Archive
28 June 2022
Vulnerabilities first published on this day (UTC), newest first.
61 results · Feed
-
Medium 5.4
Cross-site Scripting in admidio
Admidio 4.1.2 version is affected by stored cross-site scripting (XSS).
-
Unscored —
The schm_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box…
-
Medium 6.3
Use of hard-coded credentials vulnerability exists in STARDOM FCN Controller and FCJ Controller R4.10 to R4.31, which m…
-
Unscored —
Violation of secure design principles exists in the communication of CAMS for HIS. Affected products and versions are C…
-
Unscored —
Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01…
-
Unscored —
In Bento4 1.6.0-638, there is a null pointer reference in the function AP4_DescriptorListInspector::Action function in …
-
Unscored —
DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does n…
-
Unscored —
DCMTK through 3.6.6 does not handle memory free properly. The object in the program is free but its address is still us…
-
Unscored —
DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are reco…
-
High 7.5
DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would qu…
-
Medium 6.5
Authorization Bypass Through User-Controlled Key in ionicabizau/parse-path
Authorization Bypass Through User-Controlled Key in GitHub repository ionicabizau/parse-path prior to 5.0.0.
-
Medium 5.3
ShadeYouVPN.com Client privileges management
A vulnerability, which was classified as problematic, was found in ShadeYouVPN.com Client 2.0.1.11. Affected is an unknown function. The manipulation leads to improper privilege management. Local access is required to approach this attack. The exploit has bee…
-
Medium 5.3
Lithium Forum Compose Message server-side request forgery
A vulnerability, which was classified as critical, has been found in Lithium Forum 2017 Q1. This issue affects some unknown processing of the component Compose Message Handler. The manipulation of the argument upload_url leads to server-side request forgery. …
-
Medium 5.4
Simplessus path traversal
A vulnerability was found in Simplessus 3.7.7. It has been rated as critical. This issue affects some unknown processing. The manipulation of the argument path with the input ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%…
-
High 7.3
Simplessus Cookie Time sql injection
A vulnerability was found in Simplessus 3.7.7. It has been declared as critical. This vulnerability affects unknown code of the component Cookie Handler. The manipulation of the argument UWA_SID leads to sql injection (Time). The attack can be initiated remot…
-
Critical 9.8CVE-2022-31056 Public exploit
SQL injection with _actor parameter in GLPI
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all assistance forms (Ticket/Change/Problem) permit sql injection on the actor fields. This issue…
-
High 7.8
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.
-
Unscored —
The GetHintFormat function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box…
-
Unscored —
The gf_bs_write_data function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4…
-
Unscored —
In GPAC MP4Box 1.1.0, there is a Null pointer reference in the function gf_filter_pid_get_packet function in src/filter…
-
Unscored —
The gf_hinter_track_finalize function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in…