Archive
2 June 2022
Vulnerabilities first published on this day (UTC), newest first.
93 results · Feed
-
High 8.3
A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account whe…
-
High 8.2
A CWE-311: Missing Encryption of Sensitive Data vulnerability exists that could allow authentication credentials to be …
-
High 8.2
A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could allow unauthorized access when a…
-
High 8.6
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized…
-
Critical 9.4
A CWE-798: Use of Hard-coded Credentials vulnerability exists that could allow arbitrary code to be executed when root …
-
Medium 6.5
A CWE-20: Improper Input Validation vulnerability exists that could allow the product to be maliciously manipulated whe…
-
High 8.0
A CWE-20: Improper Input Validation vulnerability exists that could cause potential remote code execution when an attac…
-
Unscored —
eG Agent before 7.2 has weak file permissions that enable escalation of privileges to SYSTEM.
-
High 7.4
Owl Labs Meeting Owl 5.2.0.15 allows attackers to retrieve the passcode hash via a certain c 10 value over Bluetooth.
-
High 7.4
Owl Labs Meeting Owl 5.2.0.15 allows attackers to deactivate the passcode protection mechanism via a certain c 11 messa…
-
Critical 9.3
Owl Labs Meeting Owl 5.2.0.15 allows attackers to control the device via a backdoor password (derived from the serial n…
-
High 8.2
Owl Labs Meeting Owl 5.2.0.15 does not require a password for Bluetooth commands, because only client-side authenticati…
-
High 7.4
Owl Labs Meeting Owl 5.2.0.15 allows attackers to activate Tethering Mode with hard-coded hoothoot credentials via a ce…
-
Critical —
Login timing attack in ibexa/core
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enou…
-
Critical —
Login timing attack in ezsystems/ezpublish-kernel
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enou…
-
Medium 6.4
Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text password storage vuln…
-
High 8.1
Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication att…
-
Critical 9.8
Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. A remote unauthenticated att…
-
Medium 6.4
Dell EMC PowerStore versions 2.0.0.x, 2.0.1.x, and 2.1.0.x are vulnerable to a command injection flaw. An authenticated…
-
Medium 5.9
PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file. The data is taken as is, wit…
-
Medium 5.5
Dell PowerStore Versions before v2.1.1.0. contains a Stored Cross-Site Scripting vulnerability. A high privileged netwo…
-
High 7.5
PowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X & T environments running versions 2.0.0.x…
-
Low 3.7
Dell PowerStore contains an Uncontrolled Resource Consumption Vulnerability in PowerStore User Interface. A remote unau…
-
Critical —
Login timing attack in ezsystems/ezplatform-kernel
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enou…
-
Unscored —CVE-2022-32250 Public exploit
net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespace…
-
Low —
Cross site scripting via cookies in gogs
### Impact There is no known practical impact other than it is just possible to manipulate CSRF cookie and XSS the malicious user self. ### Patches Invalid characters of CSRF tokens are stripped after reading cookie. Users should upgrade to 0.12.8 or the late…
-
Critical 9.1
Arbitrary file write in dragonfly
An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. This vulnerability is exploited via a crafted URL.
-
Unscored —
TOTOLINK EX1200T V4.1.2cu.5215 contains a denial of service vulnerability in function RebootSystem of the file lib/cste…
-
Unscored —
TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the…
-
Medium 6.5
Federated editing allows iframing remote servers by default in richdocuments
richdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration. Prior to versions 6.0.0, 5.0.4, and 4.2.6, a user could be tricked into working against a remote Office by sending them a federated share. richdocuments versio…
-
Medium 5.9
Dev error stack trace leaking into prod in Play Framework
Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information. Play Framework, when run in dev mode, shows verbose errors for easy debugging, including an exceptio…
-
Unscored —
NetScout nGeniusONE 6.3.2 allows Java RMI Code Execution.
-
Unscored —
NetScout nGeniusONE 6.3.2 allows Arbitrary File Upload by a privileged user.
-
Unscored —
NetScout nGeniusONE 6.3.2 allows an XML External Entity (XXE) attack.
-
Unscored —
Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include…
-
Unscored —
bbs-go <= 3.3.0 including Custom Edition is vulnerable to stored XSS.
-
Low 2.4
SourceCodester Product Show Room Site cross site scripting
A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been rated as problematic. This issue affects the file /admin/?page=system_info/contact_info. The manipulation of the textbox Telephone with the input <script>alert(1)</script> lea…
-
Low 3.5
SourceCodester Product Show Room Site p=contact cross site scripting
A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been declared as problematic. This vulnerability affects p=contact. The manipulation of the Message textbox with the input <script>alert(1)</script> leads to cross site scripting. …
-
Medium 5.4
Neos CMS vulnerable to XSS in various backend modules
Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in v…
-
Unscored —CVE-2022-29597 Public exploit
Solutions Atlantic Regulatory Reporting System (RRS) v500 is vulnerable to Local File Inclusion (LFI). Any authenticate…