PT-2022-27594 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6V1.0 version 15.03.05.19 Description: A buffer overflow issue was discovered via the startIp parameter in the formSetPPTPServer function. This allows for potential exploitation. Recommendations: For Tenda AC6V1.0 version 15.03.05.19,...

PT-2022-27195 · Tenda · Tenda I21

Name of the Vulnerable Software and Affected Versions: Tenda i21 version 1.0.0.144656 Description: The issue is related to a Buffer Overflow that can be triggered via the /goform/setSnmpInfo API endpoint. This allows for potential exploitation. Recommendations: For Tenda i21 version 1.0.0.144656,...

PT-2022-26304 · WordPress · Chained Quiz

Name of the Vulnerable Software and Affected Versions: Chained Quiz plugin for WordPress versions up to, and including, 1.3.2.4 Description: The issue is related to Cross-Site Request Forgery due to missing nonce validation on the manage function. This allows unauthenticated attackers to delete...

PT-2022-27196 · Tenda · Tenda I21

Name of the Vulnerable Software and Affected Versions: Tenda i21 version 1.0.0.144656 Description: The issue is a stack overflow vulnerability. It can be exploited via the /goform/setSysPwd API endpoint. Recommendations: For Tenda i21 version 1.0.0.144656, as a temporary workaround, consider...

PT-2022-27584 · Tenda · Tenda Ac6V1.0

Name of the Vulnerable Software and Affected Versions: Tenda AC6V1.0 version 15.03.05.19 Description: A buffer overflow issue was discovered via the deviceId parameter in the addWifiMacFilter function. This issue can be exploited, potentially leading to unintended consequences. Recommendations: F...

PT-2022-27583 · Tenda · Tenda Ac6V1.0

Name of the Vulnerable Software and Affected Versions: Tenda AC6V1.0 version 15.03.05.19 Description: The issue is related to a Buffer Overflow that can be triggered via the formSetMacFilterCfg. Recommendations: For Tenda AC6V1.0 version 15.03.05.19, consider restricting access to the...

CVE-2022-2969

Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 uses an external input to construct a pathname intended to identify a file or directory located underneath a restricted parent directory. However, the software does not properly neutralize special elements within the pathname,...

PT-2022-23805 · Sophos · Sophos Firewall

Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 19.5 GA Description: A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard. Recommendations: For Sophos Firewall versions prior to 19.5 GA, update to...

PT-2022-10836 · Ibm · Ibm Api Connect

Name of the Vulnerable Software and Affected Versions: IBM API Connect versions 10.0.0.0 through 10.0.5.0 IBM API Connect versions 10.0.1.0 through 10.0.1.7 IBM API Connect versions 2018.4.1.0 through 2018.4.1.19 Description: The issue is caused by improper validation of input by the HOST headers...

PT-2022-27765 · Unknown +3 · Cap'N Proto'S Rust Implementation +4

Name of the Vulnerable Software and Affected Versions: Cap'n Proto versions prior to 0.7.1, 0.8.1, 0.9.2, and 0.10.3 Cap'n Proto's Rust implementation versions prior to 0.13.7, 0.14.11, and 0.15.2 Description: Cap'n Proto is a data interchange format and remote procedure call RPC system. The issu...

PT-2022-27123

Name of the Vulnerable Software and Affected Versions Simple Inventory Management System version 1.0 Description The issue concerns SQL Injection via the /ims/login.php endpoint. This allows for potential unauthorized access to database information. Recommendations For Simple Inventory Management...

PT-2022-27173 · Unknown · Sanitization Management System

Name of the Vulnerable Software and Affected Versions: Sanitization Management System version 1.0 Description: The issue concerns a SQL Injection vulnerability. It can be exploited via the "/php-sms/admin/quotes/manage remark.php?id=" endpoint. The estimated number of potentially affected devices...

PT-2022-27172 · Unknown · Sanitization Management System

Name of the Vulnerable Software and Affected Versions: Sanitization Management System version 1.0 Description: The issue is related to SQL Injection. It can be exploited via the "/php-sms/admin/orders/assign team.php?id=" endpoint. The id variable is vulnerable to this type of attack...

PT-2022-27171 · Unknown · Sanitization Management System

Name of the Vulnerable Software and Affected Versions: Sanitization Management System version 1.0 Description: The issue is related to SQL Injection, which can be exploited via the "/php-sms/admin/?page=services/manage service&id=" endpoint. The id variable is vulnerable to this type of attack...

CVE-2022-4186

CVE-2022-4186 affects Google Chrome/Chromium, describing insufficient validation of untrusted input in Downloads. Prior to 108.0.5359.71, an attacker who convinces a user to install a malicious extension could bypass Download restrictions via a crafted HTML page. The CVE is labeled Medium severit...

PT-2022-27087 · Russound · Russound Xsourceplayer 777D

Name of the Vulnerable Software and Affected Versions: Russound XSourcePlayer 777D version 06.08.03 Description: The issue is related to a remote code execution vulnerability via the scriptRunner.cgi component. Recommendations: For Russound XSourcePlayer 777D version 06.08.03, consider disabling...

PT-2022-24627 · WordPress · Wp-Affiliate-Platform

Name of the Vulnerable Software and Affected Versions: WP Affiliate Platform plugin for WordPress versions up to, and including, 6.3.9 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers...

Access Restriction Bypass

kubeview is vulnerable to access restriction bypass. The vulnerability exists in default function of api.js, because api/scrape/kube-system does not require authentication which allows an attacker to bypass the restrictions and retrieve certificate files that can be used to authenticate as...

PT-2022-27443 · Unknown · Web-Based Student Clearance System

Name of the Vulnerable Software and Affected Versions: Web-Based Student Clearance System version 1.0 Description: The Web-Based Student Clearance System contains a cross-site scripting XSS issue in the /Admin/add-student.php endpoint. This allows attackers to execute arbitrary web scripts or HTM...

PT-2022-27211 · Unknown · Purchase Order Management System

Name of the Vulnerable Software and Affected Versions: Purchase Order Management System version 1.0 Description: The issue concerns a file upload vulnerability. It can be exploited via the /purchase order/admin/?page=system info API endpoint. Recommendations: For Purchase Order Management System...