Archive
24 June 2022
Vulnerabilities first published on this day (UTC), newest first.
135 results · Feed
-
Unscored —
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in underscore-99xp v1.7.2 when the deepValu…
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in eyoucms v1.5.6 allows attackers to execute arbitrary web scripts o…
-
Unscored —
A Cross-Site Request Forgery (CSRF) in MiniCMS v1.11 allows attackers to arbitrarily delete local .dat files via clicki…
-
Unscored —
The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The curr…
-
Unscored —
The Texercise package in PyPI v0.0.1 to v0.0.12 was discovered to contain a code execution backdoor. This vulnerability…
-
Unscored —
The Rondolu-YT-Concate package in PyPI v0.1.0 was discovered to contain a code execution backdoor. This vulnerability a…
-
Unscored —
The Zibal package in PyPI v1.0.0 was discovered to contain a code execution backdoor. This vulnerability allows attacke…
-
Unscored —
The Catly-Translate package in PyPI v0.0.3 to v0.0.5 was discovered to contain a code execution backdoor. This vulnerab…
-
Unscored —
The Togglee package in PyPI version v0.0.8 was discovered to contain a code execution backdoor. This vulnerability allo…
-
Unscored —
The Sixfab-Tool in PyPI v0.0.2 to v0.0.3 was discovered to contain a code execution backdoor via the request package. T…
-
Unscored —
The Scoptrial package in PyPI version v0.0.5 was discovered to contain a code execution backdoor via the request packag…
-
Unscored —
The Watertools package in PyPI v0.0.0 was discovered to contain a code execution backdoor via the request package. This…
-
Unscored —
The Perdido package in PyPI v0.0.1 to v0.0.2 was discovered to contain a code execution backdoor via the request packag…
-
Unscored —
The drxhello package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. This v…
-
Unscored —
The DR-Web-Engine package in PyPI v0.2.0b0 was discovered to contain a code execution backdoor via the request package.…
-
Unscored —
The Beginner package in PyPI v0.0.2 to v0.0.4 was discovered to contain a code execution backdoor via the request packa…
-
Unscored —
The KGExplore package in PyPI v0.1.1 to v0.1.2 was discovered to contain a code execution backdoor via the request pack…
-
Unscored —
The watools package in PyPI v0.0.1 to v0.0.8 was discovered to contain a code execution backdoor via the request packag…
-
Unscored —
The ML-Scanner package in PyPI v0.1.0 to v0.1.5 was discovered to contain a code execution backdoor via the request pac…
-
Unscored —
The AAmiles package in PyPI v0.1.0 was discovered to contain a code execution backdoor via the request package. This vu…
-
Unscored —
The cloudlabeling package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. T…
-
Unscored —
The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution backdoor vi…
-
Unscored —
The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the req…
-
Unscored —
The django-navbar-client package of v0.9.50 to v1.0.1 was discovered to contain a code execution backdoor via the reque…
-
High 7.5
Prototype Pollution
All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-7715](https://security.snyk.io/vuln/SNYK-JS-DEEPGETSET-598666)
-
Medium 4.9
Dell WMS 3.6.1 and below contains a Path Traversal vulnerability in Device API. A remote attacker could potentially exp…
-
Medium 6.1
Dell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in saveGroupConfigur…
-
Medium 5.4
MantisBT XSS through crafted SVG documents in file_download.php
An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, file_download.php opens the SVG document in a browser tab instead of downloa…
-
Medium 6.2
IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an information disclosure caus…
-
Medium 6.5
IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server …
-
Unscored —
Meridian Cooperative Utility Software versions 22.02 and 22.03 allows remote attackers to obtain sensitive information …
-
Unscored —
Dradis Professional Edition before 4.3.0 allows attackers to change an account password via reusing a password reset to…
-
Unscored —CVE-2021-39409 Public exploit
A vulnerability exists in Online Student Rate System v1.0 that allows any user to register as an administrator without …
-
Unscored —CVE-2021-39408 Public exploit
Cross Site Scripting (XSS) vulnerability exists in Online Student Rate System 1.0 via the page parameter on the index.p…
-
Low 3.7
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to obtain sensitive informatio…
-
Medium 5.4
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability al…
-
Medium 5.4
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to hijack the clicking action …
-
Medium 4.0
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 allows web pages to be stored locally which can be read by a…
-
Medium 5.4
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This ma…
-
Medium 5.4
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTML injection. A remote attacker could inj…