Archive
13 January 2022
Vulnerabilities first published on this day (UTC), newest first.
158 results · Feed
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer. User inte…
-
Medium 4.3
User can bypass approval when invited to Discourse
Discourse is an open source discussion platform. Versions prior to 2.7.13 in `stable`, 2.8.0.beta11 in `beta`, and 2.8.0.beta11 in `tests-passed` allow some users to log in to a community before they should be able to do so. A user invited via email to a foru…
-
Low 3.3
Adobe InDesign JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability
Adobe InDesign version 16.4 (and earlier) is affected by a use-after-free vulnerability in the processing of a JPEG2000 file that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. E…
-
High 7.8
Adobe InDesign JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe InDesign version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a m…
-
High 7.8
Adobe InDesign JPEG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe InDesign version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a m…
-
High 7.8
Adobe InCopy TIF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Adobe InCopy version 16.4 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code i…
-
High 7.8
Adobe InCopy JPEG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe InCopy version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a mal…
-
High 7.8
Adobe InCopy JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe InCopy version 16.4 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a mal…
-
Low 3.3
Adobe InCopy JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability
Adobe InCopy version 16.4 (and earlier) is affected by a use-after-free vulnerability in the processing of a JPEG2000 file that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exp…
-
Medium 5.4
WordPress PHP Everywhere Plugin <= 2.0.2 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Alexander Fuchs PHP Everywhere plugin <= 2.0.2 versions.
-
High 7.7
Insecure file and directory permissions on EdgeRover
File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more difficult for an authenticated attacker to now traverse through the files and directories. This can only be exploited once a…
-
High 7.8
Limited authentication bypass vulnerability on Western Digital My Cloud devices
A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting ru…
-
High 7.8
Command injection through unsecured HTTP calls on Western Digital My Cloud devices
A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP call. Addressed this vulnerability by disabling checks for internet connectivity using HTTP.
-
Critical 9.8
Pre-authenticated stack overflow vulnerability on FTP Service
My Cloud OS 5 was vulnerable to a pre-authenticated stack overflow vulnerability on the FTP service that could be exploited by unauthenticated attackers on the network. Addressed the vulnerability by adding defenses against stack overflow issues.
-
High 8.0
Adobe Experience Manager Stored XSS in the Spin Set
AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be ex…
-
High 8.1
Adobe Experience Manager Stored XSS in workflow Stages parameter
AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be ex…
-
High 8.0
Adobe Experience Manager Stored XSS on Edit Tag page via Localization input
AEM's Cloud Service offering, as well as versions 6.5.7.0 (and below), 6.4.8.3 (and below) and 6.3.3.8 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerabl…
-
High 8.1
Adobe Experience Manager Stored XSS in user name parameter in the package manager
AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be ex…
-
Critical 9.8
AEM Forms Improper Restriction of XML External Entity Reference
AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.
-
High 8.1
Adobe Experience Manager Stored XSS in the Carousel Set
AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be ex…
-
Medium 5.4
Adobe Experience Manager Reflected XSS in /bin/wcm/contentfinder/page/view.html
AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a reflected Cross-Site Scripting (XSS) vulnerability via the itemResourceType parameter. If an attacker is able to convince a victim to visit a URL referencing a vulnerable …
-
Medium 6.5
Adobe Experience Manager Unicode normalization leads to dispatcher bypass
AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a dispatcher bypass vulnerability that could be abused to evade security controls. Sensitive areas of the web application may be exposed through exploitation of the vulnerab…
-
Unscored —
Some Dahua products have access control vulnerability in the password reset process. Attackers can exploit this vulnera…
-
Unscored —
jpress v4.2.0 is vulnerable to command execution via io.jpress.web.admin._AddonController::doUploadAndInstall.
-
Unscored —CVE-2021-45422 Scanner template
Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability in the /goform/activate_proc…
-
Unscored —
The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the gf_list_del function in list.c, which allows att…
-
Medium 6.5
The IBM i 7.1, 7.2, 7.3, and 7.4 Extended Dynamic Remote SQL server (EDRSQL) could allow a remote authenticated user to…
-
Unscored —
A cross-site scripting (XSS) vulnerability in the "Zip content" feature in Element-IT HTTP Commander 3.1.9 allows remot…
-
Medium 4.3
User's bio visible even if profile is restricted in Discourse
Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and version 2.7.13 in the `stable` branch, the bios of users who made their profiles private were still vis…
-
Medium 4.8
Halo CMS - Stored Cross-Site Scripting (XSS) in Article's Tag
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin attacker can inject arbitrary javascript code that will execute on a victim’s server.
-
Medium 5.4
Halo CMS - Stored Cross-Site Scripting (XSS) in Profile Image
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s browser.