Archive
13 May 2022
Vulnerabilities first published on this day (UTC), newest first.
88 results · Feed
-
Medium 6.5
Path Traversal in OpenClinica
OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). OpenClinica prior to version 3.16 is vulnerable to path traversal in multiple endpoints, leading to arbitrary file read/write, and potential remote co…
-
Medium 4.0
Prototype Pollution
This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing the set function located in js/set.js. **Note:** This vulnerability derives from an incomplete fix to [CVE-2020-7618](…
-
High 7.5
Prototype Pollution
This affects the package convict before 6.2.3. This is a bypass of [CVE-2022-22143](https://security.snyk.io/vuln/SNYK-JS-CONVICT-2340604). The [fix](https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880) introduced, relies o…
-
High 8.1
Command Injection
The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranch(remote: string, remoteBranch: string, cwd: string) function, both the remote and remoteBranch parameters are passed to…
-
Unscored —
SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource …
-
Unscored —
A buffer overflow vulnerability in the SonicWall SSL-VPN NetExtender Windows Client (32 and 64 bit) in 10.2.322 and ear…
-
Unscored —
SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions accept a user-controlled input that specifi…
-
Unscored —
SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions uses a shared and hard-coded encryption key…
-
Critical 9.8
Account Takeover in neorazorx/facturascripts
Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.07.
-
Low 3.1
IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.5 , with the adminCenter-1.0 feature configured, could…
-
Medium 5.1
IBM MQ (IBM MQ for HPE NonStop 8.1.0) can inadvertently disclose sensitive information under certain circumstances to a…
-
Medium 4.1
https://patchstack.com/database/vulnerability/nd-donations/wordpress-donations-plugin-1-8-authenticated-stored-cross-site-scripting-xss-vulnerability
Authenticated (contributor or higher role) Cross-Site Scripting (XSS) vulnerability in Donations plugin <= 1.8 on WordPress.
-
High 8.2
mySCADA myPRO Improper Access Control
mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive system information.
-
High 7.5
mySCADA myPRO Unrestricted Upload of File with Dangerous Type
mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to the file system.
-
High 7.5
mySCADA myPRO Path Traversal
mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to arbitrary directories.
-
High 7.5
mySCADA myPRO Exposure of Information Through Directory Listing
mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive directory listing information.
-
Unscored —
The DFX module has a UAF vulnerability.Successful exploitation of this vulnerability may affect system stability.
-
Unscored —
Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/admin/?page=individuals/view_indi…
-
Unscored —
The HiAIserver has a vulnerability in verifying the validity of the weight used in the model.Successful exploitation of…
-
Unscored —
The frame scheduling module has a null pointer dereference vulnerability. Successful exploitation of this vulnerability…
-
Unscored —
The frame scheduling module has a Use After Free (UAF) vulnerability.Successful exploitation of this vulnerability will…
-
Unscored —
There is a configuration defect in the activation lock of mobile phones.Successful exploitation of this vulnerability m…
-
Unscored —
The chip component has a vulnerability of disclosing CPU SNs.Successful exploitation of this vulnerability may affect d…
-
Unscored —
Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/admin/individuals/update_status.p…
-
Unscored —
The HiAIserver has a vulnerability in verifying the validity of the weight used in the model.Successful exploitation of…
-
Unscored —
The graphics acceleration service has a vulnerability in multi-thread access to the database.Successful exploitation of…
-
Unscored —
The HiAIserver has a vulnerability in verifying the validity of the properties used in the model.Successful exploitatio…
-
Unscored —
The HiAIserver has a vulnerability in verifying the validity of the weight used in the model.Successful exploitation of…
-
Unscored —
The kernel module has a UAF vulnerability.Successful exploitation of this vulnerability will affect data integrity and …
-
Unscored —
Configuration defects in the secure OS module. Successful exploitation of this vulnerability can affect availability.
-
Unscored —
Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/classes/Master.php?f=delete_appli…
-
Unscored —
Third-party pop-up window coverage vulnerability in the iConnect module.Successful exploitation of this vulnerability m…
-
Unscored —
The AMS module has a vulnerability of improper permission control.Successful exploitation of this vulnerability may cau…
-
Unscored —
The audio module has a vulnerability in verifying the parameters passed by the application space.Successful exploitatio…
-
Unscored —
The Property module has a vulnerability in permission control.This vulnerability can be exploited to obtain the unique …
-
Unscored —
Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/admin/?page=applications/view_app…
-
Unscored —
Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/admin/applications/update_status.…
-
Unscored —
Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via ctpms/admin/?page=user/manage_user&id=.
-
Unscored —
Covid-19 Travel Pass Management System v1.0 is vulnerable to file deletion via /ctpms/classes/Master.php?f=delete_img.
-
Unscored —
Pharmacy Sales And Inventory System v1.0 is vulnerable to SQL Injection via /pharmacy-sales-and-inventory-system/manage…