Archive
16 June 2022
Vulnerabilities first published on this day (UTC), newest first.
114 results · Feed
-
Unscored —
A maliciously crafted TIF file can be forced to read beyond allocated boundaries in Autodesk 3ds Max 2022, and 2021 whe…
-
Unscored —
Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via zms/admin/public_html/save_animal?an_id=24.
-
Unscored —
Online Discussion Forum Site v1.0 is vulnerable to Cross Site Scripting (XSS) via /odfs/classes/Master.php?f=save_categ…
-
Unscored —
Online Tutor Portal Site v1.0 is vulnerable to SQL Injection via /otps/classes/Master.php?f=delete_team.
-
Unscored —
Online Discussion Forum Site v1.0 is vulnerable to SQL Injection via /odfs/classes/Master.php?f=delete_team.
-
Unscored —
Online Tutor Portal Site v1.0 is vulnerable to Cross Site Scripting (XSS). via /otps/classes/Master.php.
-
Unscored —
MERCURY MIPC451-4 1.0.22 Build 220105 Rel.55642n was discovered to contain a remote code execution (RCE) vulnerability …
-
Unscored —
Xiaomi Lamp 1 v2.0.4_0066 was discovered to be vulnerable to replay attacks. This allows attackers to to bypass the exp…
-
Unscored —
Student Registration and Fee Payment System v1.0 is vulnerable to SQL Injection via /scms/student.php.
-
Unscored —
Online Fire Reporting System v1.0 is vulnerable to Cross Site Scripting (XSS) via /ofrs/classes/Master.php.
-
Unscored —
Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function.
-
Unscored —CVE-2022-31300 Public exploit
A cross-site scripting vulnerability in the DM Section component of Haraj v3.7 allows attackers to execute arbitrary we…
-
Unscored —
Wiris Mathtype v7.28.0 was discovered to contain a path traversal vulnerability in the resourceFile parameter. This vul…
-
Low 3.5
weblizar User Login Log Plugin Stored cross site scriting
A vulnerability was found in weblizar User Login Log Plugin 2.2.1. It has been classified as problematic. Affected is an unknown function. The manipulation leads to basic cross site scripting (Stored). It is possible to launch the attack remotely. The exploit…
-
Low 3.5
BestWebSoft Contact Form Plugin Stored cross site scriting
A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has bee…
-
Low 3.5
XYZScripts Contact Form Manager Plugin cross site scriting
A vulnerability was found in XYZScripts Contact Form Manager Plugin. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely. The exploit…
-
Medium 4.3
XYZScripts Contact Form Manager Plugin cross-site request forgery
A vulnerability was found in XYZScripts Contact Form Manager Plugin. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. Th…
-
Unscored —
SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the…
-
Critical 9.8
XML External Entity Reference in drools
drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.
-
High 7.1
Weak Password Requirements in kromitgmbh/titra
Weak Password Requirements in GitHub repository kromitgmbh/titra prior to 0.78.1.
-
Unscored —
flatCore-CMS v2.0.8 has a code execution vulnerability, which could let a remote malicious user execute arbitrary PHP c…
-
Unscored —
In GPAC MP4Box v1.1.0, there is a stack buffer overflow at src/utils/error.c:1769 which leads to a denial of service vu…
-
Medium 5.0
Python pgAdmin4 uncontrolled search path
A vulnerability classified as problematic was found in Python 2.7.13. This vulnerability affects unknown code of the component pgAdmin4. The manipulation leads to uncontrolled search path. The attack can be initiated remotely. The exploit has been disclosed t…
-
High 7.5
mysqlnd/pdo password buffer overflow
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigg…
-
High 8.1
Freeing unallocated memory in php_pgsql_free_params()
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This …
-
Unscored —
Out-of-bounds read vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, whic…
-
Unscored —
Out-of-bounds read vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior …
-
Unscored —
Out-of-bounds write vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior…
-
Unscored —
Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticate…
-
Unscored —
A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' …
-
Unscored —
In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'fl…
-
Unscored —
A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' …
-
Unscored —
An issue in dlt_config_file_parser.c of dlt-daemon v2.18.8 allows attackers to cause a double free via crafted TCP pack…
-
Unscored —
A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number …