Archive
9 June 2022
Vulnerabilities first published on this day (UTC), newest first.
62 results · Feed
-
Medium 4.3
CoreHR Core Portal cross-site request forgery
A vulnerability was found in CoreHR Core Portal up to 27.0.7. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross site request forgery. It is possible to launch the attack remotely. Upgrading to version 27.0…
-
Unscored —
The Android application HTTP File Server (Version 1.4.1) by 'slowscript' is affected by a path traversal vulnerability …
-
Unscored —
x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular …
-
Unscored —
x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text ex…
-
Unscored —
x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text ex…
-
Unscored —
Emlog Pro v 1.0.4 cross-site scripting (XSS) in Emlog Pro background management.
-
Critical 9.8
Excessive Attack Surface in tooljet/tooljet
Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0.
-
High 7.3
MONyog Ultimate Cookie privileges management
A vulnerability, which was classified as critical, was found in MONyog Ultimate 6.63. This affects an unknown part of the component Cookie Handler. The manipulation of the argument HasServerEdit/IsAdmin leads to privilege escalation. It is possible to initiat…
-
Critical 9.0
Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1.
-
Critical 10.0
OS Command Injection in gogs/gogs
OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9.
-
Unscored —
In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remot…
-
Unscored —
ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer.
-
Unscored —
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Insecure permissions for the serverconfi…
-
Unscored —
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. The transmission of cleartext LDAP bind …
-
Unscored —
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the PrefDBCredent…
-
Unscored —
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the LDAPDesPWEncr…
-
Unscored —CVE-2022-32195 Scanner template
Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL.
-
Unscored —CVE-2022-32272 Public exploit
OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before …
-
Unscored —
A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container…
-
High 7.5
Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle
Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a …
-
High 7.5
Fix failure to strip Authorization header on HTTP downgrade in Guzzle
Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should no…
-
Unscored —
CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby varia…