via the hostname parameter when the reverse-lookups option is enabled...

PT-2022-10914 · Unknown · 188Jianzhan

Name of the Vulnerable Software and Affected Versions: 188Jianzhan version 2.10 Description: A cross-site scripting issue allows attackers to execute arbitrary code via the username parameter to the "/admin/reg.php" API endpoint. Recommendations: For 188Jianzhan version 2.10, consider disabling t...

PT-2022-27404 · Unknown · Rainygao Docsys

Name of the Vulnerable Software and Affected Versions: RainyGao DocSys affected versions not specified Description: A critical issue has been found in RainyGao DocSys, affecting an unknown functionality of the component com.DocSystem.controller.UserControllergetUserImg. The manipulation leads to...

Alist 路径遍历漏洞

Alist is a file listing program with multi-storage support from the individual developer Xhofe in China. A security vulnerability exists in Alist version v3.4.0, which can be exploited by attackers to bypass the base path restriction...

CVE-2022-46255

An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. A check was added within Pages to ensure the working directory is clean before unpacking new content to prevent an arbitrary file overwrite...

PT-2022-24424 · Unknown · Logrocket-Oauth2-Example

Name of the Vulnerable Software and Affected Versions: logrocket-oauth2-example versions prior to 2020-05-27 Description: The issue allows SQL injection via the /auth/register API endpoint, specifically through the username parameter. Recommendations: For versions prior to 2020-05-27, as a...

PT-2022-27748 · Unknown · Helmet Store Showroom Site

Name of the Vulnerable Software and Affected Versions: Helmet Store Showroom Site version 1.0 Description: The issue is related to SQL Injection. It can be exploited via the "/hss/admin/categories/view category.php?id=" API endpoint, specifically through the id variable. Recommendations: For Helm...

PT-2022-26878 · Ibm · Aix +2

Name of the Vulnerable Software and Affected Versions: IBM AIX versions 7.1 through 7.3 VIOS version 3.1 Description: The issue allows a non-privileged local user to exploit a vulnerability in the AIX NFS kernel extension to cause a denial of service. Recommendations: For IBM AIX versions 7.1...

PT-2022-27729 · Unknown · Helmet Store Showroom

Name of the Vulnerable Software and Affected Versions: Helmet Store Showroom version 1.0 Description: The issue is related to a SQL Injection vulnerability at the Login Page. This vulnerability can be exploited to bypass admin access. Recommendations: For Helmet Store Showroom version 1.0, consid...

PT-2022-5957 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.14 and earlier Description: The issue exists due to inadequate protection of the web page structure. It may allow a remote attacker to perform cross-site scripting attacks using a specially crafted link i...