PT-2022-17608 · WordPress · Better Search Replace

Name of the Vulnerable Software and Affected Versions: Better Search Replace WordPress plugin versions prior to 1.4.1 Description: The issue concerns the improper sanitization and escaping of table data before it is inserted into a SQL query. This could allow high privilege users to perform SQL...

PT-2022-17339

Name of the Vulnerable Software and Affected Versions Duplicator WordPress plugin versions prior to 1.4.7 Description The issue allows unauthenticated visitors to access the main installer endpoint of the plugin and download the full site backup without authentication, if the installer script has...

PT-2022-14199 · WordPress · Rezgo Online Booking

Name of the Vulnerable Software and Affected Versions: Rezgo Online Booking WordPress plugin versions prior to 4.1.8 Description: The issue is related to a Reflected Cross-Site Scripting problem. This occurs because some parameters are not properly sanitised and escaped before being outputted bac...

PT-2022-17611 · WordPress · Advanced Custom Fields Pro

Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields WordPress plugin versions prior to 5.12.3 Advanced Custom Fields Pro WordPress plugin versions prior to 5.12.3 Description: The issue allows unauthenticated users to upload files, limited to those allowed in a default...

PT-2022-22633 · Unknown · Ecommerce-Codeigniter-Bootstrap

Name of the Vulnerable Software and Affected Versions: Ecommerce-CodeIgniter-Bootstrap versions before commit 56465f Description: A cross-site scripting XSS issue was found in the function base url at the /blog/blogpublish.php endpoint. This allows for potential exploitation. Recommendations: For...

Vulnerability fixed in Yokogawa Centum controller FCS products

Yokogawa has fixed a vulnerability in Centum controller FCS products. A malicious party could potentially exploit it to cause a denial-of-service. To exploit the vulnerability, the malicious party needs access to the production infrastructure. It is good practice not to have such infrastructure...

PT-2022-22485 · Pngdec · Pngdec

Name of the Vulnerable Software and Affected Versions: PNGDec version prior to the version that includes commit 8abf6be Description: A stack overflow issue was discovered in PNGDec. The issue is related to the /linux/main.cpp file. Recommendations: For versions prior to the version that includes...

PT-2022-20183 · Tibco Software · Tibco Statistica Trial +3

Name of the Vulnerable Software and Affected Versions: TIBCO Data Science - Workbench versions 14.0.0 and below TIBCO Statistica versions 14.0.0 and below TIBCO Statistica - Estore Edition versions 14.0.0 and below TIBCO Statistica Trial versions 14.0.0 and below Description: The Web Console...

PT-2022-23076 · Minetest +2 · Minetest +2

Name of the Vulnerable Software and Affected Versions: Minetest versions prior to 5.6.1 Description: The issue concerns a security vulnerability in Minetest, a free open-source voxel game engine, where a mod in single-player mode can set a global setting to control the Lua script loaded for the...

PT-2022-22914 · Fork Cms · Fork Cms

Name of the Vulnerable Software and Affected Versions: ForkCMS version 5.9.3 Description: A cross-site scripting XSS issue allows remote attackers to inject JavaScript via the end date Parameter. This issue was patched in version 5.11.0, which implies that versions prior to 5.11.0 are affected...

PT-2022-22911 · Fork Cms · Fork Cms

Name of the Vulnerable Software and Affected Versions: ForkCMS versions prior to 5.11.0 Description: A stored cross-site scripting XSS issue allows remote attackers to inject JavaScript via the start date Parameter. This issue was patched in version 5.11.0. Recommendations: For ForkCMS versions...

PT-2022-18575 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 1.3.1 Description: The issue is related to Cross-site Scripting XSS - Stored. In the GitHub repository microweber/microweber, the title parameter in the body of a POST request when creating or editing a...

PT-2022-4221 · Intel · Intel E810 Ethernet Controllers

Name of the Vulnerable Software and Affected Versions: IntelR E810 Ethernet Controllers versions prior to 1.6.1.9 Description: The issue is related to improper access control in the firmware of some IntelR E810 Ethernet Controllers. This may allow a privileged user to potentially enable denial of...

PT-2022-16067

Name of the Vulnerable Software and Affected Versions Easy Username Updater WordPress plugin versions prior to 1.0.5 Description The issue is related to the lack of CSRF checks in the Easy Username Updater WordPress plugin. This could allow attackers to make a logged-in admin change any user's...

PT-2022-16360 · WordPress · Weforms

Name of the Vulnerable Software and Affected Versions: weForms WordPress plugin versions prior to 1.6.14 Description: The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and escape its...

PT-2022-16220 · WordPress · Yaysmtp

Name of the Vulnerable Software and Affected Versions: YaySMTP WordPress plugin versions prior to 2.2.1 Description: The issue concerns a lack of proper authorization when saving settings, allowing users with a low role, such as a subscriber, to modify them. This can be exploited to conduct a...

PT-2022-16476 · WordPress · Better Tag Cloud

Name of the Vulnerable Software and Affected Versions: Better Tag Cloud WordPress plugin versions prior to 0.99.6 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is disallowed, for example in a...

PT-2022-15636 · WordPress · Website File Changes Monitor

Name of the Vulnerable Software and Affected Versions: Website File Changes Monitor WordPress plugin versions prior to 1.8.3 Description: The issue arises from the plugin's failure to sanitise and escape user input before using it in a SQL statement. This occurs via an action available to users...

PT-2022-4440 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore versions prior to 10.5.4 Description: The issue is related to a stored Cross-site Scripting XSS in the pimcore/pimcore GitHub repository. This occurs due to inadequate protection of the web page structure, allowing a remote attacker t...

PostgreSQL JDBC Driver SQL Injection in ResultSet.refreshRow() with malicious column names

Impact What kind of vulnerability is it? Who is impacted? The PGJDBC implementation of the java.sql.ResultRow.refreshRow method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. ;, could lead to SQL injection. This could lead to...