PT-2022-26022 · Forma Lms · Forma Lms

Name of the Vulnerable Software and Affected Versions: Forma LMS versions 3.1.0 and earlier Description: The issue allows an authenticated attacker with the role of student to perform a SQL injection on the 'searchvalue' parameter in the "appLms/ajax.server.php?r=mycertificate/getMyCertificates"...

PT-2022-20892

Name of the Vulnerable Software and Affected Versions Spring Security versions 5.6 prior to 5.6.9 Spring Security versions 5.7 prior to 5.7.5 Description The issue concerns the potential bypass of authorization rules in Spring Security via forward or include dispatcher types. An application is...

PT-2022-5717 · NetGear · Netgear R7000P

Name of the Vulnerable Software and Affected Versions: Netgear R7000P version 1.3.0.8 Description: The issue is related to a buffer overflow error in the Netgear R7000P router's software. This can be exploited by a remote attacker through the openvpn server ip parameter, potentially allowing the...

PT-2022-10762 · Unknown · Semcms Shop

Name of the Vulnerable Software and Affected Versions: SEMCMS SHOP version 1.1 Description: The issue is related to SQL Injection via the Ant Zekou.php file. Recommendations: For SEMCMS SHOP version 1.1, update to a version that fixes the SQL Injection issue in Ant Zekou.php, if available. As a...

PT-2022-10759 · Unknown · Semcms Shop

Name of the Vulnerable Software and Affected Versions: SEMCMS SHOP version 1.1 Description: The issue is related to SQL Injection via the Ant Plist.php file. Recommendations: For SEMCMS SHOP version 1.1, consider restricting access to the Ant Plist.php file as a temporary workaround until a patch...

PT-2022-20167 · Inhand Networks · Inrouter302

Name of the Vulnerable Software and Affected Versions: InHand Networks InRouter302 version 3.5.45 Description: A leftover debug code vulnerability exists in the console infct functionality. This vulnerability can be triggered by a specially-crafted series of network requests, leading to the...

PT-2022-16842 · Haas · Haas Controller

Name of the Vulnerable Software and Affected Versions: Haas Controller version 100.20.000.1110 Description: The issue concerns the "Ethernet Q Commands" service in the Haas Controller, where authentication is currently unsupported. This allows any user on the same network segment as the controlle...

PT-2022-10668 · Unknown · Employee Record Management System

Name of the Vulnerable Software and Affected Versions: Employee Record Management System version 1.2 Description: The issue concerns a Cross Site Scripting XSS vulnerability. It can be exploited via the editempprofile.php endpoint. Recommendations: For Employee Record Management System version 1....

PT-2022-10763 · Unknown · Semcms Shop

Name of the Vulnerable Software and Affected Versions: SEMCMS SHOP version 1.1 Description: The issue affects the Ant Message.php file, allowing for SQL injection. Recommendations: For SEMCMS SHOP version 1.1, consider restricting access to the Ant Message.php file until a patch is available. As ...

PT-2022-26822 · Unknown · Canteen Management System

Name of the Vulnerable Software and Affected Versions: Canteen Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the productId parameter at the "/php action/fetchSelectedfood.php" API endpoint. Recommendations...

PT-2022-10765 · Unknown · Semcms Shop

Name of the Vulnerable Software and Affected Versions: SEMCMS SHOP version 1.1 Description: The issue is related to SQL Injection via the Ant Menu.php file. This allows for potential exploitation. Recommendations: For SEMCMS SHOP version 1.1, consider restricting access to the Ant Menu.php file a...

PT-2022-5350 · Sudo +5 · Sudo +5

Name of the Vulnerable Software and Affected Versions: Sudo versions 1.8.0 through 1.9.12 Description: The issue is related to an array-out-of-bounds error in the plugins/sudoers/auth/passwd.c file of the Sudo program when using the crypt password backend. This error can result in a heap-based...

PT-2022-10761 · Unknown · Semcms Shop

Name of the Vulnerable Software and Affected Versions: SEMCMS SHOP version 1.1 Description: The issue is related to SQL Injection, which can be exploited via the Ant Info.php file. Recommendations: For SEMCMS SHOP version 1.1, consider restricting access to the Ant Info.php file as a temporary...

PT-2022-25996 · Haas · Haas Controller

Name of the Vulnerable Software and Affected Versions: Haas Controller version 100.20.000.1110 Description: The issue concerns the transmission of communication traffic involving the "Ethernet Q Commands" service in cleartext. This allows an attacker to obtain sensitive information being passed t...

PT-2022-23794 · WordPress · Web Stories

Name of the Vulnerable Software and Affected Versions: Web Stories plugin for WordPress versions up to, and including 1.24.0 Description: The issue arises from insufficient validation of URLs supplied via the url parameter in the "/v1/hotlink/proxy" REST API Endpoint. This allows authenticated...

PT-2022-10462 · Unknown · Hospital Management System

Name of the Vulnerable Software and Affected Versions: Hospital Management System version 4.0 Description: The issue concerns a Cross Site Scripting XSS vulnerability. It can be exploited via the /hospital/hms/admin/patient-search.php API endpoint. Recommendations: For Hospital Management System...

SUSE-SU-2022:3793-1 Security update for netty

This update for netty fixes the following issues: - CVE-2020-11612: The ZlibDecoders allow for unbounded memory allocation while decoding a byte stream bsc1168932 - CVE-2021-21290: Information disclosure via the local system temporary directory bsc1182103 - CVE-2021-37136: Bzip2Decoder doesn't...

PT-2022-26004 · Unknown · Diaenergie

Name of the Vulnerable Software and Affected Versions: DIAEnergie versions prior to v1.9.01.002 Description: The issue concerns a stored cross-site scripting vulnerability. This vulnerability can be exploited through the SetPF API. Recommendations: For versions prior to v1.9.01.002, update to...

Google Chrome Security Bypass Vulnerability (CNVD-2022-85089)

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome, which stems from insufficient data validation in Extensions. An attacker could use this vulnerability to bypass security restrictions...

PT-2022-25641 · Unknown · Diaenergie

Name of the Vulnerable Software and Affected Versions: DIAEnergie versions prior to v1.9.01.002 Description: The issue concerns a stored cross-site scripting vulnerability. This vulnerability can be exploited through the "PostEnergyType API" endpoint. Recommendations: For versions prior to...