PT-2022-24331 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinal CMS version 5.1.0 Description: The issue allows for SQL Injection via the "/admin/folderrollpicture/list" API endpoint. Recommendations: For JFinal CMS version 5.1.0, update to a newer version that contains a fix for this issue. At the...

PT-2022-23360 · Lester 'Gamerz' Chan · Wp-Postratings

Name of the Vulnerable Software and Affected Versions: Lester 'GaMerZ' Chan WP-PostRatings plugin version 1.89 and earlier Description: The issue is related to a race condition that allows rating increase or decrease in the WP-PostRatings plugin. Recommendations: For Lester 'GaMerZ' Chan...

PT-2022-24329 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinal CMS version 5.1.0 Description: The issue allows for SQL Injection via the "/admin/contact/list" API endpoint. Recommendations: For JFinal CMS version 5.1.0, update to a newer version that contains a fix for this issue...

PT-2022-23669 · Google · Android

Name of the Vulnerable Software and Affected Versions: Group Sharing versions prior to 13.0.6.15 Description: The issue is related to improper access control in Group Sharing, allowing attackers to access device information. This affects devices running Android S12 and earlier versions, with...

PT-2022-19497 · Appwrite · Appwrite

Name of the Vulnerable Software and Affected Versions: appwrite versions prior to 1.0.0-RC1 Description: The issue is related to stored Cross-site Scripting XSS in the appwrite repository. This type of attack occurs when an application stores user input data without proper validation, allowing an...

PT-2022-24326 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinal CMS version 5.1.0 Description: The issue allows for SQL Injection via the "/admin/article/list" API endpoint. Recommendations: For JFinal CMS version 5.1.0, update to a newer version that contains a fix for this issue...

PT-2022-24339 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinal CMS version 5.1.0 Description: The issue allows for SQL Injection via the "/system/department/list" API endpoint. Recommendations: For JFinal CMS version 5.1.0, update to a newer version that contains a fix for this issue...

SUSE-SU-2022:3198-1 Security update for php8-pear

This update for php8-pear fixes the following issues: - Add php8-pear to SLE15-SP4 jscSLE-24728 - Update to 1.10.21 - PEAR 1.10.13 unsupported protocol - use --force to continue Add $this operator to determineIfPowerpc calls - Update to 1.10.20 - ArchiveTar 1.4.14 Properly fix symbolic link path...

PT-2022-23183 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.10.5 XWiki Platform versions prior to 14.2 Description: The issue allows user accounts to be created even when user registration is disabled by passing a template of the distribution wizard to the xpart...

PT-2022-24317 · Unknown · Tastyigniter

Name of the Vulnerable Software and Affected Versions: TastyIgniter version 3.5.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload, which is a result of a cross-site scripting XSS vulnerability. This means an attacker can inject malicious...

PT-2022-23184 · Xwiki · Xwiki +1

Name of the Vulnerable Software and Affected Versions: XWiki Platform Web Parent POM versions 1.0 through 13.10.5 XWiki Platform Web Parent POM versions 14.0-rc-1 through 14.3 Description: The issue allows storing JavaScript that will be executed by anyone viewing the history of an attachment...

PT-2022-23817 · Securonix +1 · Securonix Snypr +1

Name of the Vulnerable Software and Affected Versions: Securonix Snypr versions prior to 6.4 Jun 2022 R3 Description: An injection vulnerability in the syslog-ng configuration wizard allows an application user with the "Manage Ingesters" permission to execute arbitrary code on remote ingesters by...

CVE-2022-31020 Remote code execution in Indy's NODE_UPGRADE transaction

Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the pool-upgrade request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The pool-upgrade request...

PT-2022-20055 · Fortinet · Fortisoar

Name of the Vulnerable Software and Affected Versions: Fortinet FortiSOAR versions prior to 7.2.1 Description: The issue is related to improper privilege management, allowing a GUI user who has already found a way to modify system files to execute arbitrary Python commands as root. Recommendation...

PT-2022-16604 · Ecwid · Ecwid Ecommerce Shopping Cart

Name of the Vulnerable Software and Affected Versions: Ecwid Ecommerce Shopping Cart plugin for WordPress versions up to, and including, 6.10.23 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the ecwid update plugin params function...

PT-2022-21726 · WordPress · Wpdevelop/Oplugins Booking Calendar

Name of the Vulnerable Software and Affected Versions: WPdevelop/Oplugins Booking Calendar plugin versions prior to 9.2.1 Description: A Cross-Site Request Forgery CSRF issue exists, allowing unauthorized actions related to Translations Update. Recommendations: For WPdevelop/Oplugins Booking...

PT-2022-19364 · Chatwoot · Chatwoot

Name of the Vulnerable Software and Affected Versions: chatwoot/chatwoot versions prior to 2.8 Description: The issue is related to improper authorization in the GitHub repository chatwoot/chatwoot. Recommendations: For versions prior to 2.8, update to version 2.8 or later to resolve the issue...

PT-2022-23130 · Unknown · Reactphp Http

Name of the Vulnerable Software and Affected Versions: ReactPHP HTTP versions 0.7.0 through 1.7.0 Description: The issue arises when ReactPHP's HTTP server component processes incoming HTTP cookie values, url-decoding the cookie names. This can lead to confusion between cookies with prefixes like...

PT-2022-23148 · Discourse · Discourse-Chat

Name of the Vulnerable Software and Affected Versions: Discourse-Chat versions prior to 0.9 Description: The issue affects users of Discourse Chat, an asynchronous messaging plugin for the Discourse open-source discussion platform. Admin users can insert HTML into chat titles and descriptions,...

PT-2022-18245 · Unknown · Rosariosis Student Information System +1

Name of the Vulnerable Software and Affected Versions: rosariosis versions prior to 10.0 RosarioSIS Student Information System versions prior to 10.1 Description: The issue is related to improper handling of length parameter inconsistency in the GitHub repository francoisjacquet/rosariosis...