10 June 2022

13 results · Clear filters · Feed

• High 7.5
  CVE-2022-25851

  Denial of Service (DoS)

  The package jpeg-js before 0.4.4 are vulnerable to Denial of Service (DoS) where a particular piece of input will cause to enter an infinite loop and never return.

  jpeg-js npm
  Jun 10, 2022
• High 8.1
  CVE-2022-25845 Public exploit EPSS 19%

  Deserialization of Untrusted Data

  The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote serve…

  com.alibaba:fastjson Maven
  Jun 10, 2022
• High 7.5
  CVE-2022-24278

  Directory Traversal

  The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file.

  convert-svg-core npm
  Jun 10, 2022
• High 7.2
  CVE-2022-24376

  Command Injection

  All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior [vulnerability](https://security.snyk.io/vuln/SNYK-JS-GITPROMISE-567476) in this package. **Note:** Please note that the vulnerability will not be f…

  git-promise npm
  Jun 10, 2022
• High 8.3
  CVE-2022-29095

  Dell SupportAssist Client Consumer versions (3.10.4 and prior) and Dell SupportAssist Client Commercial versions (3.1.1…

  Dell SupportAssist Consumer
  Jun 10, 2022
• High 7.1
  CVE-2022-29094

  Dell SupportAssist Client Consumer versions (3.10.4 and versions prior) and Dell SupportAssist Client Commercial versio…

  Dell SupportAssist Client Consumer
  Jun 10, 2022
• High 7.1
  CVE-2022-29093

  Dell SupportAssist Client Consumer versions (3.10.4 and versions prior) and Dell SupportAssist Client Commercial versio…

  Dell SupportAssist Client Commercial
  Jun 10, 2022
• High 7.8
  CVE-2022-29092

  Dell SupportAssist Client Consumer versions (3.11.0 and versions prior) and Dell SupportAssist Client Commercial versio…

  Dell SupportAssist Consumer
  Jun 10, 2022
• High 7.5
  CVE-2022-24429

  Arbitrary Code Injection

  The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file.

  convert-svg-core npm
  Jun 10, 2022
• High 8.1
  CVE-2022-25863

  Deserialization of Untrusted Data

  The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploit…

  gatsby-plugin-mdx npm
  Jun 10, 2022
• High —
  GHSA-x9jp-4w8m-4f3c

  Cross Site Scripting vulnerability in django-jsonform's admin form.

  ### Description django-jsonform stores the raw JSON data of the db field in a hidden textarea on the admin page. However, that data was kept in the textarea after unescaping it using the `safe` template filter. This opens up possibilities for XSS attacks. Thi…

  django-jsonform PyPI
  Jun 10, 2022
• High 7.3
  CVE-2017-20029 EPSS 21%

  PHPList Edit Subscription index.php sql injection

  A vulnerability was found in PHPList 3.2.6 and classified as critical. This issue affects some unknown processing of the file /lists/index.php of the component Edit Subscription. The manipulation leads to sql injection. The attack may be initiated remotely. T…

  Jun 10, 2022
• High 7.4
  CVE-2022-2042

  Use After Free in vim/vim

  Use After Free in GitHub repository vim/vim prior to 8.2.

  vim vim/vim vim vim Debian Ubuntu
  Jun 10, 2022