Archive
June 2022
Vulnerabilities first published in this month (UTC), newest first.
2,191 results · Feed
-
Low 3.5
TrueConf Server change-lang redirect
A vulnerability classified as problematic has been found in TrueConf Server 4.3.7. This affects an unknown part of the file /admin/general/change-lang. The manipulation of the argument redirect_url leads to open redirect. It is possible to initiate the attack…
-
Low 3.5
TrueConf Server DOM cross site scripting
A vulnerability was found in TrueConf Server 4.3.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/conferences/list/. The manipulation of the argument domxss leads to basic cross site scripting (DOM).…
-
Low 3.5
TrueConf Server group DOM cross site scripting
A vulnerability was found in TrueConf Server 4.3.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/group. The manipulation leads to basic cross site scripting (DOM). The attack can be launche…
-
Low 3.5
TrueConf Server Reflected cross site scripting
A vulnerability was found in TrueConf Server 4.3.7. It has been classified as problematic. Affected is an unknown function of the file /admin/group/list/. The manipulation of the argument checked_group_id leads to basic cross site scripting (Reflected). It is…
-
Low 3.5
TrueConf Server Reflected cross site scripting
A vulnerability was found in TrueConf Server 4.3.7 and classified as problematic. This issue affects some unknown processing of the file /admin/conferences/list/. The manipulation of the argument sort leads to basic cross site scripting (Reflected). The attac…
-
Low 3.5
TrueConf Server Reflected cross site scripting
A vulnerability has been found in TrueConf Server 4.3.7 and classified as problematic. This vulnerability affects unknown code of the file /admin/conferences/get-all-status/. The manipulation of the argument keys[] leads to basic cross site scripting (Reflect…
-
Low 3.5
TrueConf Server Stored cross site scripting
A vulnerability, which was classified as problematic, was found in TrueConf Server 4.3.7. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclos…
-
Medium 6.1
IBM Security Guardium 11.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja…
-
Medium 4.3
Open Redirect in microweber/microweber
Open Redirect in GitHub repository microweber/microweber prior to 1.2.19.
-
Unscored —
MetaMask before 10.11.3 might allow an attacker to access a user's secret recovery phrase because an input field is use…
-
Unscored —
ApiFest OAuth 2.0 Server 0.3.1 does not validate the redirect URI in accordance with RFC 6749 and is susceptible to an …
-
Unscored —
Incorrect permissions for the folder C:\ProgramData\NoMachine\var\uninstall of Nomachine v7.9.2 allows attackers to per…
-
Unscored —
A binary hijack in Orwell-Dev-Cpp v5.11 allows attackers to execute arbitrary code via a crafted .exe file.
-
Unscored —
A binary hijack in Embarcadero Dev-CPP v6.3 allows attackers to execute arbitrary code via a crafted .exe file.
-
Unscored —
XLPD v7.0.0094 and below contains an unquoted service path vulnerability which allows local users to launch processes w…
-
Unscored —
CVA6 commit 909d85a gives incorrect permission to use special multiplication units when the format of instructions is w…
-
Unscored —
CVA6 commit 909d85a accesses invalid memory when reading the value of MHPMCOUNTER30.
-
Critical 9.8CVE-2022-33107 EPSS 24%
Deserialization of Untrusted Data in topthink/framework
ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.php. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
-
Unscored —
Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attrib…
-
High 7.8
IVPN Client privileges management
A vulnerability has been found in IVPN Client 2.6.6120.33863 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument --up cmd leads to improper privilege management. The attack needs to be appro…
-
High 7.3
Teleopti WFM Administration privileges management
A vulnerability, which was classified as critical, was found in Teleopti WFM 7.1.0. This affects an unknown part of the component Administration. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. The expl…
-
Medium 4.3
Teleopti WFM Administration Credentials information disclosure
A vulnerability, which was classified as problematic, has been found in Teleopti WFM up to 7.1.0. Affected by this issue is some unknown functionality of the component Administration. The manipulation as part of JSON leads to information disclosure (Credentia…
-
Medium 4.3
Teleopti WFM Administration GetOneTenant Credentials information disclosure
A vulnerability classified as problematic was found in Teleopti WFM up to 7.1.0. Affected by this vulnerability is an unknown functionality of the file /TeleoptiWFM/Administration/GetOneTenant of the component Administration. The manipulation leads to informa…
-
Low 3.5
Easy Table Plugin options-general.php cross site scripting
A vulnerability classified as problematic has been found in Easy Table Plugin 1.6. This affects an unknown part of the file /wordpress/wp-admin/options-general.php. The manipulation with the input "><script>alert(1)</script> leads to basic cross site scriptin…
-
Unscored —CVE-2022-29272 Scanner template
In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing.
-
Unscored —
In Nagios XI through 5.8.5, a read-only Nagios user (due to an incorrect permission check) is able to schedule downtime…
-
Unscored —
In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address.
-
Unscored —
In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that…
-
Medium 5.4
Stored XSS in link tags added via XHR in SilverStripe Framework
In SilverStripe Framework through 2022-04-07, Stored XSS can occur in javascript link tags added via XMLHttpRequest (XHR).
-
Unscored —
In ILIAS through 7.10, lack of verification when changing an email address (on the Profile Page) allows remote attacker…
-
Unscored —CVE-2022-31897 Public exploit
SourceCodester Zoo Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via public_html/register_visitor?m…
-
High 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
Medium —
Uncontrolled Resource Consumption in Spray JSON
Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.
-
Critical 9.8
Authentication Bypass Vulnerability
Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
-
Medium 5.4
Stored XSS via HTML fields in SilverStripe Framework
Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in…
-
Medium 4.3
Unpublished, protected files can be published via shortcode
Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by changing an existing image short code on website content.
-
Medium 6.5
Hybridsessions does not expire session id on logout
Silverstripe silverstripe/framework through 4.10 allows Session Fixation.
-
Medium 6.5
Quadratic blowup in Convert::xml2array()
Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted XML document.
-
Unscored —
A reflected Cross Site Scripting (XSS) in wuzhicms v4.1.0 allows remote attackers to execute arbitrary web script or HT…
-
Unscored —
File inclusion vulnerability in Minicms v1.9 allows remote attackers to execute arbitary PHP code via post-edit.php.