Archive
June 2022
Vulnerabilities first published in this month (UTC), newest first.
2,191 results · Feed
-
High 7.8
Adobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction i…
-
High 7.5
Security Update for the OPC UA .NET Standard Stack
An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message.
-
High 7.8
Adobe InDesign SVG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction i…
-
High 7.8
Adobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction i…
-
High 7.8
Adobe InDesign Font Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interac…
-
High 7.8
Adobe InDesign PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction i…
-
High 7.8
Adobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction i…
-
High 7.8
Adobe InDesign Font Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interac…
-
High 8.8
Escalate Privileges to Server Admin - Robohelp Server
RoboHelp Server earlier versions than RHS 11 Update 3 are affected by an Improper Authorization vulnerability which could lead to privilege escalation. An authenticated attacker could leverage this vulnerability to achieve full administrator privileges. Explo…
-
Unscored —CVE-2022-31298 Public exploit
A cross-site scripting vulnerability in the ads comment section of Haraj v3.7 allows attackers to execute arbitrary web…
-
Unscored —
A PHP code injection vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker to gain RCE through the Mai…
-
High 7.5
Incorrect Implementation of Authentication Algorithm in OPCFoundation.NetStandard.Opc.Ua.Core
OPC UA .NET Standard Stack allows a remote attacker to bypass the application authentication check via crafted fake credentials.
-
Unscored —
Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter i…
-
Unscored —
A stored XSS vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker for arbitrary JavaScript code execu…
-
Unscored —
Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in vi…
-
High 7.5
Swift-corelibs-foundation denial of service in JSON decoding with JSONDecoder
A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document containing a type mismatch. This vulnerability is caused by the interaction between a deserialization mech…
-
Unscored —
Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in …
-
Medium 5.5
synaTEE.signed.dll Out-Of-Bounds Heap Write
Improper Input Validation vulnerability in synaTEE.signed.dll of Synaptics Fingerprint Driver allows a local authorized attacker to overwrite a heap tag, with potential loss of confidentiality. This issue affects: Synaptics Synaptics Fingerprint Driver 5.1.xx…
-
Unscored —
VMware HCX update addresses an information disclosure vulnerability. A malicious actor with network user access to the …
-
Unscored —
A maliciously crafted TIF file in Autodesk 3ds Max 2022 and 2021 can be used to write beyond the allocated buffer while…
-
Unscored —
A maliciously crafted TIF file can be forced to read beyond allocated boundaries in Autodesk 3ds Max 2022, and 2021 whe…
-
Unscored —
Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via zms/admin/public_html/save_animal?an_id=24.
-
Unscored —
Online Discussion Forum Site v1.0 is vulnerable to Cross Site Scripting (XSS) via /odfs/classes/Master.php?f=save_categ…
-
Unscored —
Online Tutor Portal Site v1.0 is vulnerable to SQL Injection via /otps/classes/Master.php?f=delete_team.
-
Unscored —
Online Discussion Forum Site v1.0 is vulnerable to SQL Injection via /odfs/classes/Master.php?f=delete_team.
-
Unscored —
Online Tutor Portal Site v1.0 is vulnerable to Cross Site Scripting (XSS). via /otps/classes/Master.php.
-
Unscored —
MERCURY MIPC451-4 1.0.22 Build 220105 Rel.55642n was discovered to contain a remote code execution (RCE) vulnerability …
-
Unscored —
Xiaomi Lamp 1 v2.0.4_0066 was discovered to be vulnerable to replay attacks. This allows attackers to to bypass the exp…
-
Unscored —
Student Registration and Fee Payment System v1.0 is vulnerable to SQL Injection via /scms/student.php.
-
Unscored —
Online Fire Reporting System v1.0 is vulnerable to Cross Site Scripting (XSS) via /ofrs/classes/Master.php.
-
Unscored —
Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function.
-
Unscored —CVE-2022-31300 Public exploit
A cross-site scripting vulnerability in the DM Section component of Haraj v3.7 allows attackers to execute arbitrary we…
-
Unscored —
Wiris Mathtype v7.28.0 was discovered to contain a path traversal vulnerability in the resourceFile parameter. This vul…
-
Low 3.5
weblizar User Login Log Plugin Stored cross site scriting
A vulnerability was found in weblizar User Login Log Plugin 2.2.1. It has been classified as problematic. Affected is an unknown function. The manipulation leads to basic cross site scripting (Stored). It is possible to launch the attack remotely. The exploit…
-
Low 3.5
BestWebSoft Contact Form Plugin Stored cross site scriting
A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has bee…
-
Low 3.5
XYZScripts Contact Form Manager Plugin cross site scriting
A vulnerability was found in XYZScripts Contact Form Manager Plugin. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely. The exploit…
-
Medium 4.3
XYZScripts Contact Form Manager Plugin cross-site request forgery
A vulnerability was found in XYZScripts Contact Form Manager Plugin. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. Th…
-
Unscored —
SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the…
-
Critical 9.8
XML External Entity Reference in drools
drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.
-
High 7.1
Weak Password Requirements in kromitgmbh/titra
Weak Password Requirements in GitHub repository kromitgmbh/titra prior to 0.78.1.