PT-2022-21436 · Rdiffweb · Rdiffweb

Name of the Vulnerable Software and Affected Versions: rdiffweb versions prior to 2.4.8 Description: The issue arises from improper handling of length parameter inconsistency, specifically in the validation of email length. This allows users to insert an email longer than 255 characters. If a use...

PT-2022-25200 · Unknown · Online Tours & Travels Management System

Name of the Vulnerable Software and Affected Versions: Online Tours & Travels Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/admin/update expense.php" API endpoint. Recommendations...

PT-2022-25399 · Unknown · Wedding Planner

Name of the Vulnerable Software and Affected Versions: Wedding Planner version 1.0 Description: A SQL injection issue was found in Wedding Planner via the id parameter at the "/wedding details.php" endpoint. Recommendations: For Wedding Planner version 1.0, consider restricting access to the...

Security Bulletin: Lack of path restriction may allow access to sensitive data stored on Information Server Engine (CVE-2012-4818)

Abstract Security Bulletin: Lack of path restriction may allow access to sensitive data stored on Information Server Engine CVE-2012-4818 Content VULNERABILITY DETAILS: CVE ID: CVE-2012-4818 DESCRIPTION: Whenever an Information Server client application such as InfoSphere DataStage and QualitySta...

Claim can only be created for a recipient once

Lines of code Vulnerability details Claim can only be created for a recipient once The function creating claims, createClaimUnchecked, has the hasNoClaim modifier, that is defined as opposite hasActiveClaim, meaning it reverts if there is an active claim for a user. It reverts if...

PT-2022-14472 · Grandstream · Grandstream Gsd3710

Name of the Vulnerable Software and Affected Versions: Grandstream GSD3710 version 1.0.11.13 Description: The issue allows an attacker with knowledge of user and password to overflow the stack, as it does not check the parameter length before using the strcopy instruction. This could lead to an...

PT-2022-21156 · Unknown · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions prior to 4.6.4 Description: A cleartext storage of sensitive information exists due to an Oauth token being leaked in plaintext in Rocket.Chat logs. Recommendations: For versions prior to 4.6.4, update to version 4.6.4 or...

PT-2022-22563 · Swftools · Swftools

Name of the Vulnerable Software and Affected Versions: SWFTools version 772e55a2 Description: A heap-buffer overflow issue was discovered in SWFTools via the DCTStream::readHuffSymDCTHuffTable function at /xpdf/Stream.cc. This issue affects the specified commit. Recommendations: For SWFTools...

PT-2022-25592 · Tenda · Tenda W20E

Name of the Vulnerable Software and Affected Versions: Tenda W20E router version 15.11.0.6 Description: The issue is a stack overflow vulnerability in the formIPMacBindDel function, which is triggered by the request "/goform/delIpMacBind/". This vulnerability can be exploited, potentially allowin...

PT-2022-25226 · Unknown · Online Banking System

Name of the Vulnerable Software and Affected Versions: Online Banking System version 1.0 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the cust id parameter at the "/net-banking/edit customer action.php" API endpoint. Recommendations: For Online Banki...

The vulnerability in the web interface of the commutable managed distribution power supply PDU (iBoot-PDU), which allows a attacker to write a file to the root web directory.

The vulnerability in the web interface of the commutable managed distribution power unit PDU iBoot-PDU is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to write a file to the root web catalog...

PT-2022-23628 · WordPress · Awesome Ug Torro Forms

Name of the Vulnerable Software and Affected Versions: Awesome UG Torro Forms plugin versions 1.0.16 and earlier Description: The issue is an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with contributor or higher privileges can inject malicious scripts...

Update Firefox and Thunderbird now! Mozilla patches several high risk vulnerabilities

Mozilla has released security updates to address vulnerabilities in Firefox, Firefox ESR, and Thunderbird. An attacker could exploit some of these vulnerabilities to take control of an affected system. In Firefox 105 a total of seven vulnerabilities were patched, three of which received the...

PT-2022-22516 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC commit 617837b Description: A heap buffer overflow issue has been discovered in OTFCC commit 617837b via the /release-x64/otfccdump+0x6adb1e endpoint. Recommendations: For OTFCC commit 617837b, consider restricting access to the...

PT-2022-22511 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC commit 617837b Description: A segmentation violation was discovered in OTFCC via the /release-x64/otfccdump+0x703969 endpoint. Recommendations: For OTFCC commit 617837b, consider restricting access to the /release-x64/otfccdump+0x703969...

PT-2022-25389 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2022 Description: A full path disclosure issue was discovered in ZZCMS 2022. This issue can be exploited via the "/admin/index.PHP? server" API endpoint. Recommendations: For ZZCMS version 2022, consider restricting access to th...

PT-2022-25632 · Unknown · Online Pet Shop We App

Name of the Vulnerable Software and Affected Versions: Online Pet Shop We App version 1.0 Description: The issue is related to SQL injection via the /pet shop/classes/Master.php endpoint, specifically when the f parameter is set to delete sub category and the id variable is used. This allows for...

PT-2022-22503 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC commit 617837b Description: A segmentation violation was discovered in OTFCC commit 617837b via the "/multiarch/memmove-vec-unaligned-erms.S" endpoint. This issue affects the specified commit. Recommendations: For OTFCC commit 617837b,...

PT-2022-6355 · Dell · Dell Geodrive

Name of the Vulnerable Software and Affected Versions: Dell GeoDrive versions prior to 2.2 Description: The issue is related to an uncontrolled DLL search path in the local file system of Dell GeoDrive. Exploitation of this issue could allow an attacker to execute arbitrary code. A low-privilege...

PT-2022-19342 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.3 through 7.4.2 Liferay DXP versions 7.3 before service pack 3 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of...