Archive
20 June 2022
Vulnerabilities first published on this day (UTC), newest first.
59 results · Feed
-
High 7.9
McAfee MCPR privilege escalation
An uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local attacker to perform a sideloading attack by using a specific file name. This could result in the user gaining elevated permissions …
-
Unscored —
Cisco Catalyst 2940 Series Switches provided by Cisco Systems, Inc. contain a reflected cross-site scripting vulnerabil…
-
Medium 6.5CVE-2022-2130 Scanner template
Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.17.
-
High 8.8
ASUS Control Center - SQL Injection
ASUS Control Center is vulnerable to SQL injection. An authenticated remote attacker with general user privilege can inject SQL command to specific API parameters to acquire database schema or access data.
-
High 7.3
ASUS Control Center - Broken Access Control
ASUS Control Center API has a broken access control vulnerability. An unauthenticated remote attacker can call privileged API functions to perform partial system operations or cause partial disrupt of service.
-
Medium 6.2
Realtek USB FE/1GbE/2.5GbE/5GbE NIC Family - Buffer Overflow
Realtek USB driver has a buffer overflow vulnerability due to insufficient parameter length verification in the API function. An unauthenticated LAN attacker can exploit this vulnerability to disrupt services.
-
High 7.5
NHI’s health insurance web service component – Heap-based Buffer Overflow
NHI’s health insurance web service component has insufficient validation for input string length, which can result in heap-based buffer overflow attack. A remote attacker can exploit this vulnerability to flood the memory space reserved for the program, in or…
-
Medium 6.3
Elefant CMS layout code injection
A vulnerability was found in Elefant CMS 1.3.12-RC. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /designer/add/layout. The manipulation leads to code injection. The attack can be launched remotely. U…
-
Medium 6.3
Elefant CMS File Upload drop privileges management
A vulnerability was found in Elefant CMS 1.3.12-RC. It has been classified as critical. Affected is an unknown function of the file /filemanager/upload/drop of the component File Upload. The manipulation leads to improper privilege management. It is possible …
-
Medium 5.0
Elefant CMS cross-site request forgery
A vulnerability was found in Elefant CMS 1.3.12-RC and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the pub…
-
Medium 4.3
Elefant CMS extended Reflected cross site scriting
A vulnerability has been found in Elefant CMS 1.3.12-RC and classified as problematic. This vulnerability affects unknown code of the file /admin/extended. The manipulation of the argument name with the input %3Cimg%20src=no%20onerror=alert(1)%3E leads to bas…
-
Low 3.5
Elefant CMS Blog Post Persistent cross site scriting
A vulnerability, which was classified as problematic, was found in Elefant CMS 1.3.12-RC. This affects an unknown part of the component Blog Post Handler. The manipulation leads to basic cross site scripting (Persistent). It is possible to initiate the attack…
-
Low 3.5
Elefant CMS Title Persistent cross site scriting
A vulnerability, which was classified as problematic, has been found in Elefant CMS 1.3.12-RC. Affected by this issue is some unknown functionality of the component Title Handler. The manipulation with the input </title><img src=no onerror=alert(1)> leads to …
-
Medium 4.3
Elefant CMS Version Comparison Persistent cross site scriting
A vulnerability classified as problematic was found in Elefant CMS 1.3.12-RC. Affected by this vulnerability is an unknown functionality of the component Version Comparison. The manipulation leads to basic cross site scripting (Persistent). The attack can be …
-
Medium 4.3
Elefant CMS Persistent cross site scriting
A vulnerability classified as problematic has been found in Elefant CMS 1.3.12-RC. Affected is an unknown function. The manipulation of the argument username leads to basic cross site scripting (Persistent). It is possible to launch the attack remotely. Upgra…
-
Critical 10.0
Incorrect Use of Privileged APIs in polonel/trudesk
Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4.
-
Medium 5.3CVE-2022-31062 Public exploit
Unauthenticated Local File Inclusion
### Impact A plugin public script can be used to read content of system files. ### Patches Upgrade to version 1.0.2. ### Workarounds `b/deploy/index.php` file can be deleted if deploy feature is not used.
-
High 7.1
Allocation of Resources Without Limits or Throttling in inventree/inventree
Allocation of Resources Without Limits or Throttling in GitHub repository inventree/inventree prior to 0.8.0.
-
Critical 9.6CVE-2022-25772 EPSS 63%
Cross-site Scripting vulnerability in Mautic's tracking pixel functionality
A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript