Archive
25 May 2022
Vulnerabilities first published on this day (UTC), newest first.
15 results · Clear filters · Feed
-
Medium 6.5
Possible vulnerability at 'npm install' time in sharp if an attacker has control over build environment
sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at `npm install` time when installing versions of `sharp` prior to the latest v0.30.5. If an attacker has the ability to…
-
Medium 4.9
An information disclosure vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation S…
-
Medium —
XSS in various backend modules due to (un)escaping in JS notification module
The notification module displaying flash messages unscapes HTML coming from the server, resulting in XSS vulnerabilities with various names and labels of entities (eg. workspace title or media title). This however means you must be a logged in user with respe…
-
Medium —
`CHECK` failure in depthwise ops via overflows
### Impact The implementation of depthwise ops in TensorFlow is vulnerable to a denial of service via `CHECK`-failure (assertion failure) caused by overflowing the number of elements in a tensor: ```python import tensorflow as tf input = tf.constant(1, shape=…
-
Medium 6.8
TP-Link TL-WR840N EU v6.20 was discovered to contain insecure protections for its UART console. This vulnerability allo…
-
Medium 4.7
WordPress Advanced Contact form 7 DB plugin <= 1.8.7 - Unauthenticated Persistent Cross-Site Scripting (XSS) vulnerability
Persistent Cross-Site Scripting (XSS) vulnerability in Vsourz Digital's Advanced Contact form 7 DB plugin <= 1.8.7 at WordPress.
-
Medium 6.8
HCL BigFix Mobile / Modern Client Management is vulnerable to sensitive information exposure
User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.
-
Medium 6.5
A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel exe…
-
Medium 4.3
Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aemobile component can crash the scanning engine. The exploit can be triggered remotely by an attacker.
-
Medium 5.9
An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can l…
-
Medium 6.8
Rancher: Weave CNI password is not set if RKE template is used with CNI value overridden
A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change network data due to missing encryption of data transmitted via the network when a cluster is created from an RKE templa…
-
Medium 5.3CVE-2022-1815 Scanner template
Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.
-
Medium 6.5
Apache Archiva Arbitrary user password reset vulnerability
In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8
-
Medium 5.4
Cross-site Scripting in ZKEACMS
A cross-site scripting (XSS) vulnerability in /navigation/create?ParentID=%23 of ZKEACMS v3.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ParentID parameter.
-
Medium 5.3
MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occur…