Archive
May 2022
Vulnerabilities first published in this month (UTC), newest first.
2,175 results · Feed
-
Unscored —
ChatBot Application with a Suggestion Feature 1.0 was discovered to contain a SQL injection vulnerability via the id pa…
-
Unscored —
MiniTool Partition Wizard v12.0 contains an unquoted service path which allows attackers to escalate privileges to the …
-
Unscored —
Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request.
-
Unscored —
A Cross-Site Request Forgery (CSRF) in Online Banquet Booking System v1.0 allows attackers to change admin credentials …
-
Unscored —
Multi Store Inventory Management System v1.0 was discovered to contain an information disclosure vulnerability which al…
-
Unscored —
Online Sports Complex Booking System v1.0 was discovered to allow attackers to take over user accounts via a crafted PO…
-
Unscored —
Online Sports Complex Booking System v1.0 was discovered to contain a blind SQL injection vulnerability via the id para…
-
Unscored —
BattlEye v0.9 contains an unquoted service path which allows attackers to escalate privileges to the system level.
-
Unscored —
Foxit PDF Editor v11.3.1 was discovered to contain an arbitrary file upload vulnerability.
-
Unscored —
Sony PlayMemories Home v6.0 contains an unquoted service path which allows attackers to escalate privileges to the syst…
-
Unscored —
Simple Student Quarterly Result/Grade System v1.0 was discovered to contain a SQL injection vulnerability via /sqgs/Act…
-
Unscored —
HMA VPN v5.3.5913.0 contains an unquoted service path which allows attackers to escalate privileges to the system level.
-
Unscored —
Multi-Vendor Online Groceries Management System v1.0 was discovered to contain a blind SQL injection vulnerability via …
-
Unscored —
A buffer overflow vulnerability exists in the razeraccessory driver of OpenRazer up to version v3.3.0 allows attackers …
-
Unscored —
A buffer overflow vulnerability exists in the razermouse driver of OpenRazer up to version v3.3.0 allows attackers to c…
-
Unscored —
A buffer overflow vulnerability exists in the razerkbd driver of OpenRazer up to version v3.3.0 allows attackers to cau…
-
High 7.5
Server-Side Request Forgery (SSRF) in jgraph/drawio
Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8.
-
Unscored —
In certain Goverlan products, the Windows Firewall is temporarily turned off upon a Goverlan agent update operation. Th…
-
Unscored —
OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending c…
-
Unscored —
Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, th…
-
Unscored —
Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged r…
-
Unscored —
Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page. The 'nodeIntegration' …
-
Medium 6.3
Cross-site Scripting (XSS) - Reflected in rtxteam/rtx
Cross-site Scripting (XSS) - Reflected in GitHub repository rtxteam/rtx prior to checkpoint_2022-05-18.
-
High 8.4
Integer Overflow or Wraparound in polonel/trudesk
Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.2.
-
Unscored —
Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST re…
-
Unscored —
Thecus 4800Eco was discovered to contain a command injection vulnerability via the username parameter in /adm/setmain.p…
-
Medium 6.3
A stored cross-site scripting (XSS) vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to …
-
Unscored —
Multiple DLL hijacking vulnerabilities via the components instup.exe and wsc_proxy.exe in Avast Premium Security before…
-
Unscored —
An arbitrary file write vulnerability in Avast Premium Security before v21.11.2500 (build 21.11.6809.528) allows attack…
-
High 8.2
Improper Handling of Unexpected Data Type in Nokogiri
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads…
-
High 7.5
Vulnerability in Oracle E-Business Suite (component: Manage Proxies). The supported version that is affected is 12.2. E…
-
High 8.8
HCL Domino is affected by an Insufficient Access Control vulnerability
HCL Domino is affected by an Insufficient Access Control vulnerability. An authenticated attacker with local access to the system could exploit this vulnerability to attain escalation of privileges, denial of service, or information disclosure.
-
Unscored —
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=save_client.
-
Unscored —
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /classes/master.php?f=delete_ Facility.
-
Unscored —
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=delete_client.
-
Unscored —
Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via th…
-
Unscored —
A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parame…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of Spip Web Framework v3.1.13 and below …
-
High 7.5
gopkg.in/yaml.v3 Denial of Service
An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.
-
High 7.5
Out of bounds memory access in github.com/open-policy-agent/opa
An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causing a Denial of Service (DoS) via triggering out-of-range memory access.