Archive
12 July 2022
Vulnerabilities first published on this day (UTC), newest first.
186 results · Feed
-
High 7.5CVE-2022-22025 EPSS 33%
Windows Internet Information Services Cachuri Module Denial of Service Vulnerability
Windows Internet Information Services Cachuri Module Denial of Service Vulnerability
-
High 7.8
Windows Fax Service Remote Code Execution Vulnerability
Windows Fax Service Remote Code Execution Vulnerability
-
Medium 6.6
Windows Portable Device Enumerator Service Security Feature Bypass Vulnerability
Windows Portable Device Enumerator Service Security Feature Bypass Vulnerability
-
High 7.1
Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
-
Medium 4.7
Windows Kernel Information Disclosure Vulnerability
Windows Kernel Information Disclosure Vulnerability
-
Low 2.6
Cross-site Scripting for Argo CD single sign on users
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with 2.3.0 and prior to 2.3.6 and 2.4.5 is vulnerable to a cross-site scripting (XSS) bug which could allow an attacker to inject arbitrary JavaScript in the `/auth/cal…
-
High 8.3
Argo CD's certificate verification is skipped for connections to OIDC providers
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerable to an improper certificate validation bug which could cause Argo CD to trust a malicious (or othe…
-
Critical 9.8CVE-2022-35628 EPSS 27%
SQL Injection in typo3 extension "LUX - TYPO3 Marketing Automation"
A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.
-
Medium 5.4
Cross site scripting in ameos_tarteaucitron
The ameos_tarteaucitron (aka AMEOS - TarteAuCitron GDPR cookie banner and tracking management / French RGPD compatible) extension before 1.2.23 for TYPO3 allows XSS.
-
Unscored —
Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022…
-
Medium 5.4
brotkrueml/schema fails to properly encode user input for output in HTML context, leading to XSS
The schema (aka Embedding schema.org vocabulary) extension before 1.13.1 and 2.x before 2.5.1 for TYPO3 allows XSS.
-
Unscored —
The oelib (aka One is Enough Library) extension through 4.1.5 for TYPO3 allows SQL Injection.
-
Unscored —
The seminars (aka Seminar Manager) extension through 4.1.3 for TYPO3 allows SQL Injection.
-
Unscored —
VMware vRealize Log Insight in versions prior to 8.8.2 contain a stored cross-site scripting vulnerability due to impro…
-
Unscored —
VMware vRealize Log Insight in versions prior to 8.8.2 contain a stored cross-site scripting vulnerability due to impro…
-
Critical 9.8
Pyramid Solutions EtherNet/IP Adapter Development Kit Out-of-bound Write
Pyramid Solutions' affected products, the Developer and DLL kits for EtherNet/IP Adapter and EtherNet/IP Scanner, are vulnerable to an out-of-bounds write, which may allow an unauthorized attacker to send a specially crafted packet that may result in a denial…
-
Critical 9.9
Improper access control allows admin privilege escalation in Argo CD
All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.
-
Unscored —
Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /dev/pts/ and /dev/…
-
High 8.2
Git for Windows' installer can be tricked into executing an untrusted binary
Git for Windows is a fork of Git that contains Windows-specific patches. This vulnerability in versions prior to 2.37.1 lets Git for Windows' installer execute a binary into `C:\mingw64\bin\git.exe` by mistake. This only happens upon a fresh install, not when…
-
Medium 4.9
Zulip Server public data export contains attachments that are non-public
Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server administrators, which provides a way to download a "public data" export. While this export is only acces…
-
Unscored —
A vulnerability was found in libguestfs. This issue occurs while calculating the greatest possible number of matching k…
-
Unscored —
Under special integration scenario of SAP Business one and SAP HANA - version 10.0, an attacker can exploit HANA cockpi…
-
Unscored —
SAP Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled…
-
Unscored —
SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would o…
-
Unscored —
SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-…
-
Unscored —
A vulnerability in SAP NW EP (WPC) - versions 7.30, 7.31, 7.40, 7.50, which does not sufficiently validate user-control…
-
Unscored —
SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-…
-
Unscored —
When a user opens manipulated JPEG 2000 (.jp2, jp2k.x3d) files received from untrusted sources in SAP 3D Visual Enterpr…
-
Unscored —
SAP BusinessObjects Business Intelligence Platform (LCM) - versions 420, 430, allows an attacker with an admin privileg…
-
Unscored —
SAP NetWeaver Enterprise Portal does - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, not sufficiently encode user-…
-
Unscored —
Due to improper input sanitization of XML input in SAP Business One - version 10.0, an attacker can perform a denial-of…
-
Unscored —
SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution…
-
Unscored —
Due to missing input validation in the Manage Checkbooks component of SAP S/4HANA - version 101, 102, 103, 104, 105, 10…
-
Unscored —
SAP Business One client - version 10.0 allows an attacker with low privileges, to inject code that can be executed by t…
-
Unscored —
SAP BusinessObjects BW Publisher Service - versions 420, 430, uses a search path that contains an unquoted element. A l…
-
Unscored —
Within SAP S/4HANA - versions S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE 127, the application business partner exten…
-
Unscored —
Due to missing authentication check, SAP Business one License service API - version 10.0 allows an unauthenticated atta…
-
Unscored —
Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.x - versions 420,430 allows user Administ…
-
Unscored —
The application SAP Enterprise Extension Defense Forces & Public Security - versions 605, 606, 616,617,618, 802, 803, 8…
-
Unscored —
Due to insufficient input validation, SAP Business Objects - version 420, allows an authenticated attacker to submit a …