PT-2022-17162

Name of the Vulnerable Software and Affected Versions Money Transfer Management System version 1.0 Description The issue allows an authenticated user to inject SQL queries in the "mtms/admin/?page=transaction/view details" endpoint via the id parameter. Recommendations For Money Transfer Manageme...

CVE-2022-26283

Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the viewplan endpoint. This vulnerability allows attackers to dump the application's database via crafted HTTP requests...

CVE-2022-26283

Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the viewplan endpoint. This vulnerability allows attackers to dump the application's database via crafted HTTP requests...

CVE-2021-45878

Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by incorrect access control. Lack of access control on the web manger pages allows any user to view and modify information...

CVE-2022-1004

Accounted time is shown in the Ticket Detail View External Interface, even if ExternalFrontend::TicketDetailViewAccountedTimeDisplay is disabled...

CVE-2022-1004

Accounted time is shown in the Ticket Detail View External Interface, even if ExternalFrontend::TicketDetailViewAccountedTimeDisplay is disabled...

Code injection

Accounted time is shown in the Ticket Detail View External Interface, even if ExternalFrontend::TicketDetailViewAccountedTimeDisplay is disabled...

CVE-2022-1004

CVE-2022-1004 affects OTRS and concerns an information disclosure where the Billing Time ExternalFrontend::TicketDetailView###AccountedTimeDisplay setting is shown in the Ticket Work Order details view even if the display is disabled. Multiple sources corroborate this, including NVD and CVE recor...

CVE-2022-1004

Accounted time is shown in the Ticket Detail View External Interface, even if ExternalFrontend::TicketDetailViewAccountedTimeDisplay is disabled...

PT-2022-17765 · Unknown · Simple Subscription Website

Name of the Vulnerable Software and Affected Versions: Simple Subscription Website version 1.0 Description: The issue allows attackers to dump the application's database via crafted HTTP requests. This is made possible by a SQL injection vulnerability via the id parameter in the "view plan"...

PT-2022-13585

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned. Description The issue concerns the display of accounted time in the Ticket Detail View, which is part of an external interface. Even when the ExternalFrontend::TicketDetailView setting for...

CVE-2022-1004: Exposure of Sensitive Information to an Unauthorized Actor

Accounted time is shown in the Ticket Detail View External Interface, even if ExternalFrontend::TicketDetailViewAccountedTimeDisplay is disabled...

OESA-2022-1587 mariadb security update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon mariadbd and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs a...

CVE-2022-22598

An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 15.4 and iPadOS 15.4. An app may be able to learn information about the current camera view before being granted camera access...

CVE-2022-22656

An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.6.5, macOS Monterey 12.3, Security Update 2022-003 Catalina. A local attacker may be able to view the previous logged in user’s desktop from the fast user switching screen...

PT-2022-18323

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.156 Description An issue was discovered that allows Local File Inclusion via the custom terms file setting in the app/View/Users/terms.ctp file. Recommendations For versions prior to 2.4.156, update to version 2.4.15...

GHSA-6FG4-36V7-XV32 Stored Cross-site Scripting vulnerability in Jenkins Dashboard View Plugin

Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure views. Dashboard View Plugin 2.18.1 performs URL validation for the...

Stored Cross-site Scripting vulnerability in Jenkins Dashboard View Plugin

Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure views. Dashboard View Plugin 2.18.1 performs URL validation for the...

CVE-2022-27213

Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with View/Configure permission...

CVE-2022-27197

Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure views...