Archive
May 2022
Vulnerabilities first published in this month (UTC), newest first.
111 results · Clear filters · Feed
-
Unscored —CVE-2022-24702 Public exploit
An issue was discovered in WinAPRS 2.9.0. A buffer overflow in the VHF KISS TNC component allows a remote attacker to a…
-
Medium 4.9
Privilege escalation from administrator in eLabFTW
eLabFTW is an electronic lab notebook manager for research teams. Prior to version 4.3.0, a vulnerability allows an authenticated user with an administrator role in a team to assign itself system administrator privileges within the application, or create a ne…
-
High 7.5CVE-2022-23082 Public exploit
CureKit - Path Traversal in isFileOutsideDir
In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal.
-
Unscored —CVE-2022-1203 Public exploit
Content Mask < 1.8.4.1 - Subscriber+ Arbitrary Options Update
The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscr…
-
Unscored —CVE-2022-29598 Public exploit
Solutions Atlantic Regulatory Reporting System (RRS) v500 is vulnerable to an reflected Cross-Site Scripting (XSS) vuln…
-
Unscored —
School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.…
-
Unscored —CVE-2022-30511 Public exploit
School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/view_details.php:4.
-
Unscored —
School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.…
-
Unscored —
School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/payment_history.php:31.
-
Unscored —CVE-2022-30510 Public exploit
School Dormitory Management System 1.0 is vulnerable to SQL Injection via reports/daily_collection_report.php:59.
-
Medium 5.5CVE-2022-26766 Public exploit
A certificate parsing issue was addressed with improved checks. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 1…
-
High 7.8CVE-2022-26763 Public exploit
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, iOS 15.5 a…
-
Unscored —CVE-2022-26726 Public exploit
This issue was addressed with improved checks. This issue is fixed in Security Update 2022-004 Catalina, watchOS 8.6, m…
-
Unscored —CVE-2022-26711 Public exploit
An integer overflow issue was addressed with improved input validation. This issue is fixed in tvOS 15.5, iTunes 12.12.…
-
Unscored —CVE-2022-22616 Public exploit
This issue was addressed with improved checks. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey…
-
Critical 9.8CVE-2022-21831 Public exploit
Possible code injection vulnerability in Rails / Active Storage
A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments.
-
Unscored —CVE-2022-29380 Public exploit
Academy-LMS v4.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the SEO panel.
-
Unscored —CVE-2022-29361 Public exploit
Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggli…
-
Unscored —CVE-2022-29359 Public exploit
A stored cross-site scripting (XSS) vulnerability in /scas/?page=clubs/application_form&id=7 of School Club Application…
-
Unscored —
C-DATA FD702XW-X-R430 v2.1.13_X001 was discovered to contain a command injection vulnerability via the va_cmd parameter…
-
High 8.8CVE-2022-29221 Public exploit
PHP Code Injection by malicious block or filename in Smarty
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites t…
-
Unscored —CVE-2022-28944 Public exploit
Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Pac…
-
Unscored —
Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name paramete…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate…
-
Unscored —
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability af…
-
High 7.5CVE-2022-24434 Public exploit
Denial of Service (DoS)
This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.
-
Medium 6.6CVE-2022-29170 Public exploit
Grafana Enterprise datasource network restrictions bypass via HTTP redirects
Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafana in a way so that the instance doesn’t call or only calls specific hosts. The vulnerability present…
-
Unscored —CVE-2022-31245 Public exploit
mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admi…
-
Unscored —
Pharmacy Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component…
-
High 7.5
Vulnerability in Oracle E-Business Suite (component: Manage Proxies). The supported version that is affected is 12.2. E…
-
Medium 5.3CVE-2022-22976 Public exploit
Integer overflow in BCrypt class in Spring Security
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due t…
-
Critical 9.8
Authorization bypass in Spring Security
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression …
-
Critical 9.8CVE-2022-30600 Public exploit
Incorrect Calculation in moodle
A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.
-
Unscored —CVE-2021-41946 Public exploit
In FiberHome VDSL2 Modem HG150-Ub_V3.0, a stored cross-site scripting (XSS) vulnerability in Parental Control --> Acces…
-
Medium 4.4CVE-2022-0486 Public exploit
Privileged Command Injection Vulnerability in Fidelis Network and Deception
Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected files and enable escalation of privileges equivalent t…
-
Low 3.9CVE-2022-0997 Public exploit
Local Privilege Escalation Vulnerability in Fidelis Network and Deception
Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected script files, which could result in arbitrary commands being ru…
-
Unscored —CVE-2022-24611 Public exploit
Denial of Service (DoS) in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows local…
-
High 7.8CVE-2022-29581 Public exploit
Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege …
-
Unscored —
Fusion Builder < 3.6.2 - Unauthenticated SSRF
The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could b…
-
Unscored —
Advanced Uploader <= 4.2 - Subscriber+ Arbitrary File Upload
The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, which could lead to RCE