Archive
July 2022
Vulnerabilities first published in this month (UTC), newest first.
1,993 results · Feed
-
Medium 5.8
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could disclose sensitive information due to improper privileg…
-
Medium 5.3
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently protected credentials for use…
-
High 8.0
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to elevate their privilege to p…
-
Medium 4.6
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow IBM tenant credenti…
-
Medium 4.2
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user to access information from a tenant of whi…
-
Medium 5.3
IBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.16, 7.0.0.0 through 7.0.5.11, 7.1.0.0 through 7.1.2.7, and 7.2.0.0 thr…
-
Medium 5.4
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.2…
-
Medium 6.5
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.2…
-
Medium 5.5
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.2…
-
Medium 5.4
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.2…
-
Medium 4.0
IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could al…
-
High 7.5CVE-2022-2591 Public exploit
TEM FLEX-1085 reboot denial of service
A vulnerability classified as critical has been found in TEM FLEX-1085 1.6.0. Affected is an unknown function of the file /sistema/flash/reboot. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been di…
-
Unscored —
The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the …
-
Low 3.9
HCL Commerce could allow a local attacker to obtain sensitive personal information (CVE-2021-27785)
HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the victim to first perform a particular operation on the website.
-
Unscored —
EllieGrid Android Application version 3.4.1 is vulnerable to Code Injection. The application appears to evaluate user i…
-
Unscored —
A link following vulnerability in the scanning function of Trend Micro Apex One and Worry-Free Business Security agents…
-
Unscored —
Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerabili…
-
Unscored —
Trend Micro VPN Proxy Pro version 5.2.1026 and below contains a vulnerability involving some overly permissive folders …
-
Unscored —CVE-2022-34531 EPSS 24%
DedeCMS v5.7.95 was discovered to contain a remote code execution (RCE) vulnerability via the component mytag_ main.php.
-
Unscored —
D-Link DSL-3782 v1.03 and below was discovered to contain a stack overflow via the function getAttrValue.
-
Unscored —CVE-2022-34527 Public exploit
D-Link DSL-3782 v1.03 and below was discovered to contain a command injection vulnerability via the function byte_4C016…
-
Medium —
Scrapy before 2.6.2 and 1.8.3 vulnerable to one proxy sending credentials to another
### Impact When the [built-in HTTP proxy downloader middleware](https://docs.scrapy.org/en/2.6/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpproxy) processes a request with `proxy` metadata, and that `proxy` metadata includes proxy…
-
Unscored —
Hiby R3 PRO firmware v1.5 to v1.7 was discovered to contain a file upload vulnerability via the file upload feature.
-
High —
mezzio-swoole Applications Using Diactoros Vulnerable to HTTP Host Header Attack
### Impact mezzio-swoole applications using Diactoros for their PSR-7 implementation, and which are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a `Laminas\Diactoros\Uri` instance…
-
High 7.5
async-graphql / async-graphql - @DOS GraphQL Nested Fragments overflow
### Impact Executing deeply nested queries may cause stack overflow. ### Patches Upgrade to `v4.0.6`
-
Unscored —
Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture A…
-
Unscored —
Improper Neutralization of Special Elements used in an SQL Command leading to Unauthenticated SQL Injection vulnerabili…
-
High 7.5
chia-blockchain tokens can be inflated to an arbitrary extent
An inflation issue was discovered in Chia Network CAT1 Standard 1.0.0. Previously minted tokens minted on the Chia blockchain using the CAT1 standard can be inflated to an arbitrary extent by any holder of any amount of the token. The total amount of the toke…
-
Unscored —
Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remo…
-
Unscored —
A Double Free vulnerability allows remote attackers to execute arbitrary code through DesignReview.exe application on P…
-
Unscored —
A maliciously crafted TIFF file when consumed through DesignReview.exe application can be forced to read beyond allocat…
-
Unscored —
A maliciously crafted TGA or PCX file may be used to write beyond the allocated buffer through DesignReview.exe applica…
-
Unscored —
Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows …
-
Medium 4.8
WordPress Floating Div plugin <= 3.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Floating Div plugin <= 3.0 at WordPress.
-
Medium 5.3
Algorithm incorrectly returning error and Invalid unreduced value written to output buffer
When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is returned from the library, and an invalid unreduced value is written to the output buffer. This may be leveraged by an …
-
Medium 5.3
Shared secret or Point multiplication of NIST P-256 points with X coordinate of zero
When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero, the resulting output is not properly reduced modulo the P-256 field prime and is invalid. The resulting output may cause an error when used…
-
Medium 5.3
Point Compression/Decompression of NIST P-256 points with X coordinate of zero
When compressing or decompressing a point on the NIST P-256 elliptic curve with an X coordinate of zero, the resulting output is not properly reduced modulo the P-256 field prime and is invalid. The resulting output will cause an error when used in other oper…
-
Medium 5.3
Sweet-B Library: Point compress/decompress using the wrong bit for sign
When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is used. An attacker with user level privileges and no other user's assistance can exploit this vulnerability with only knowledge of the public …
-
Unscored —
XSS in User Interface
The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. This field was not properly sanitized and can lead to cross-site scripting (XSS). This issue was resolved in Velociraptor …
-
Unscored —
Filesystem race on temporary files
On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file. This issue was resolved in Velociraptor 0.6.5-2.