Archive
5 July 2022
Vulnerabilities first published on this day (UTC), newest first.
32 results · Feed
-
Medium 5.6
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in pycares
### Impact pycares versions < 4.2.0 are affected by [CVE-2021-3672](https://nvd.nist.gov/vuln/detail/CVE-2021-3672). ### Patches Update to version 4.2.0.
-
Unscored —
An arbitrary file upload vulnerability in Dice v4.2.0 allows attackers to execute arbitrary code via a crafted file.
-
Unscored —
So Filter Shop v3.x was discovered to contain multiple blind SQL injection vulnerabilities via the att_value_id , manu_…
-
Unscored —
Ingredient Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at…
-
Unscored —
An access control issue in Ingredient Stock Management System v1.0 allows attackers to take over user accounts via a cr…
-
Unscored —
Newsletter Module v3.x was discovered to contain a SQL injection vulnerability via the zemez_newsletter_email parameter…
-
High 7.5
Improper Restriction of Excessive Authentication Attempts in heroiclabs/nakama
Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks.
-
High 7.5
Incorrect handling of invalid surrogate pair characters in ujson
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were…
-
Unscored —CVE-2022-33075 Public exploit
A stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allo…
-
Medium 5.9
Double free of buffer during string decoding in ujson
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the …
-
Medium 5.4
SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server
Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the backend SMTP server. However, the main risk here is that the atta…
-
Unscored —
Taocms 3.0.2 was discovered to contain a blind SQL injection vulnerability via the function Edit category.
-
Medium 4.9
IBM App Connect Enterprise Certified Container 4.2 could allow a user from the administration console to cause a denial…
-
Medium 6.5
VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple Cross Site Scripting (XSS) vulnerabilities at /vicidial/admin.php.
Reflected Cross Site Scripting (XSS) vulnerabilities in AST Agent Time Sheet interface (/vicidial/AST_agent_time_sheet.php) of VICIdial via agent, and search_archived_data parameters. This issue affects: VICIdial 2.14b0.5 versions prior to 3555.
-
Medium 5.5CVE-2022-34878 Public exploit
VICIDial 2.14b0.5 SVN 3550 was discovered to contain a SQL injection vulnerability at /vicidial/user_stats.php.
SQL Injection vulnerability in User Stats interface (/vicidial/user_stats.php) of VICIdial via the file_download parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data …
-
Medium 6.4CVE-2022-34877 Public exploit
VICIDial 2.14b0.5 SVN 3550 was discovered to contains a SQL injection vulnerability at /vicidial/AST_agent_time_sheet.php.
SQL Injection vulnerability in AST Agent Time Sheet interface ((/vicidial/AST_agent_time_sheet.php) of VICIdial via the agent parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, dest…
-
Medium 5.5CVE-2022-34876 Public exploit
VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php.
SQL Injection vulnerability in admin interface (/vicidial/admin.php) of VICIdial via modify_email_accounts, access_recordings, and agentcall_email parameters allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all da…
-
Unscored —
Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspe…
-
Unscored —
Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspe…
-
Unscored —
Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspe…
-
Unscored —
Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspe…
-
Unscored —
network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data Path), a cod…
-
Unscored —
Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree to keep track…
-
High 7.5
In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. An attacke…
-
Medium 5.4
A stored Cross-site Scripting (XSS) vulnerability was identified in the Data Import functionality of OpenCTI through 5.…
-
Unscored —
ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not saniti…
-
High 7.5CVE-2022-2097 Public exploit
AES OCB fails to encrypt some bytes
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the…
-
Medium 5.3
NULL Pointer Dereference in lxml/lxml
NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through fo…
-
High 8.2
Insufficient Session Expiration in heroiclabs/nakama
Old session tokens can be used to authenticate to the application and send authenticated requests.
-
Critical 9.8
Path Traversal in Beego
The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.
-
High 7.8
Stack-based Buffer Overflow in vim/vim
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.
-
High 8.8CVE-2021-43116 Public exploit
Use of Hard-coded Credentials in Nacos
An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login.