Archive
May 2022
Vulnerabilities first published in this month (UTC), newest first.
2,175 results · Feed
-
Unscored —
An issue was discovered in swftools through 20201222. A heap-buffer-overflow exists in the function swf_GetD64() locate…
-
Medium 6.5
DNN CMS Server-Side Request Forgery (SSRF)
The AppCheck research team identified a Server-Side Request Forgery (SSRF) vulnerability within the DNN CMS platform, formerly known as DotNetNuke. SSRF vulnerabilities allow the attacker to exploit the target system to make network requests on their behalf, …
-
Unscored —
Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-fr…
-
Unscored —
The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of *drm_vgem_g…
-
High 7.8
e-Design - Multiple vulnerabilities
Incorrect Default Permissions vulnerability in ABB e-Design allows attacker to install malicious software executing with SYSTEM permissions violating confidentiality, integrity, and availability of the target machine.
-
Medium 6.1
e-Design - Multiple vulnerabilities
Incorrect Default Permissions vulnerability in ABB e-Design allows attacker to install malicious software executing with SYSTEM permissions violating confidentiality, integrity, and availability of the target machine.
-
Unscored —
In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "phot…
-
Unscored —
In Wedding Management v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "users_edit.…
-
Unscored —
In Wedding Management System v1.0, the editing function of the "Services" module in the background management system ha…
-
Unscored —
An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function main() located …
-
Unscored —
In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "user…
-
Unscored —
Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\blog_events_edit.php.
-
Unscored —
Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\client_edit.php.
-
Unscored —
Wedding Management System v1.0 is vulnerable to SQL Injection via admin\client_assign.php.
-
Unscored —
Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\package_edit.php.
-
Unscored —
Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\photos_edit.php.
-
Unscored —
An issue was discovered in swftools through 20201222. A heap buffer overflow exists in the function swf_FontExtract_Def…
-
Unscored —
Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\users_edit.php.
-
Unscored —
Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\feature_edit.php.
-
Unscored —
Wedding Management System v1.0 is vulnerable to SQL Injection via Wedding-Management/wedding_details.php.
-
Unscored —
Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_assign.php?booking=3…
-
Unscored —
An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function swf_GetBits() l…
-
Unscored —
Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_edit.php?booking=31&…
-
Unscored —
Wedding Management System v1.0 is vulnerable to SQL injection via /Wedding-Management/admin/blog_events_edit.php?id=31.
-
Unscored —
Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_manage_account_detai…
-
Unscored —
Wedding Management System v1.0 is vulnerable to SQL Injection. via /Wedding-Management/admin/budget.php?booking_id=.
-
Unscored —
Wedding Management System v1.0 is vulnerable to SQL Injection. via Wedding-Management/admin/select.php.
-
Unscored —
An issue was discovered in swftools through 20201222 through a memory leak in the swftools when swfdump is used. It all…
-
High 7.4
Cross-site Scripting in Filter Stream Converter Application in XWiki Platform
XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Starting with versions 6.0-milestone-2 and 5.4.4 and prior to versions 12.10.11, 14.0-rc-1, 13.4.7, and 1…
-
Unscored —
An issue was discovered in swftools through 20201222. A NULL pointer dereference exists in the function traits_parse() …
-
Medium 6.5
Weak private key generation in SSH.NET
SSH.NET is a Secure Shell (SSH) library for .NET. In versions 2020.0.0 and 2020.0.1, during an `X25519` key exchange, the client’s private key is generated with `System.Random`. `System.Random` is not a cryptographically secure random number generator, it mus…
-
Unscored —
Simple Bus Ticket Booking System 1.0 is vulnerable to SQL Injection via /SimpleBusTicket/index.php.
-
Unscored —
An issue was discovered in swftools through 20201222. A heap-buffer-overflow exists in the function handleEditText() lo…
-
Unscored —
elitecms v1.01 is vulnerable to Delete any file via /admin/delete_image.php?file=.
-
Unscored —CVE-2022-30808 EPSS 17%
elitecms 1.0.1 is vulnerable to Arbitrary code execution via admin/manage_uploads.php.
-
Unscored —
elitecms 1.01 is vulnerable to SQL Injection via /admin/edit_page.php?page=.
-
Unscored —
elitecms v1.01 is vulnerable to SQL Injection via admin/edit_post.php.
-
Unscored —
elitecms 1.01 is vulnerable to SQL Injection via /admin/add_post.php.
-
Unscored —
elitecms v1.01 is vulnerable to SQL Injection via /admin/add_sidebar.php.
-
Medium 4.3
Improper input-size validation on the user new session name in Nextcloud Server
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users to create app passwords with long names. These long names are…