Archive
6 July 2022
Vulnerabilities first published on this day (UTC), newest first.
95 results · Feed
-
Unscored —
Tenda AC23 v16.03.07.44 is vulnerable to Stack Overflow that will allow for the execution of arbitrary code (remote).
-
Unscored —CVE-2022-32386 EPSS 10%
Tenda AC23 v16.03.07.44 was discovered to contain a buffer overflow via fromAdvSetMacMtuWan.
-
Unscored —CVE-2022-30591 Public exploit
quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant i…
-
Unscored —
The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control. It listens on a random, unpriv…
-
Low 3.7
Reflected XSS in graphs page of Zabbix Frontend
An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to pr…
-
Low 3.7
Reflected XSS in discovery page of Zabbix Frontend
An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to…
-
Low 3.1
JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific…
-
Critical 9.8
Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issues
Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a do…
-
Medium 4.9
JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Adm…
-
Medium 6.1
JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one…
-
High 8.1
Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote …
-
Critical 9.8
Apache Commons Configuration insecure interpolation defaults
Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configura…
-
High 7.5
Inefficient Regular Expression Complexity in moment
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 par…
-
Critical 10.0
Authentication Bypass in Roxy-wi
Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to bypass authentication and access admin functionality by sending a specially crafted HTT…
-
Unscored —
There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers…