PT-2022-22914 · Fork Cms · Fork Cms

Name of the Vulnerable Software and Affected Versions: ForkCMS version 5.9.3 Description: A cross-site scripting XSS issue allows remote attackers to inject JavaScript via the end date Parameter. This issue was patched in version 5.11.0, which implies that versions prior to 5.11.0 are affected...

PT-2022-18575 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 1.3.1 Description: The issue is related to Cross-site Scripting XSS - Stored. In the GitHub repository microweber/microweber, the title parameter in the body of a POST request when creating or editing a...

PT-2022-4221 · Intel · Intel E810 Ethernet Controllers

Name of the Vulnerable Software and Affected Versions: IntelR E810 Ethernet Controllers versions prior to 1.6.1.9 Description: The issue is related to improper access control in the firmware of some IntelR E810 Ethernet Controllers. This may allow a privileged user to potentially enable denial of...

PT-2022-16476 · WordPress · Better Tag Cloud

Name of the Vulnerable Software and Affected Versions: Better Tag Cloud WordPress plugin versions prior to 0.99.6 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is disallowed, for example in a...

PT-2022-16360 · WordPress · Weforms

Name of the Vulnerable Software and Affected Versions: weForms WordPress plugin versions prior to 1.6.14 Description: The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and escape its...

PT-2022-16220 · WordPress · Yaysmtp

Name of the Vulnerable Software and Affected Versions: YaySMTP WordPress plugin versions prior to 2.2.1 Description: The issue concerns a lack of proper authorization when saving settings, allowing users with a low role, such as a subscriber, to modify them. This can be exploited to conduct a...

PT-2022-15636 · WordPress · Website File Changes Monitor

Name of the Vulnerable Software and Affected Versions: Website File Changes Monitor WordPress plugin versions prior to 1.8.3 Description: The issue arises from the plugin's failure to sanitise and escape user input before using it in a SQL statement. This occurs via an action available to users...

PT-2022-16067 · WordPress · Easy Username Updater

Name of the Vulnerable Software and Affected Versions: Easy Username Updater WordPress plugin versions prior to 1.0.5 Description: The issue is related to the lack of CSRF checks in the Easy Username Updater WordPress plugin. This could allow attackers to make a logged-in admin change any user's...

PT-2022-4440 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore versions prior to 10.5.4 Description: The issue is related to a stored Cross-site Scripting XSS in the pimcore/pimcore GitHub repository. This occurs due to inadequate protection of the web page structure, allowing a remote attacker t...

PostgreSQL JDBC Driver SQL Injection in ResultSet.refreshRow() with malicious column names

Impact What kind of vulnerability is it? Who is impacted? The PGJDBC implementation of the java.sql.ResultRow.refreshRow method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. ;, could lead to SQL injection. This could lead to...

PT-2022-23643 · Samsung · Samsung Checkout

Name of the Vulnerable Software and Affected Versions: Samsung Checkout versions prior to 5.0.53.1 Description: The issue allows attackers to access IAP information via SQL injection vulnerability in the IAPService of Samsung Checkout. Recommendations: For versions prior to 5.0.53.1, update to...

PT-2022-23290 · Storeapps · Storeapps Affiliate For Woocommerce

Name of the Vulnerable Software and Affected Versions: StoreApps Affiliate For WooCommerce premium plugin versions = 4.7.0 Description: The issue allows an attacker to change the PayPal email due to an authenticated IDOR vulnerability. This can be exploited when the WooCommerce PayPal Payments...

PT-2022-23635 · Samsung · Samsung Notes

Name of the Vulnerable Software and Affected Versions: Samsung Notes versions prior to 4.3.14.39 Description: The issue is related to a path traversal vulnerability in the UriFileUtils component of Samsung Notes. This vulnerability allows an attacker to access certain files with the permissions o...

SUSE-SU-2022:2671-1 Security update for go1.17

This update for go1.17 fixes the following issues: Update to go version 1.17.13 bsc1190649: - CVE-2022-32189: encoding/gob, math/big: decoding big.Float and big.Rat can panic bsc1202035. - CVE-2022-30635: encoding/gob: stack exhaustion in Decoder.Decode bsc1201444. - CVE-2022-30631: compress/gzip...

CVE-2022-35925 Missing rate limit in Authentication in bookwyrm

BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force attacks. This issue has been patched in version 0.4.5. Admins with existing instances will need to update their nginx.conf file that was...

PT-2022-23714 · Ipswitch · Ws Ftp Server

Name of the Vulnerable Software and Affected Versions: In Progress WS FTP Server versions prior to 8.7.3 Description: The issue concerns forms within the administrative interface that did not include a nonce, which is used to mitigate the risk of cross-site request forgery CSRF attacks. CSRF...

CVE-2022-31173 Juniper is vulnerable to @DOS GraphQL Nested Fragments overflow

Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program crash. This issue has been addressed in version 0.15.10. Users are advised to upgrade. Users unable to upgrade should limit the recursion depth manually...

PT-2022-16200 · WordPress · Yaysmtp

Name of the Vulnerable Software and Affected Versions: YaySMTP WordPress plugin versions prior to 2.2.1 Description: The issue allows any logged-in users, such as subscribers, to view the logs of the plugin due to a lack of capability check in an AJAX action. Recommendations: For YaySMTP WordPres...

PT-2022-13961 · Unknown +1 · Krakend-Ce +2

Name of the Vulnerable Software and Affected Versions: Lura versions prior to 2.0.2 KrakenD-CE versions prior to 2.0.2 KrakenD-EE versions prior to 2.0.0 Description: The issue arises from incorrect sanitization of URL parameters, allowing malicious users to alter the backend URL defined for a pi...

PT-2022-20569 · Sourcegraph · Sourcegraph

Name of the Vulnerable Software and Affected Versions: Sourcegraph versions prior to 3.42 Description: The issue allows an authenticated Sourcegraph user to edit Code Monitors owned by any other Sourcegraph user, including editing the trigger and action of the monitor. However, an attacker cannot...