Archive
1 July 2022
Vulnerabilities first published on this day (UTC), newest first.
84 results · Feed
-
Unscored —
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the command parameter in the functio…
-
Unscored —
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the url parameter in the function FU…
-
Unscored —
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the functi…
-
Unscored —
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc, week, sTime, eTime paramet…
-
Unscored —
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function F…
-
Unscored —
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the functi…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.26 allows remote unauthenticated users to inject arbitrary we…
-
Critical 9.8
Unsafe yaml deserialization in NVFlare
NVFLARE, versions prior to 2.1.2, contains a vulnerability in its utils module, where YAML files are loaded via yaml.load() instead of yaml.safe_load(). The deserialization of Untrusted Data, may allow an unprivileged network attacker to cause Remote Code Exe…
-
Critical 9.8
Unsafe deserialisation in the PKI implementation scheme of NVFlare
NVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe deserialization. The deserialization of Untrusted Data may allow an unprivileged network attacker to c…
-
Low 3.1
An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting f…
-
Medium 4.3
A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5…
-
Medium 5.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 14.10.5, all versions sta…
-
Low 3.5
An issue has been discovered in GitLab affecting all versions starting from 12.4 before 14.10.5, all versions starting …
-
High 7.5
An improper authorization issue in GitLab CE/EE affecting all versions from 13.7 prior to 14.10.5, 15.0 prior to 15.0.4…
-
Medium 6.3
Cross-Site Scripting in Canarytoken history
Canarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identified in the history page of triggered Canarytokens. This permits an attacker who recognised an HTTP-based Canarytoken (a…
-
Medium 5.3
Information exposure in GitLab EE affecting all versions from 12.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 pri…
-
Low 3.1
An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 prior to 14.10.5, 15.0 prior to 15.0.4, a…
-
Low 2.7
An issue has been discovered in GitLab EE affecting all versions starting from 12.2 prior to 14.10.5, 15.0 prior to 15.…
-
Medium 6.5
Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 …
-
High 8.1CVE-2022-2230 EPSS 58%
A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from 14…
-
Low 3.1
Improper access control in the runner jobs API in GitLab CE/EE affecting all versions prior to 14.10.5, 15.0 prior to 1…
-
Medium 5.0
An access control vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4…
-
High 8.7
Insufficient sanitization in GitLab EE's external issue tracker affecting all versions from 14.5 prior to 14.10.5, 15.0…
-
Critical 9.9
A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior t…
-
Low 2.6
An information disclosure vulnerability in GitLab EE affecting all versions from 12.5 prior to 14.10.5, 15.0 prior to 1…
-
Medium 4.3
An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior t…
-
Medium 4.7
An open redirect vulnerability in GitLab EE/CE affecting all versions from 11.1 prior to 14.10.5, 15.0 prior to 15.0.4,…
-
Medium 6.2
Distributed Data Systems WebHMI Cross-site Scripting
A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 can store a script that could impact other logged in users.
-
Critical 9.1
Distributed Data Systems WebHMI OS Command Injection
A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 may send OS commands to execute on the host server.
-
Unscored —
Multiple persistent cross-site scripting (XSS) flaws were found in the way Aerogear handled certain user-supplied conte…
-
Unscored —
The simplepush server iterates through the application installations and pushes a notification to the server provided b…
-
Unscored —
Das U-Boot from v2020.10 to v2022.07-rc3 was discovered to contain an out-of-bounds write via the function sqfs_readdir…
-
Unscored —
An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error …
-
Low 3.5
In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services
-
Medium 6.6
NULL Pointer Dereference in bfabiszewski/libmobi
NULL Pointer Dereference in GitHub repository bfabiszewski/libmobi prior to 0.11.
-
Medium 6.5
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.
-
Critical 9.8
RSA implementation bug in AVX512IFMA instructions
The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happe…
-
Unscored —
JPEGOPTIM v1.4.7 was discovered to contain a segmentation violation which is caused by a READ memory access at jpegopti…
-
Unscored —
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.
-
Unscored —
MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobas…