Archive
19 July 2022
Vulnerabilities first published on this day (UTC), newest first.
136 results · Feed
-
Medium 5.3
CRLF injection in request headers
undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to elim…
-
High 7.0CVE-2022-31144 Public exploit
Potential heap overflow in Redis
Redis is an in-memory database that persists on disk. A specially crafted `XAUTOCLAIM` command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7…
-
Medium 5.5
The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (app…
-
Unscored —
DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux element in lz…
-
Unscored —
DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux element in b…
-
Unscored —
DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in qtdemux_infl…
-
Unscored —
DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in matroskaparse eleme…
-
Unscored —
DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux element in g…
-
Unscored —
Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a heap overwrite …
-
Unscored —
Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a command injection vulnerability in t…
-
Unscored —
Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a command injection vulnerability in t…
-
Unscored —
Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a command injection vulnerability in t…
-
Unscored —
Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a cross-site scripting (XSS) vulnerabi…
-
Unscored —
Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows attackers to access the core log file and perform session…
-
Unscored —CVE-2022-34534 Scanner template
Digital Watchdog DW Spectrum Server 4.2.0.32842 allows attackers to access sensitive infromation via a crafted API call.
-
Unscored —
Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows unauthenticated attackers to view internal paths and scri…
-
Unscored —
Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the body function at /web/api/v…
-
Unscored —
Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the generate_response function …
-
Unscored —
Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the handle_file_upload function…
-
Unscored —
Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the post function at /web/api/v…
-
Medium 6.5
TIBCO Data Virtualization Access Control Vulnerability
The Column Based Security component of TIBCO Software Inc.'s TIBCO Data Virtualization and TIBCO Data Virtualization for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with network access to obtain read acce…
-
Medium 4.1
Sensitive Parameter Exposure in Puppet Bolt prior to 3.24
Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, such as via Puppet Enterprise.
-
Unscored —
Shanghai Feixun Data Communication Technology Co., Ltd router fir302b A2 was discovered to contain a remote command exe…
-
Unscored —CVE-2022-34024 Public exploit
Barangay Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the resident modul…
-
Unscored —
Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at …
-
Medium 5.4
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site scripting. This vul…
-
Medium 5.4
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery (S…
-
High 7.5
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to …
-
Medium 4.3
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery whi…
-
High 7.1
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injecti…
-
Unscored —
Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously.
-
Critical 9.8
Grails framework Remote Code Execution via Data Binding
In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 configurations are used), data binding allows a remote attacker to execute code by gaining access to the class loader.
-
Low 3.8
GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client
-
Unscored —
A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions…
-
Unscored —
A deserialization vulnerability in a .NET framework class used and not properly checked by Flexi Soft Designer in all v…
-
Medium 4.6
HCL BigFix Web Reports authorized users may perform HTML injection.
BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.
-
Medium 5.0
HCL BigFix Web Reports authorized users may see sensitive information in clear text
BigFix Web Reports authorized users may see SMTP credentials in clear text.
-
Critical 9.8
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote cod…
KEV Sep 22, 2022 -
Unscored —
Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance user…
-
High 7.5
Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attacke…