Archive
June 2022
Vulnerabilities first published in this month (UTC), newest first.
2,191 results · Feed
-
Unscored —
MyAdmin v1.0 is affected by an incorrect access control vulnerability in viewing personal center in /api/user/userData?…
-
Unscored —
Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin …
-
Unscored —
There is a buffer overflow in gps-sdr-sim v1.0 when parsing long command line parameters, which can lead to DoS or code…
-
Unscored —
Nucleus CMS v3.71 is affected by a file upload vulnerability. In this vulnerability, we can use upload to change the up…
-
Unscored —
Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI35…
-
Unscored —
A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in th…
-
Medium 6.1
Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data
In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an a…
-
Unscored —
A cross-site scripting (XSS) vulnerability in the batch add function of Urtracker Premium v4.0.1.1477 allows attackers …
-
Critical 9.8
Prototype Pollution in deep.assign
deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').
-
Unscored —
EyesOfNetwork before 07-07-2021 has a Remote Code Execution vulnerability on the mail options configuration page. In th…
-
Medium 6.5
A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user …
-
Medium 6.3
Online Hotel Booking System Pro roomtype-details.php sql injection
A vulnerability classified as critical was found in Online Hotel Booking System Pro 1.2. Affected by this vulnerability is an unknown functionality of the file /roomtype-details.php. The manipulation of the argument tid leads to sql injection. The attack can …
-
Medium 6.3
Online Hotel Booking System Pro Plugin roomtype-details.php sql injection
A vulnerability classified as critical has been found in Online Hotel Booking System Pro Plugin 1.0. Affected is an unknown function of the file /front/roomtype-details.php. The manipulation of the argument tid leads to sql injection. It is possible to launch…
-
High 8.8
Viscosity DLL untrusted search path
A vulnerability was found in Viscosity 1.6.7. It has been classified as critical. This affects an unknown part of the component DLL Handler. The manipulation leads to untrusted search path. It is possible to initiate the attack remotely. The exploit has been …
-
Low 3.5
Bitrix Site Manager Contact Form cross site scripting
A vulnerability classified as problematic was found in Bitrix Site Manager 12.06.2015. Affected by this vulnerability is an unknown functionality of the component Contact Form. The manipulation of the argument text with the input <img src="http://1"; on onerr…
-
High 7.8
Teradici Management Console Database Management privileges management
A vulnerability was found in Teradici Management Console 2.2.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Database Management. The manipulation leads to improper privilege management. It is p…
-
Unscored —CVE-2022-2078 Public exploit
A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an attacker to t…
-
Medium 5.5
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file…
-
High 7.8
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
-
Medium 5.5
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file…
-
Medium 5.5
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file…
-
Unscored —
In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md…
-
Unscored —
The firmware of EDIMAX IC-3140W Version 3.11 is hardcoded with Administrator username and password.
-
Unscored —
Joy ebike Wolf Manufacturing year 2022 is vulnerable to Denial of service, which allows remote attackers to jam the key…
-
Critical 9.1CVE-2022-2073 EPSS 11%
Code Injection in getgrav/grav
Code Injection in GitHub repository getgrav/grav prior to 1.7.34.
-
Medium 5.3
Denial of Service (DoS) vulnerability in RSSHub
RSSHub is an open source, extensible RSS feed generator. In commits prior to 5c4177441417 passing some special values to the `filter` and `filterout` parameters can cause an abnormally high CPU. This results in an impact on the performance of the servers and …
-
High 7.2
SQL injection via the field name of a tracker in Tuleap
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.95 Tuleap does not sanitize properly user inputs when constructing the SQL query to retrieve data for the tracker reports. An a…
-
Medium 6.5
Cross site scripting via the title of a document in Tuleap
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.111 the title of a document is not properly escaped in the search result of MyDocmanSearch widget and in the administration pag…
-
Medium 4.3
Resources of private projects can be exposed in Tuleap
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.58 authorizations are not properly verified when creating projects or trackers from projects marked as templates. Users can get…
-
Unscored —
This module enables you to create and manage a version of taxonomy based on configuration entities instead of content. …
-
Unscored —
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
Unscored —
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
High 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
High 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
Unscored —
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
Unscored —
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
Unscored —
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
Unscored —
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
Unscored —
The Lottiefiles Field module enables you to integrate the lottiefiles features into your page. The module does not suff…
-
Medium 4.3
TrueConf Server cross-site request forgery
A vulnerability classified as problematic was found in TrueConf Server 4.3.7. This vulnerability affects unknown code of the file /admin/service/stop/. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has…