Archive
13 June 2022
Vulnerabilities first published on this day (UTC), newest first.
146 results · Feed
-
High 7.8
Adobe Media Encoder M4A file memory corruption vulnerability could lead to remote code execution
Adobe Media Encoder version 15.4 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue …
-
High 7.1
Cross-site Scripting (XSS) - Reflected in neorazorx/facturascripts
Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06.
-
High 8.6
Cross-site Scripting (XSS) - Stored in neorazorx/facturascripts
Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06.
-
High 7.1
Open Redirect in open-forms
Open Forms is an application for creating and publishing smart forms. Prior to versions 1.0.9 and 1.1.1, the cookie consent page in Open Forms contains an open redirect by injecting a `referer` querystring parameter and failing to validate the value. A malici…
-
High 7.8
Adobe Media Encoder M4A file memory corruption vulnerability could lead to remote code execution
Adobe Media Encoder version 15.4 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue …
-
Critical 9.1
Insufficient Session Expiration in nocodb/nocodb
Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+.
-
Low 2.8
Heap-based Buffer Overflow in hpjansson/chafa
Heap-based Buffer Overflow in GitHub repository hpjansson/chafa prior to 1.12.0.
-
Critical 9.0
Improper Privilege Management in nocodb/nocodb
Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+.
-
High 8.4
Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr
Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.
-
Medium 5.3
Information disclosure in Request New Password feature
Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time.
-
Low 3.5
Information disclosure in the External Interface
A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances.
-
Low 3.5
OTRS version number is always in the exported ICS files
When Secure::DisableBanner system configuration has been disabled and agent shares his calendar via public URL, received ICS file contains OTRS release number.
-
Critical 9.8
Heap buffer overflow in libhdfs native library
There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 o…
-
High 7.3
Navetti PricePoint cross-site request forgery
A vulnerability was found in Navetti PricePoint 4.6.0.0. It has been declared as critical. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to t…
-
Medium 4.3
Navetti PricePoint Reflected cross site scriting
A vulnerability was found in Navetti PricePoint 4.6.0.0. It has been classified as problematic. This affects an unknown part. The manipulation leads to basic cross site scripting (Reflected). It is possible to initiate the attack remotely. Upgrading to versio…
-
Medium 4.3
Navetti PricePoint Persistent cross site scriting
A vulnerability was found in Navetti PricePoint 4.6.0.0 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting (Persistent). The attack may be launched remotely. Upgrading to v…
-
Medium 6.3
Navetti PricePoint Blind sql injection
A vulnerability has been found in Navetti PricePoint 4.6.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection (Blind). The attack can be launched remotely. Upgrading to version 4.7…
-
Medium 5.4
Ucweb UC Browser HTML URL improper restriction of rendered ui layers
A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title leads to improper restriction of rendered ui layers (URL). It i…
-
Medium 4.8
Cross-site Scripting in Strapi
Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the admi…
-
Unscored —
Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 uses a hard-coded credential which may allow a remote unauthenticated a…
-
Unscored —
Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to lo…
-
Unscored —
Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a p…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthe…
-
Unscored —
Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to ob…
-
Unscored —
Directory traversal vulnerability in RCCMD 4.26 and earlier allows a remote authenticated attacker with an administrati…
-
Critical 9.1
Generation of Error Message Containing Sensitive Information in nocodb/nocodb
Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.