Archive
25 May 2022
Vulnerabilities first published on this day (UTC), newest first.
62 results · Feed
-
Critical —
Malware in ctx
The `ctx` hosted project on [PyPI](https://pypi.org/project/ctx/) was taken over via user account compromise and replaced with a malicious project which contained runtime code that collected the content of `os.environ.items()` when instantiating `Ctx` objects…
-
High 7.5
Potential secrets being logged to disk in CVE Services
CVEProject/cve-services is an open source project used to operate the CVE services API. A conditional in 'data.js' has potential for production secrets to be written to disk. The affected method writes the generated randomKey to disk if the environment is not…
-
High 8.7
Possible cross-site scripting attack via unsanitized SVG files in FoF Upload
FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files ('image/svg+xml'), navigating directly to an SVG file URI could execute…
-
Medium 6.5
Possible vulnerability at 'npm install' time in sharp if an attacker has control over build environment
sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at `npm install` time when installing versions of `sharp` prior to the latest v0.30.5. If an attacker has the ability to…
-
High 7.4
Cross-site Scripting in the Flamingo theme manager
XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possible cross-site scripting vector is present in the `FlamingoThemesCode.WebHomeSheet` wiki page relate…
-
High 7.4
Cross-site Scripting in XWiki Platform Wiki UI Main Wiki
XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-milestone-2, XWiki Platform Wiki UI Main Wiki contains a possible cross-site scripting vector in the `WikiManager.JoinWiki ` wiki page related to the "requestJoin" …
-
Low 2.7
Path Traversal in XWiki Platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with version 8.3-rc-1 and prior to versions 12.10.3 and 14.0, one can ask for any file located in the classloader using the template API and a pa…
-
Unscored —
MariaDB Server before 10.7 is vulnerable to Denial of Service. While executing the plugin/server_audit/server_audit.c m…
-
High 7.5
An information disclosure vulnerability exists in the OAS Engine SecureBrowseFile functionality of Open Automation Soft…
-
Critical 9.4
An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform …
-
High 7.5
An external config control vulnerability exists in the OAS Engine SecureAddUser functionality of Open Automation Softwa…
-
Critical 9.1CVE-2022-26082 EPSS 20%
A file write vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS P…
-
High 7.5
A cleartext transmission of sensitive information vulnerability exists in the OAS Engine configuration communications f…
-
Medium 4.9
An information disclosure vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation S…
-
High 7.5
An external config control vulnerability exists in the OAS Engine SecureAddSecurity functionality of Open Automation So…
-
High 7.5
A denial of service vulnerability exists in the OAS Engine SecureConfigValues functionality of Open Automation Software…
-
Unscored —
In libjpeg before 1.64, BitStream<false>::Get in bitstream.hpp has an assertion failure that may cause denial of servic…
-
Medium —
XSS in various backend modules due to (un)escaping in JS notification module
The notification module displaying flash messages unscapes HTML coming from the server, resulting in XSS vulnerabilities with various names and labels of entities (eg. workspace title or media title). This however means you must be a logged in user with respe…
-
Medium —
`CHECK` failure in depthwise ops via overflows
### Impact The implementation of depthwise ops in TensorFlow is vulnerable to a denial of service via `CHECK`-failure (assertion failure) caused by overflowing the number of elements in a tensor: ```python import tensorflow as tf input = tf.constant(1, shape=…
-
Medium 6.8
TP-Link TL-WR840N EU v6.20 was discovered to contain insecure protections for its UART console. This vulnerability allo…
-
Unscored —
The Apigee Edge module allows connecting a Drupal site to Apigee X / Edge in order to build a developer portal. The dev…
-
Unscored —
Entity Browser Block provides a Block Plugin for every Entity Browser on your site. The module didn't sufficiently chec…
-
Unscored —
The Drupal Embed module provides a filter to allow embedding various embeddable items like entities in content fields. …
-
Medium 4.7
WordPress Advanced Contact form 7 DB plugin <= 1.8.7 - Unauthenticated Persistent Cross-Site Scripting (XSS) vulnerability
Persistent Cross-Site Scripting (XSS) vulnerability in Vsourz Digital's Advanced Contact form 7 DB plugin <= 1.8.7 at WordPress.
-
Unscored —
TrueStack Direct Connect 1.4.7 has Incorrect Access Control.
-
Unscored —
Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to s…
-
Unscored —
Docker Desktop 4.3.0 has Incorrect Access Control.
-
High 7.5
Path traversal in ginadmin
In ginadmin through 05-10-2022 the incoming path value is not filtered, resulting in directory traversal.
-
High 7.5
Arbitrary file read in ginadmin
In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading.
-
Medium 6.8
HCL BigFix Mobile / Modern Client Management is vulnerable to sensitive information exposure
User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.
-
Critical 9.1
A Security Misconfiguration vulnerability affects HCL VersionVault Express
VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with the server.
-
Medium 6.5
A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel exe…
-
Medium 4.3
Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aemobile component can crash the scanning engine. The exploit can be triggered remotely by an attacker.
-
Medium 5.9
An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can l…
-
Unscored —
Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers …
-
Unscored —
Nokia Broadcast Message Center through 11.1.0 allows an authenticated user to perform a Boolean Blind SQL Injection att…
-
High 8.2
Baker Hughes Bently Nevada 3500 - Use of Password Hash with Insufficient Computational Effort
The affected Baker Hughes Bentley Nevada products (3500 System 1 6.x, Part No. 3060/00 versions 6.98 and prior, 3500 System 1, Part No. 3071/xx & 3072/xx versions 21.1 HF1 and prior, 3500 Rack Configuration, Part No. 129133-01 versions 6.4 and prior, and 3500…
-
Critical 9.3
LCDS LAquis SCADA - Cross-site Scripting
When a non-existent resource is requested, the LCDS LAquis SCADA application (version 4.3.1.1011 and prior) returns error messages which may allow reflected cross-site scripting.
-
Low 3.7
Philips Interoperability Solution XDS - Clear Text Transmission of Sensitive Information
Philips Interoperability Solution XDS versions 2.5 through 3.11 and 2018-1 through 2021-1 are vulnerable to clear text transmission of sensitive information when configured to use LDAP via TLS and where the domain controller returns LDAP referrals, which may …
-
Unscored —CVE-2022-29380 Public exploit
Academy-LMS v4.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the SEO panel.