Archive
June 2022
Vulnerabilities first published in this month (UTC), newest first.
2,191 results · Feed
-
Unscored —
x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text ex…
-
Unscored —
Emlog Pro v 1.0.4 cross-site scripting (XSS) in Emlog Pro background management.
-
Critical 9.8
Excessive Attack Surface in tooljet/tooljet
Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0.
-
High 7.3
MONyog Ultimate Cookie privileges management
A vulnerability, which was classified as critical, was found in MONyog Ultimate 6.63. This affects an unknown part of the component Cookie Handler. The manipulation of the argument HasServerEdit/IsAdmin leads to privilege escalation. It is possible to initiat…
-
Critical 9.0
Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1.
-
Critical 10.0
OS Command Injection in gogs/gogs
OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9.
-
Unscored —
In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remot…
-
Unscored —
ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer.
-
Unscored —
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Insecure permissions for the serverconfi…
-
Unscored —
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. The transmission of cleartext LDAP bind …
-
Unscored —
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the PrefDBCredent…
-
Unscored —
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the LDAPDesPWEncr…
-
Unscored —CVE-2022-32195 Scanner template
Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL.
-
Unscored —CVE-2022-32272 Public exploit
OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before …
-
Unscored —
A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container…
-
High 7.5
Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle
Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a …
-
High 7.5
Fix failure to strip Authorization header on HTTP downgrade in Guzzle
Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should no…
-
Unscored —
CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby varia…
-
Unscored —
LibreHealth EHR Base 2.0.0 allows incorrect interface/super/manage_site_files.php access.
-
Unscored —
A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to read arbitrar…
-
Unscored —
A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execu…
-
Medium —
`MsQueue` `push`/`pop` use the wrong orderings
Affected versions of this crate use orderings which are too weak to support this data structure. It is likely this has caused memory corruption in the wild: <https://github.com/crossbeam-rs/crossbeam/issues/97#issuecomment-412785919>.
-
Critical 9.8
Backdoor in api-res-py
api-res-py package in PyPI 0.1 is vulnerable to a code execution backdoor in the request package.
-
Unscored —
pyanxdns package in PyPI version 0.2 is vulnerable to code execution backdoor. The impact is: execute arbitrary code (r…
-
Unscored —
ZAngband zangband-data 2.7.5 is affected by an integer underflow vulnerability in src/tk/plat.c through the variable fi…
-
Medium 5.4
XSS vulnerability in repository issue list in Gogs
Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 `DisplayName` does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commi…
-
Critical 9.8
The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current …
-
Medium 6.1
Cross-site Scripting in Dolibarr
Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page.
-
Unscored —CVE-2022-31325 Public exploit
There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php.
-
Unscored —
A Cross Site Scripting vulnerabilty exists in PartKeepr 1.4.0 via the 'name' field in /api/part_categories.
-
Unscored —
An issue was discovered in certain Verbatim drives through 2022-03-31. Due to missing integrity checks, an attacker can…
-
Unscored —
An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they can be unlocked …
-
Unscored —
As a result of an observable discrepancy in returned messages, OPSWAT MetaDefender Core (MDCore) before 5.1.2 could all…
-
Unscored —
ToaruOS 1.99.2 is affected by incorrect access control via the kernel. Improper MMU management and having a low GDT add…
-
Unscored —
A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by out-of-bound r…
-
Unscored —
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Air Conditioning System G-150AD Ver. 3.21 and prior, …
-
High 8.1CVE-2022-1993 EPSS 37%
Path Traversal in gogs/gogs
Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.
-
Critical 10.0
Path Traversal in gogs/gogs
Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.
-
Unscored —
H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the EditMacList parameter at /…
-
Unscored —
H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the AddMacList parameter at /g…