PT-2022-24424 · Unknown · Logrocket-Oauth2-Example

Name of the Vulnerable Software and Affected Versions: logrocket-oauth2-example versions prior to 2020-05-27 Description: The issue allows SQL injection via the /auth/register API endpoint, specifically through the username parameter. Recommendations: For versions prior to 2020-05-27, as a...

PT-2022-27748 · Unknown · Helmet Store Showroom Site

Name of the Vulnerable Software and Affected Versions: Helmet Store Showroom Site version 1.0 Description: The issue is related to SQL Injection. It can be exploited via the "/hss/admin/categories/view category.php?id=" API endpoint, specifically through the id variable. Recommendations: For Helm...

PT-2022-26878 · Ibm · Aix +2

Name of the Vulnerable Software and Affected Versions: IBM AIX versions 7.1 through 7.3 VIOS version 3.1 Description: The issue allows a non-privileged local user to exploit a vulnerability in the AIX NFS kernel extension to cause a denial of service. Recommendations: For IBM AIX versions 7.1...

PT-2022-27729 · Unknown · Helmet Store Showroom

Name of the Vulnerable Software and Affected Versions: Helmet Store Showroom version 1.0 Description: The issue is related to a SQL Injection vulnerability at the Login Page. This vulnerability can be exploited to bypass admin access. Recommendations: For Helmet Store Showroom version 1.0, consid...

PT-2022-27016 · Unknown · Sicam Pas/Pqs

Name of the Vulnerable Software and Affected Versions: SICAM PAS/PQS versions prior to V7.0 Description: A vulnerability has been identified where the affected software does not properly secure a folder containing library files. This could allow an attacker to place a custom malicious DLL in this...

PT-2022-25779 · Sap · Sap Business Planning/Consolidation +3

Name of the Vulnerable Software and Affected Versions: SAP Business Planning and Consolidation versions SAP BW 750 through 757, DWCORE 200 through 300, CPMBPC 810 Description: The issue concerns the use of a transaction code reserved for the customer in some SAP standard roles. This could allow a...

PT-2022-6269

Name of the Vulnerable Software and Affected Versions Safari versions prior to 16.2 tvOS versions prior to 16.2 macOS Ventura versions prior to 13.1 iOS versions prior to 15.7.2 and 16.1.2 iPadOS versions prior to 15.7.2 Description A type confusion issue was addressed with improved state handlin...

PT-2022-5957 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.14 and earlier Description: The issue exists due to inadequate protection of the web page structure. It may allow a remote attacker to perform cross-site scripting attacks using a specially crafted link i...

PT-2022-16045

Name of the Vulnerable Software and Affected Versions Loofah versions 2.1.0 through 2.19.0 Description The issue concerns a cross-site scripting vulnerability via the image/svg+xml media type in data URIs. This vulnerability affects Loofah, a library for manipulating and transforming HTML/XML...

CVE-2022-43515

Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitive data will be prevented from being...

CVE-2022-43515 X-Forwarded-For header is active by default causes access to Zabbix sites in maintenance mode

Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitive data will be prevented from being...

CVE-2022-43515

CVE-2022-43515 affects Zabbix Frontend by bypassing the IP allowlist that gates access during maintenance. An attacker can reach the frontend from an IP outside the configured range, potentially enabling data exposure. Public sources in the connected documents map this to Zabbix maintenance acces...

user's funds lock and incorrect code behavior because users withdrawal amount won't get reset for all users in each userPeriodLength in WithdrawHook contract

Lines of code Vulnerability details Impact according to the comments in code: "Every time userPeriodLength seconds passes, the amount withdrawn for all users will be reset to 0" . but in current implementation only one of the users userToAmountWithdrawnThisPeriod value gets reset and this will...

PT-2022-27086 · Sourcecodester · Sourcecodester Canteen Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Canteen Management System affected versions not specified Description: A critical vulnerability was found in the SourceCodester Canteen Management System, affecting the file ajax represent.php. The manipulation of the customer ...

PT-2022-27460 · Funkwhale · Funkwhale

Name of the Vulnerable Software and Affected Versions: Funkwhale version 1.2.8 Description: The issue concerns user invites that do not permanently expire after being used for signup. These invites can be used again even after an account associated with the invite has been deleted. Recommendation...

PT-2022-19869 · Western Digital · Western Digital My Cloud

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud versions prior to 5.25.124 on Linux. Description: The issue is related to an Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices. This could allow a...

CVE-2022-46158

PrestaShop (open-source e-commerce platform) is affected by CVE-2022-46158 due to insufficient restriction of host filesystem access, allowing potential viewing of the upload directory contents. The issue affects versions prior to 1.7.8.8. The advised remediation is upgrading to PrestaShop 1.7.8....

PT-2022-36161 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.80 Description: A potential memory leak issue exists in the register pcpu function. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v3.6 and is fixe...

PT-2022-35961 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.10 Description: The issue is related to an overflow check in the sgx validate offset length function. It was introduced in version v5.11 and fixed in version v6.0.10. The actual impact and attack plausibili...

PT-2022-36001 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.10 Description: The issue concerns error handling in the ata tlink add function. It was introduced in version v2.6.37 and fixed in version v6.0.10. The actual impact and attack plausibility have not yet bee...