PT-2022-22535 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC commit 617837b Description: A heap buffer overflow issue was discovered in OTFCC, which can be exploited via the /release-x64/otfccdump+0x6171b2 endpoint. Recommendations: For OTFCC commit 617837b, consider restricting access to the...

Adobe ColdFusion Path Traversal Vulnerability (CNVD-2023-08751)

Adobe ColdFusion is a rapid application development platform from Adobe, which includes an integrated development environment and scripting language. The platform includes an integrated development environment and scripting language.Adobe ColdFusion contains a path traversal vulnerability, which...

PT-2022-22536 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC commit 617837b Description: A heap buffer overflow issue was discovered in OTFCC, which can be exploited via the /release-x64/otfccdump+0x6c0473 endpoint. Recommendations: For OTFCC commit 617837b, consider restricting access to the...

PT-2022-25925 · Unknown · Wedding Planner

Name of the Vulnerable Software and Affected Versions: Wedding Planner version 1.0 Description: The issue is related to an arbitrary file upload vulnerability in the /admin/users add.php component. This allows attackers to execute arbitrary code via a crafted PHP file. Recommendations: For Weddin...

PT-2022-26228 · Unknown · Online Diagnostic Lab Management System

Name of the Vulnerable Software and Affected Versions: Online Diagnostic Lab Management System version 1.0 Description: The issue concerns a remote exploit that bypasses login using SQL injection and then uploads a shell. This allows unauthorized access to the system. Recommendations: For Online...

CVE-2022-35944

October is a self-hosted Content Management System CMS platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin pan...

PT-2022-26653 · Linaro · Lava

Name of the Vulnerable Software and Affected Versions: Linaro Automated Validation Architecture LAVA versions prior to 2022.10 Description: The issue is related to dynamic code execution in lava server/lavatable.py due to improper input sanitization. This allows an anonymous user to force the...

PT-2022-22439 · Sourcecodester · Sourcecodester Human Resource Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Human Resource Management System version 1.0 Description: A problematic issue has been found in the Add Employee Handler component, where the manipulation of the First Name/Middle Name/Last Name argument leads to cross-site...

PT-2022-25885 · Tenda · Tenda Ac1200

Name of the Vulnerable Software and Affected Versions: Tenda AC1200 version US AC6V2.0RTL V15.03.06.51 multi TDE01 Description: A buffer overflow was discovered in the 0x475dc function, allowing attackers to cause a Denial of Service DoS via a crafted request. Recommendations: For Tenda AC1200...

CVE-2022-35944 October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution)

October is a self-hosted Content Management System CMS platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin pan...

PT-2022-21712 · Robustel · Robustel R1510

Name of the Vulnerable Software and Affected Versions: Robustel R1510 version 3.1.16 Description: A command injection issue exists in the js package install functionality, allowing arbitrary command execution via a specially-crafted network request. An attacker can exploit this by sending a...

PT-2022-25888 · Tenda · Tenda Ac1200

Name of the Vulnerable Software and Affected Versions: Tenda AC1200 version US AC6V2.0RTL V15.03.06.51 multi TDE01 Description: A buffer overflow was discovered in the 0x4a12cc function, allowing attackers to cause a Denial of Service DoS via a crafted request. Recommendations: For Tenda AC1200...

PT-2022-22435 · Sourcecodester · Sourcecodester Human Resource Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Human Resource Management System version 1.0 Description: A critical issue was found in the Profile Photo Handler component, where manipulation of the argument parameter leads to os command injection. This issue can be initiate...

CVE-2022-39297

MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. Attackers can deserialize arbitrary data on affected versions of melisplatform/melis-cms, and ultimately leads to the execution of arbitrary PHP code on the...

PT-2022-5201 · Juniper Networks · Junos Evolved

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS Evolved on PTX Series versions prior to 20.4R3-S4-EVO Juniper Networks Junos OS Evolved on PTX Series version 21.1R1-EVO and later versions Juniper Networks Junos OS Evolved on PTX Series version 21.2R1-EVO and later...

CVE-2022-39297 Deserialization of untrusted data in MelisCms

MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. Attackers can deserialize arbitrary data on affected versions of melisplatform/melis-cms, and ultimately leads to the execution of arbitrary PHP code on the...

CVE-2022-20420

In getBackgroundRestrictionExemptionReason of AppRestrictionController.java, there is a possible way to bypass device policy restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not need...

CVE-2022-20420

In getBackgroundRestrictionExemptionReason of AppRestrictionController.java, there is a possible way to bypass device policy restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not need...

CVE-2022-39296

MelisAssetManager provides deliveries of Melis Platform's assets located in every module's public folder. Attackers can read arbitrary files on affected versions of melisplatform/melis-asset-manager, leading to the disclosure of sensitive information. Conducting this attack does not require...

PT-2022-25689 · Autodesk +1 · Autocad +1

Name of the Vulnerable Software and Affected Versions: SAP 3D Visual Enterprise Author version 9 Description: The issue arises due to inadequate memory management. When a manipulated AutoCAD .dwg file from untrusted sources is opened in SAP 3D Visual Enterprise Author, it can trigger Remote Code...