Archive
June 2022
Vulnerabilities first published in this month (UTC), newest first.
2,191 results · Feed
-
Medium 6.5
ABB Relion REX640 Insufficient file access control
Incorrect Permission Assignment for Critical Resource vulnerability in ABB REX640 PCL1, REX640 PCL2, REX640 PCL3 allows an authenticated attacker to launch an attack against the user database file and try to take control of an affected system node.
-
Unscored —
A flaw was found in AMQ Broker Operator 7.9.4 installed via UI using OperatorHub where a low-privilege user that has ac…
-
Unscored —
A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the gru…
-
Medium 5.9
AtlasVPN - Privilege Escalation
AtlasVPN - Privilege Escalation Lack of proper security controls on named pipe messages can allow an attacker with low privileges to send a malicious payload and gain SYSTEM permissions on a windows computer where the AtlasVPN client is installed.
-
High 7.5
Denial of Service in Spring Cloud Function
In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service condition due to the caching issue in the Function Catalog component of the framework.
-
Unscored —
A maliciously crafted PDF file may be used to dereference a pointer for read or write operation while parsing PDF files…
-
Unscored —
A maliciously crafted TGA file in Autodesk AutoCAD 2023 may be used to write beyond the allocated buffer while parsing …
-
Unscored —
A maliciously crafted CAT file in Autodesk AutoCAD 2023 can be used to trigger use-after-free vulnerability. Exploitati…
-
Unscored —
A maliciously crafted JT file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to trigger use-after-free vulnerab…
-
Unscored —
Autodesk AutoCAD product suite, Revit, Design Review and Navisworks releases using PDFTron prior to 9.1.17 version may …
-
Unscored —
A maliciously crafted TIFF file in Autodesk AutoCAD 2023 can be forced to read and write beyond allocated boundaries wh…
-
Unscored —
An authenticated attacker could read arbitrary files from the underlying operating system of the scanner using a custom…
-
Unscored —
An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with …
-
Unscored —
Comodo Antivirus 12.2.2.8012 has a quarantine flaw that allows privilege escalation. To escalate privilege, a low-privi…
-
Medium 6.1
Cross-site Scripting in krayin/laravel-crm
Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting (XSS).
-
Unscored —
IdeaLMS 2022 allows reflected Cross Site Scripting (XSS) via the IdeaLMS/Class/Assessment/ PATH_INFO.
-
Unscored —
iSpy v7.2.2.0 is vulnerable to remote command execution via path traversal.
-
Unscored —
iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL.
-
Unscored —
The UserTakeOver plugin before 4.0.1 for ILIAS allows an attacker to list all users via the search function.
-
Unscored —CVE-2022-23342 Public exploit
The Hyland Onbase Application Server releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.100…
-
Unscored —
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
Unscored —
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
Unscored —
Unioncms v1.0.13 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Default settings.
-
Unscored —
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
Unscored —
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
Unscored —CVE-2022-33119 Scanner template
NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerab…
-
Unscored —CVE-2022-31373 Scanner template
SolarView Compact v6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Solar_AiC…
-
Unscored —
An arbitrary file upload vulnerability /images/background/1.php in of SolarView Compact 6.0 allows attackers to execute…
-
Unscored —
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_vmcode_interpreter at src/njs_v…
-
Unscored —
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_string_offset at src/njs_string…
-
Unscored —
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_convert_to_slow_array at …
-
Unscored —
maccms10 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.
-
Unscored —
maccms8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.
-
Unscored —
Recipes - Stored XSS in Name Parameter
In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Keyword, Food and Unit components. When a victim accesses the Keyword/Food/Unit endpoints, the XSS payload will trigger. A low privileged att…
-
Unscored —
Recipes - Stored XSS in Clipboard
In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in copy to clipboard functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and c…
-
Unscored —
Recipes - Stored XSS in Add to Cart
In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and click…
-
Critical 9.8
Insufficient Verification of Data Vulnerability in ProConOS/ProConOS eCLR SDK and MULTIPROG Engineering tool
An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.
-
Critical 9.8
Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers
An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.
-
Medium 6.3
Hindu Matrimonial Script reports.php privileges management
A vulnerability, which was classified as critical, was found in Hindu Matrimonial Script. This affects an unknown part of the file /admin/reports.php. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. The…
-
Medium 6.3
Hindu Matrimonial Script googleads.php privileges management
A vulnerability, which was classified as critical, has been found in Hindu Matrimonial Script. Affected by this issue is some unknown functionality of the file /admin/googleads.php. The manipulation leads to improper privilege management. The attack may be la…