Archive
18 May 2022
Vulnerabilities first published on this day (UTC), newest first.
78 results · Feed
-
High 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
-
Medium 6.3
Missing Cryptographic Step in cassproject
CaSS is a Competency and Skills System. CaSS Library, (npm:cassproject) has a missing cryptographic step when storing cryptographic keys that can allow a server administrator access to an account’s cryptographic keys. This affects CaSS servers using standalon…
-
High 8.2
Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.
-
Medium 6.3
Potential cross-site scripting (XSS) vulnerability in Hydrogen
Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts. There is a potential Cross-Site Scripting (XSS) vulnerability where an arbitrary user is able to execute scripts on pages that are built with Hydrogen. This affects …
-
Unscored —
HTML injection via report name
HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240
-
Unscored —
Open redirect via user-controlled query parameter
Open redirect via user-controlled query parameter. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240
-
Unscored —
Cleartext transmission of sensitive information
Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240
-
Unscored —
Cleartext transmission of sensitive information
Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 29240
-
Unscored —
Sensitive information disclosure due to insecure folder permissions
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 15 (Linux) before build 29240, Acronis Agent (Linux) before build 28037
-
Medium 4.8
IBM DataPower Gateway 10.0.2.0 through 1.0.3.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 is vulner…
-
Unscored —
Tenda TX9 Pro V22.03.02.10 is vulnerable to Buffer Overflow via the functtion setIPv6Status() in httpd module.
-
Medium 4.7
WordPress Code Snippets plugin <= 2.14.3 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting (XSS) vulnerability in Code Snippets plugin <= 2.14.3 at WordPress via &orderby vulnerable parameter.
-
Critical 9.8CVE-2022-30600 Public exploit
Incorrect Calculation in moodle
A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.
-
Unscored —
Due to the use of an insecure algorithm for rolling codes in MCK Smartlock 1.0, allows attackers to unlock the mechanis…
-
Unscored —
The Wingsuit module enables site builders to build UI Patterns (and|or) Twig Components with Storybook and use them wit…
-
Unscored —
A Cross-Site Request Forgery (CSRF) vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attacker…
-
Critical 9.8
SQL injection in moodle
A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.
-
Medium 4.3
Exposure of Sensitive Information in moodle
A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it.
-
Medium 5.3
External Control of Assumed-Immutable Web Parameter in moodle
A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.
-
High 8.8
TIBCO BusinessConnect Trading Community Management Cross-Site Request Forgery Vulnerability
The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to execute Cross-Site Request Forgery (CSRF) on the a…
-
Medium 6.1
TIBCO BusinessConnect Trading Community Management Reflected Cross Site Scripting Vulnerability
The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow an unauthenticated attacker with network access to execute scripts…
-
High 8.0
TIBCO BusinessConnect Trading Community Management Stored Cross Site Scripting Vulnerability
The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains easily exploitable vulnerabilities that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affe…
-
Medium 5.4
Cross-site Scripting in moodle
A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk.
-
Medium 6.8
WordPress Popup Box plugin <= 2.1.2 - Authenticated Local File Inclusion (LFI) vulnerability
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.
-
High 7.3
Windows Unquoted/Trusted Service Paths
SLM has an issue with Windows Unquoted/Trusted Service Paths Security Issue. All installations version 9.x.x prior to 9.20.1 should be patched.
-
Unscored —
Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS…
-
Unscored —
An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive inform…
-
Unscored —
Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS…
-
Unscored —
A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free b…
-
High 7.8
Inkscape Out-of-bounds Write
Inkscape version 0.91 is vulnerable to an out-of-bounds write, which may allow an attacker to arbitrary execute code.
-
Low 3.3
Inkscape Access of Uninitialized Pointer
Inkscape version 0.91 can access an uninitialized pointer, which may allow an attacker to have access to unauthorized information.
-
Low 3.3
Inkscape Out-of-bounds Read
Inkscape 0.91 is vulnerable to an out-of-bounds read, which may allow an attacker to have access to unauthorized information.
-
Medium 5.5
A buffer overflow vulnerability in Lenovo Smart Standby Driver prior to version 4.1.50.0 could allow a local attacker t…
-
High 8.0
A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authen…
-
Medium 6.3
A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to …
-
High 8.8
A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud …
-
Medium 6.8
A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow…
-
Medium 4.3
An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an …
-
High 7.8
A Time of Check Time of Use (TOCTOU) vulnerability was reported in IMController, a software component of Lenovo System …
-
Medium 4.3
A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Contr…