Archive
18 July 2022
Vulnerabilities first published on this day (UTC), newest first.
36 results · Clear filters · Feed
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2…
-
High 7.8CVE-2022-28672 Public exploit
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2…
-
High 7.6
An attacker that gains service access to the FSP (POWER9 only) or gains admin authority to a partition can compromise p…
-
High 7.2
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager v…
-
High 7.8
A relative path traversal vulnerability [CWE-23] in FortiClient for Windows versions 7.0.2 and prior, 6.4.6 and prior a…
-
High 7.7
An execution with unnecessary privileges vulnerability [CWE-250] in FortiClientWindows 7.0.0 through 7.0.3, 6.4.0 throu…
-
High 7.8
A path traversal vulnerability [CWE-22] in FortiAP-U CLI 6.2.0 through 6.2.3, 6.0.0 through 6.0.4, 5.4.0 through 5.4.6 …
-
High 8.1
A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2…
-
High 8.8
FreeMind WP Browser <= 1.2 - Cross-Site Request Forgery to Cross-Site Scripting
The FreeMind WP Browser plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.2. This is due to missing nonce protection on the FreemindOptions() function found in the ~/freemind-wp-browser.php file. This makes it…
-
High 8.8
DX Share Selection <= 1.4 - Cross-Site Request Forgery to Cross-Site Scripting
The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce protection on the dxss_admin_page() function found in the ~/dx-share-selection.php file. This makes it p…
-
High 8.8
Button Widget Smartsoft <= 1.0.1 - Cross-Site Request Forgery to Cross-Site Scripting
The Button Widget Smartsoft plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing nonce validation on the smartsoftbutton_settings page. This makes it possible for unauthenticated atta…
-
High 8.8
Visualizer: Tables and Charts Manager for WordPress <= 3.7.9 - Authenticated (Contributor+) PHAR Deserialization
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remote_data' parameter in versions up to, and including 3.7.9. This makes it possible for authenticated attackers with co…
-
High 8.8
AnyMind Widget <= 1.1 - Cross-Site Request Forgery to Cross-Site Scripting
The AnyMind Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1. This is due to missing nonce protection on the createDOMStructure() function found in the ~/anymind-widget-id.php file. This makes it pos…
-
High 8.8
Free Live Chat Support <= 1.0.11 - Cross-Site Request Forgery to Cross-Site Scripting
The Free Live Chat Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.11. This is due to missing nonce protection on the livesupporti_settings() function found in the ~/livesupporti.php file. This mak…
-
High 7.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (3…
-
High 7.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (3…
-
High 7.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.3 (3…
-
High 7.0
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (3…
-
High 7.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Paralle…
-
High 7.6
Cellinx NVT – IP PTZ Camera local file inclusion
Allows a remote user to read files on the camera's OS "GetFileContent.cgi". Reading arbitrary files on the camera's OS as root user.
-
High 8.2
Cellinx NVT – IP PTZ Camera Privilege Escalation
On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie values from "is_admin", "showConfig". Administrative Privileges which allows changing various confi…
-
High 7.5
Service unavailability impact in NodeJS agent(version <= 0.5.0)
A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.
-
High 8.8
Apache Spark shell command injection vulnerability via Spark UI
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in H…
KEV Mar 7, 2023 -
High 7.2
Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload
The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level pe…
-
High 8.8
An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8…