Archive
14 July 2022
Vulnerabilities first published on this day (UTC), newest first.
68 results · Feed
-
Unscored —
A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-ba…
-
High 7.7
ProxyAgent vulnerable to MITM
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally …
-
Unscored —
A reflected DOM-Based XSS vulnerability has been discovered in the Help directory of Veeam Management Pack for Microsof…
-
Unscored —CVE-2022-32223 Public exploit
Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulner…
-
Unscored —
A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by heap overflow …
-
Medium 4.3
Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aeheur.dll component can crash the scanning engine. The exploit can be triggered remotely by an attacker.
-
Unscored —CVE-2022-30024 Public exploit
A buffer overflow in the httpd daemon on TP-Link TL-WR841N V12 (firmware version 3.16.9) devices allows an authenticate…
-
Unscored —
Electronic mall system 1.0_build20200203 is affected vulnerable to SQL Injection.
-
Unscored —
Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not validate the user-provided URL within the crtcmode functio…
-
Unscored —
On Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 devices, the RPC endpoint crtc_fw_upgrade provides a means of p…
-
Unscored —
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC e…
-
Unscored —
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC e…
-
Unscored —
Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not properly sanitize user-controlled parameters within the cr…
-
Unscored —
Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the D…
-
Unscored —
Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the c…
-
Unscored —
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC e…
-
Low 3.5
SourceCodester Simple e-Learning System claire_blake cross site scripting
A vulnerability classified as problematic was found in SourceCodester Simple e-Learning System 1.0. Affected by this vulnerability is an unknown functionality of the file /vcs/claire_blake. The manipulation of the argument Bio with the input "><script>alert(d…
-
Unscored —
Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search.
-
Unscored —
Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an atta…
-
Unscored —
Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via Scripted Action tools.
-
Unscored —
Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool.
-
Medium 6.3
LogoStore search.php sql injection
A vulnerability was found in LogoStore. It has been classified as critical. Affected is an unknown function of the file /LogoStore/search.php. The manipulation of the argument query with the input test' UNION ALL SELECT CONCAT(CONCAT('qqkkq','VnPVWVaYxljWqGpL…
-
Unscored —
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAl…
-
Critical 9.1CVE-2022-32214 EPSS 82%
llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
-
Critical 9.1CVE-2022-32213 EPSS 45%
llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
-
Unscored —CVE-2022-32215 EPSS 70%
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line …
-
Unscored —
The MPlayer Project v1.5 was discovered to contain a heap use-after-free resulting in a double free in the preinit func…
-
Unscored —
A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default p…