Archive
June 2022
Vulnerabilities first published in this month (UTC), newest first.
428 results · Clear filters · Feed
-
High 7.5
ITarian - Session cookie not protected by HttpOnly flag
Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set the HTTP Only flag. A remote attacker could exploit this vulnerability to gain access to the managem…
-
High 7.8
ITarian - Local privilege escalation in Endpoint Manager agent on Windows
The ITarian Endpoint Manage Communication Client, prior to version 6.43.41148.21120, is compiled using insecure OpenSSL settings. Due to this setting, a malicious actor with low privileges access to a system can escalate his privileges to SYSTEM abusing an in…
-
High 7.5
Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely…
-
High 8.5
Improper validation vulnerability in LSOItemData prior to SMR Jun-2022 Release 1 allows attackers to launch certain act…
-
High 8.5
Improper validation vulnerability in KfaOptions prior to SMR Jun-2022 Release 1 allows attackers to launch certain acti…
-
High 8.5
Improper validation vulnerability in FeedsInfo prior to SMR Jun-2022 Release 1 allows attackers to launch certain activ…
-
High 8.5
Improper validation vulnerability in RemoteViews prior to SMR Jun-2022 Release 1 allows attackers to launch certain act…
-
High 7.5
Node DOS by way of memory exhaustion through ExecSync request in CRI-O
A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after co…
-
High 7.3
SourceCodester Prison Management System New User Creation improper authorization
A vulnerability classified as critical was found in SourceCodester Prison Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Users.php?f=save of the component New User Creation. The manipulation leads to imp…
-
High 7.8
Out-of-bounds Write in vim/vim
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
-
High 7.5
DoS Vulnerability in URLEncodedFormDecoder in Vapor
Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with the following request: `curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -…
-
High 7.5
Server-Side Request Forgery in Jodd HTTP
Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers to execute Server-Side Request Forgery (SSRF) via a crafted …
-
High 8.2
Multiple evaluation of contract address in call in vyper
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incor…
-
High 7.5
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.…
-
High 7.5
Improper Check for Unusual or Exceptional Conditions in Elasticsearch
A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request.
-
High 7.7
A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE affecting all versions from 13.11 prior to…
-
High 8.8
Command injection via Advanced Networking route add functionality
An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which c…
-
High 7.5
User Account Deletion Unauthenticated
An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware…
-
High 7.5
Denial-of-Service via internal structure overflow
An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which c…
-
High 7.5
Unauthenticated Firmware Upload and Arbitrary Reboot
An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502…
-
High 8.8
Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.
-
High 8.8CVE-2022-29778 Public exploit
D-Link DIR-890L 1.20b01 allows attackers to execute arbitrary code due to the hardcoded option Wake-On-Lan for the para…
-
High 8.1
Command Injection
The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags ca…
-
High 7.3
Demokratian install3.php privileges management
A vulnerability classified as critical has been found in Demokratian. This affects an unknown part of the file install/install3.php. The manipulation leads to privilege escalation. It is possible to initiate the attack remotely. The exploit has been disclosed…
-
High 7.3
Demokratian genera_select.php sql injection
A vulnerability was found in Demokratian. It has been rated as critical. Affected by this issue is some unknown functionality of the file basicos_php/genera_select.php. The manipulation of the argument id_provincia with the input -1%20union%20all%20select%201…
-
High 8.8
SevOne Network Management System Traceroute traceroute.php command injection
A vulnerability classified as critical has been found in SevOne Network Management System up to 5.7.2.22. This affects the file traceroute.php of the Traceroute Handler. The manipulation leads to privilege escalation with a command injection. It is possible t…
-
High 7.5
Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO
MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO is vulnerable to an unending go-routine buildup while keeping connections established due to HTTP cl…
-
High 8.3
A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account whe…
-
High 8.2
A CWE-311: Missing Encryption of Sensitive Data vulnerability exists that could allow authentication credentials to be …
-
High 8.2
A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could allow unauthorized access when a…
-
High 8.6
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized…
-
High 8.0
A CWE-20: Improper Input Validation vulnerability exists that could cause potential remote code execution when an attac…
-
High 7.4
Owl Labs Meeting Owl 5.2.0.15 allows attackers to retrieve the passcode hash via a certain c 10 value over Bluetooth.
-
High 7.4
Owl Labs Meeting Owl 5.2.0.15 allows attackers to deactivate the passcode protection mechanism via a certain c 11 messa…
-
High 8.2
Owl Labs Meeting Owl 5.2.0.15 does not require a password for Bluetooth commands, because only client-side authenticati…
-
High 7.4
Owl Labs Meeting Owl 5.2.0.15 allows attackers to activate Tethering Mode with hard-coded hoothoot credentials via a ce…
-
High 8.1
Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication att…
-
High 7.5
PowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X & T environments running versions 2.0.0.x…
-
High 7.5
Denial of service binding form from JSON in Play Framework
Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 of Play's forms library, in both the Scala and Java APIs. This can occur when using either the `Form#bindFromRequest` m…
-
High 7.5
Phoenix-ws source code and data in extensions folder is publicly available
### Impact All of the source code, files, and folders in `phoenix_files/extensions/` are available to end users through a simple HTTP GET request. ### Patches The issue has been patched. The users of version 1.0.6 and above are not effected.