Archive
16 May 2022
Vulnerabilities first published on this day (UTC), newest first.
101 results · Feed
-
Unscored —
A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager version(s)…
-
Unscored —
A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.1…
-
Unscored —
A remote authenticated server-side request forgery (ssrf) vulnerability was discovered in Aruba ClearPass Policy Manage…
-
Unscored —
A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.1…
-
Unscored —
A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.1…
-
Unscored —
A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.1…
-
Unscored —
A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.1…
-
Unscored —
A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.1…
-
Unscored —
A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.1…
-
Unscored —
A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and be…
-
Unscored —
A remote reflected cross site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s)…
-
Unscored —
A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and be…
-
Unscored —
A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and be…
-
Unscored —
Metasonic Doc WebClient 7.0.14.0 / 7.0.12.0 / 7.0.3.0 is vulnerable to a SQL injection attack in the username field. SS…
-
Medium 5.6
xArrow SCADA Path Traversal
xArrow SCADA versions 7.2 and prior permits unvalidated registry keys to be run with application-level privileges.
-
Medium 6.1
xArrow SCADA Cross-site Scripting
xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘edate’ of the resource xhisalarm.htm, which may allow an unauthorized attacker to execute arbitrary code.
-
Medium 6.1
xArrow SCADA Cross-site Scripting
xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘bdate’ of the resource xhisvalue.htm, which may allow an unauthorized attacker to execute arbitrary code.
-
Unscored —
Local privilege escalation due to insecure folder permissions
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before build 3640
-
Unscored —
Local privilege escalation due to a DLL hijacking vulnerability
Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 3640
-
Unscored —
Local privilege escalation due to excessive permissions assigned to child processes
Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Snap Deploy (Windows) before build 3640
-
Critical 10.0
Weintek EasyWeb cMT Code Injection
The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on the operation system.
-
Critical 9.8
Weintek EasyWeb cMT Improper Access Control
The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator.
-
Critical 9.4
Weintek EasyWeb cMT Cross-site Scripting
The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious JavaScript code.
-
High 7.6
Improper Control of Dynamically-Managed Code Resources in Crafter Studio
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods.
-
Medium 4.3
Improper Output Neutralization for Logs in Crafter Studio
An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator.
-
Low 3.5
Improper Privilege Management in Crafter Studio
A logged-in and authenticated user with a Reviewer Role may lock a content item.
-
Medium 5.5
Apache Tika Regular Expression Denial of Service in Standards Extractor
In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractin…
-
Medium 5.5
Apache Tika BPGParser Memory Usage DoS
The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
-
Unscored —
Prime95 30.7 build 9 suffers from a Buffer Overflow vulnerability that could lead to Remote Code Execution.
-
Unscored —
Gnuboard 5.55 and 5.56 is vulnerable to Cross Site Scripting (XSS) via bbs/member_confirm.php.
-
Critical 9.8
Improper Input Validation in IpMatcher
An Input Validation Vulnerability exists in Joel Christner .NET C# packages WatsonWebserver, IpMatcher 1.0.4.1 and below (IpMatcher) and 4.1.3 and below (WatsonWebserver) due to insufficient validation of input IP addresses and netmasks against the internal M…
-
Medium 6.8
Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in wenzhixin/bootstrap-table
Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties.
-
High 7.6
Allowing long password leads to denial of service in polonel/trudesk in polonel/trudesk
Allowing long password leads to denial of service in polonel/trudesk in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.
-
Unscored —
Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Privilege Escala…
-
High 7.2
The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in polonel/trudesk
The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in GitHub repository polonel/trudesk prior to 1.2.2. This can …
-
Medium 5.5
Reflected XSS on ticket filter function in polonel/trudesk
Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capable of executing a malicious javascript code in web page
-
High 8.8
JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead…
-
High 8.8
Leaking password protected articles content due to improper access control in publify/publify
Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vulnerability to view the contents of any password-protected article present on the publify website, co…
-
High 7.5CVE-2022-1713 Scanner template
SSRF on /proxy in jgraph/drawio
SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information.
-
Medium 5.3
Code Injection in publify/publify
Code Injection in GitHub repository publify/publify prior to 9.2.8.