Archive
29 June 2022
Vulnerabilities first published on this day (UTC), newest first.
51 results · Feed
-
Unscored —
In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md…
-
Unscored —
The firmware of EDIMAX IC-3140W Version 3.11 is hardcoded with Administrator username and password.
-
Unscored —
Joy ebike Wolf Manufacturing year 2022 is vulnerable to Denial of service, which allows remote attackers to jam the key…
-
Critical 9.1CVE-2022-2073 EPSS 11%
Code Injection in getgrav/grav
Code Injection in GitHub repository getgrav/grav prior to 1.7.34.
-
Medium 5.3
Denial of Service (DoS) vulnerability in RSSHub
RSSHub is an open source, extensible RSS feed generator. In commits prior to 5c4177441417 passing some special values to the `filter` and `filterout` parameters can cause an abnormally high CPU. This results in an impact on the performance of the servers and …
-
High 7.2
SQL injection via the field name of a tracker in Tuleap
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.95 Tuleap does not sanitize properly user inputs when constructing the SQL query to retrieve data for the tracker reports. An a…
-
Medium 6.5
Cross site scripting via the title of a document in Tuleap
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.111 the title of a document is not properly escaped in the search result of MyDocmanSearch widget and in the administration pag…
-
Medium 4.3
Resources of private projects can be exposed in Tuleap
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.58 authorizations are not properly verified when creating projects or trackers from projects marked as templates. Users can get…
-
Unscored —
This module enables you to create and manage a version of taxonomy based on configuration entities instead of content. …
-
Unscored —
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
Unscored —
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
High 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
High 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
Unscored —
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
Unscored —
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
Unscored —
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
Unscored —
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
Unscored —
The Lottiefiles Field module enables you to integrate the lottiefiles features into your page. The module does not suff…
-
Medium 4.3
TrueConf Server cross-site request forgery
A vulnerability classified as problematic was found in TrueConf Server 4.3.7. This vulnerability affects unknown code of the file /admin/service/stop/. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has…
-
Low 3.5
TrueConf Server change-lang redirect
A vulnerability classified as problematic has been found in TrueConf Server 4.3.7. This affects an unknown part of the file /admin/general/change-lang. The manipulation of the argument redirect_url leads to open redirect. It is possible to initiate the attack…
-
Low 3.5
TrueConf Server DOM cross site scripting
A vulnerability was found in TrueConf Server 4.3.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/conferences/list/. The manipulation of the argument domxss leads to basic cross site scripting (DOM).…
-
Low 3.5
TrueConf Server group DOM cross site scripting
A vulnerability was found in TrueConf Server 4.3.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/group. The manipulation leads to basic cross site scripting (DOM). The attack can be launche…
-
Low 3.5
TrueConf Server Reflected cross site scripting
A vulnerability was found in TrueConf Server 4.3.7. It has been classified as problematic. Affected is an unknown function of the file /admin/group/list/. The manipulation of the argument checked_group_id leads to basic cross site scripting (Reflected). It is…
-
Low 3.5
TrueConf Server Reflected cross site scripting
A vulnerability was found in TrueConf Server 4.3.7 and classified as problematic. This issue affects some unknown processing of the file /admin/conferences/list/. The manipulation of the argument sort leads to basic cross site scripting (Reflected). The attac…
-
Low 3.5
TrueConf Server Reflected cross site scripting
A vulnerability has been found in TrueConf Server 4.3.7 and classified as problematic. This vulnerability affects unknown code of the file /admin/conferences/get-all-status/. The manipulation of the argument keys[] leads to basic cross site scripting (Reflect…
-
Low 3.5
TrueConf Server Stored cross site scripting
A vulnerability, which was classified as problematic, was found in TrueConf Server 4.3.7. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclos…
-
Medium 6.1
IBM Security Guardium 11.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja…
-
Medium 4.3
Open Redirect in microweber/microweber
Open Redirect in GitHub repository microweber/microweber prior to 1.2.19.
-
Unscored —
MetaMask before 10.11.3 might allow an attacker to access a user's secret recovery phrase because an input field is use…
-
Unscored —
ApiFest OAuth 2.0 Server 0.3.1 does not validate the redirect URI in accordance with RFC 6749 and is susceptible to an …
-
Unscored —
Incorrect permissions for the folder C:\ProgramData\NoMachine\var\uninstall of Nomachine v7.9.2 allows attackers to per…
-
Unscored —
A binary hijack in Orwell-Dev-Cpp v5.11 allows attackers to execute arbitrary code via a crafted .exe file.
-
Unscored —
A binary hijack in Embarcadero Dev-CPP v6.3 allows attackers to execute arbitrary code via a crafted .exe file.
-
Unscored —
XLPD v7.0.0094 and below contains an unquoted service path vulnerability which allows local users to launch processes w…
-
Unscored —
CVA6 commit 909d85a gives incorrect permission to use special multiplication units when the format of instructions is w…
-
Unscored —
CVA6 commit 909d85a accesses invalid memory when reading the value of MHPMCOUNTER30.
-
Critical 9.8CVE-2022-33107 EPSS 24%
Deserialization of Untrusted Data in topthink/framework
ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.php. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
-
Unscored —
Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attrib…
-
High 7.8
IVPN Client privileges management
A vulnerability has been found in IVPN Client 2.6.6120.33863 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument --up cmd leads to improper privilege management. The attack needs to be appro…
-
High 7.3
Teleopti WFM Administration privileges management
A vulnerability, which was classified as critical, was found in Teleopti WFM 7.1.0. This affects an unknown part of the component Administration. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. The expl…