Archive
6 June 2022
Vulnerabilities first published on this day (UTC), newest first.
103 results · Feed
-
Unscored —
In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local in…
-
Unscored —
In imgsensor, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of …
-
Unscored —
In imgsensor, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of …
-
Unscored —
In WIFI Firmware, there is a possible memory corruption due to a use after free. This could lead to remote escalation o…
-
Medium 5.5
Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP feature
Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotatio…
-
High 7.5
Improper Check for Unusual or Exceptional Conditions in Elasticsearch
A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request.
-
Critical 9.9CVE-2022-1680 EPSS 16%
An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, al…
-
Low 2.7
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 14.9.5, all versions star…
-
Medium 5.4
When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all ve…
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 14.9.5, all versions star…
-
Medium 6.5
Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 b…
-
High 7.7
A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE affecting all versions from 13.11 prior to…
-
Medium 6.5
Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 b…
-
Medium 5.3
In specific circumstances, trace file buffers in GitLab Runner versions up to 14.3.4, 14.4 to 14.4.2, and 14.5 to 14.5.…
-
High 8.8
Command injection via Advanced Networking route add functionality
An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which c…
-
Medium 5.3
Unauthenticated homepage note modification
An unauthenticated attacker can send a specially crafted packets to update the “notes” section of the home page of the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 w…
-
High 7.5
User Account Deletion Unauthenticated
An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware…
-
Critical 9.1
Arbitrary file write via authenticated OSDP file upload
An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, L…
-
High 7.5
Denial-of-Service via internal structure overflow
An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which c…
-
Critical 10.0
Remote Code Execution via buffer overflow in firmware update process
An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware v…
-
High 7.5
Unauthenticated Firmware Upload and Arbitrary Reboot
An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502…
-
Critical 9.6
Remote Code Execution via command injection of the hostname
An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP…
-
Medium 6.8
Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in cert…
-
Medium 5.3
IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted S…
-
Unscored —
A blind SQL injection vulnerability in search form in TeamMate+ Audit version 28.0.19.0 allows any authenticated user t…
-
Unscored —
FUDForum 3.1.2 is vulnerable to Cross Site Scripting (XSS) via page_title param in Page Manager in the Admin Control Pa…
-
Unscored —
FUDforum 3.1.2 is vulnerable to Stored XSS via Forum Name field in Forum Manager Feature.
-
Unscored —CVE-2022-30860 EPSS 25%
FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admi…
-
Unscored —
FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content secti…
-
High 8.8
Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.
-
Unscored —
LiveSync for WordPress <= 1.0 - Arbitrary Settings Update via CSRF
The LiveSync for WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
-
Unscored —
Throws SPAM Away < 3.3.1 - Comment Deletion via CSRF
The Throws SPAM Away WordPress plugin before 3.3.1 does not have CSRF checks in place when deleting comments (either all, spam, or pending), allowing attackers to make a logged in admin delete comments via a CSRF attack
-
Unscored —
WP Simple Adsense Insertion < 2.1 - Inject ads and javascript via CSRF
The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker to trick a logged in user to manipulate ads and inject arbitrary javascript via submitting a form.
-
Unscored —
CP Image Store with Slideshow < 1.0.68 - Unauthenticated SQLi
The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allowing unauthenticated users to perform an…
-
Unscored —
Realty Workstation < 1.0.15 - Agent SQLi
The Realty Workstation WordPress plugin before 1.0.15 does not sanitise and escape the trans_edit parameter before using it in a SQL statement when an agent edit a transaction, leading to an SQL injection
-
Unscored —
Note Press <= 0.1.10 - Admin+ SQLi via Bulk Actions
The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin page, leading to an SQL injection
-
Unscored —
Note Press <= 0.1.10 - Admin+ SQLi via Update
The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the Update parameter before using it in a SQL statement when updating a note via the admin dashboard, leading to an SQL injection
-
Unscored —
Note Press <= 0.1.10 - Admin+ SQLi via id
The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboard, leading to SQL Injections
-
Unscored —
Logo Slider <= 1.4.8 - Admin+ SQLi
The Logo Slider WordPress plugin through 1.4.8 does not sanitise and escape the lsp_slider_id parameter before using it in a SQL statement via the Manage Slider Images admin page, leading to an SQL Injection
-
Unscored —
Five Minute Webshop <= 1.3.2 - Admin+ SQLi via id
The Five Minute Webshop WordPress plugin through 1.3.2 does not sanitise and escape the id parameter before using it in a SQL statement when editing a product via the admin dashboard, leading to an SQL Injection