Archive
25 May 2022
Vulnerabilities first published on this day (UTC), newest first.
62 results · Feed
-
Unscored —
Nginx NJS v0.7.3 was discovered to contain a stack overflow in the function njs_default_module_loader at /src/njs/src/n…
-
Unscored —
Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the Search parameter at /o…
-
Unscored —
An arbitrary file upload vulnerability in the Select Image function of Online Food Ordering System v1.0 allows attacker…
-
Unscored —
radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols.c binary symbol pa…
-
High 7.5
Buffer over-flow in Pillow
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.
-
High 8.6
HashiCorp go-getter unsafe downloads could lead to asymmetric resource exhaustion
go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.
-
Unscored —
go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and co…
-
Unscored —
go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP respons…
-
Unscored —
go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files. Fixed in 1.6.1 and 2.1.0.
-
Unscored —
In Archibus Web Central before 26.2, multiple SQL Injection vulnerabilities occur in dwr/call/plaincall/workflow.runWor…
-
Critical 9.6CVE-2022-1883 Scanner template
SQL Injection in camptocamp/terraboard
SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0.
-
Medium 6.8
Rancher: Weave CNI password is not set if RKE template is used with CNI value overridden
A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change network data due to missing encryption of data transmitted via the network when a cluster is created from an RKE templa…
-
Medium 5.3CVE-2022-1815 Scanner template
Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.
-
Medium 6.5
Apache Archiva Arbitrary user password reset vulnerability
In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8
-
Medium 5.4
Cross-site Scripting in ZKEACMS
A cross-site scripting (XSS) vulnerability in /navigation/create?ParentID=%23 of ZKEACMS v3.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ParentID parameter.
-
High 7.8
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
-
High 8.0
Cross-domain cookie leakage in Guzzle
Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cooki…
-
Unscored —
In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a.
-
Medium 5.3
MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occur…
-
Unscored —
MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occur…
-
Unscored —
In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a.
-
Unscored —
MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occur…