CVE-2022-39314 User enumeration in the code-based login and password reset forms

Kirby is a flat-file CMS. In versions prior to 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, Kirby is subject to user enumeration due to Improper Restriction of Excessive Authentication Attempts. This vulnerability affects you only if you are using the code or password-reset auth method with the...

PT-2022-11614 · Stmicroelectronics +2 · Stm32 Mw Usb Host +2

Name of the Vulnerable Software and Affected Versions: stm32 mw usb host versions prior to 3.5.1 Description: A buffer overflow issue allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH MAX NUM ENDPOINTS. This typically occurs when using a RTOS such ...

CVE-2022-27625

A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band OOB Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology...

CVE-2022-27624

A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band OOB Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology...

PT-2022-25192 · Opencrx · Opencrx

Name of the Vulnerable Software and Affected Versions: OpenCRX versions prior to 5.2.2 Description: The issue allows an attacker to determine if a username, email, or ID is valid due to the difference in error messages received during a password reset. This is a result of password enumeration...

PT-2022-25825 · Unknown · Garage Management System

Name of the Vulnerable Software and Affected Versions: Garage Management System version 1.0 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the categoriesName parameter in the "createCategories.php"...

PT-2022-26209 · Unknown · Student Result Management System

Name of the Vulnerable Software and Affected Versions: Best Student Result Management System version 1.0 Description: The issue concerns SQL Injection. It can be exploited via the "/upresult/upresult/notice-details.php?nid=" endpoint, specifically through the nid variable. Recommendations: For Be...

PT-2022-25542 · Ocomon · Ocomon

Name of the Vulnerable Software and Affected Versions: OcoMon version 4.0RC1 Description: The issue is related to Incorrect Access Control. Through a request, a user can obtain the real email, and by sending the same request with the correct email, it is possible to perform an account takeover...

PT-2022-15916 · Netapp · Clustered Data Ontap

Name of the Vulnerable Software and Affected Versions: Clustered Data ONTAP versions 9.11.1 through 9.11.1P2 Description: The issue allows an authenticated remote attacker to arbitrarily modify or delete WORM data prior to the end of the retention period, specifically in configurations with...

PT-2022-24829 · Tuleap +1 · Tuleap +1

Name of the Vulnerable Software and Affected Versions: Tuleap versions 12.9.99.228 through 14.0.99.23 Description: The issue concerns improper verification of authorizations when updating the branch prefix used by the GitLab repository integration. Authenticated users can change the branch prefix...

PT-2022-13870 · Red Hat · 3Scale Api Management 2

Name of the Vulnerable Software and Affected Versions: 3scale API Management 2 Description: The issue arises from inadequate sanitation of user input in multiple fields, allowing an authenticated user to inject scripts. This could potentially lead to access to sensitive information or further...

PT-2022-26909 · Jenkins · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins Custom Checkbox Parameter Plugin versions 1.4 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability, which can be exploited by attackers with Item/Configure permission. This occurs because the...

PT-2022-26716 · Bento4 · Bento4

Name of the Vulnerable Software and Affected Versions: Bento4 version 1.6.0-639 Description: A memory leak issue was discovered in the AP4 DescriptorFactory::CreateDescriptorFromStream function located in Core/Ap4DescriptorFactory.cpp. This issue is demonstrated by the mp42aac tool...

Authentication flaw

An improper restriction of excessive authentication attempts vulnerability CWE-307 in FortiTester Telnet port 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated attacker to guess the credentials of an admin user via a brute force attack...

PT-2022-21777 · Mcafee · Mcafee Epo

Name of the Vulnerable Software and Affected Versions: McAfee ePO versions prior to 5.10 Update 14 Description: The issue allows an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack by exploiting an External XML entity XXE vulnerability. This can be done ...

PT-2022-26260 · Liferay · Liferay Portal

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.3.4 through 7.4.3.36 Description: A cross-site scripting issue exists in the Object module's edit object details page, allowing remote attackers to inject arbitrary web script or HTML via a crafted payload injected...

PT-2022-22967 · Sourcecodester · Sourcecodester Canteen Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Canteen Management System version 1.0 Description: A critical issue has been discovered, affecting the login.php file. The business argument is vulnerable to SQL injection, which can be exploited remotely. Recommendations: For...

PT-2022-26813 · Tenda · Tenda Ac15

Name of the Vulnerable Software and Affected Versions: Tenda AC15 version 15.03.05.18 Description: A stack overflow issue was discovered via the timeZone parameter in the form fast setting wifi set function. Recommendations: For Tenda AC15 version 15.03.05.18, consider restricting access to the...

PT-2022-22968 · Sourcecodester · Sourcecodester Canteen Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Canteen Management System version 1.0 Description: A critical issue affects the processing of the file edituser.php, where the manipulation of the id argument leads to SQL injection. This issue can be initiated remotely...

PT-2022-25610 · Phpok · Phpok

Name of the Vulnerable Software and Affected Versions: Phpok version 6.1 Description: The issue is related to a deserialization vulnerability. It affects the framework/phpok call.php file. Recommendations: For Phpok version 6.1, consider restricting access to the framework/phpok call.php file unt...