Archive
25 July 2022
Vulnerabilities first published on this day (UTC), newest first.
102 results · Feed
-
Unscored —
A vulnerability in adm.cgi of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a cra…
-
Unscored —CVE-2022-34576 Scanner template
A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute ar…
-
Unscored —
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key inf…
-
Unscored —
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key inf…
-
Unscored —
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to arbitrarily config…
-
Unscored —
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the system …
-
Unscored —
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the telnet …
-
Unscored —
WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain th…
-
Critical 9.0CVE-2022-35131 Public exploit
Joplin is vulnerable to arbitrary code execution
Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.
-
Unscored —CVE-2022-34906 EPSS 11%
A hard-coded cryptographic key is used in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an …
-
Unscored —CVE-2022-34907 EPSS 16%
An authentication bypass vulnerability exists in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could al…
-
High 7.2
WordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerability
Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress.
-
High 8.2
Cross-site Scripting Vulnerability in USB Backups App
Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privileges access to drives being backed up to construct and inject JavaScript payloads into an authenticated user's browser.…
-
High 7.3
Weak Default SSL use in Port Forwarding Service
The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to configure port forwarding rules. This was enabled to maintain compatibility with old or outdated home routers. By using an "SSL" context instead of "TLS"…
-
Unscored —
OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an HTML injection vulnerability via t…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation …
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation …
-
High 8.1CVE-2022-35871 EPSS 41%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation …
-
High 8.8CVE-2022-35870 EPSS 44%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation …
-
High 7.5CVE-2022-35869 EPSS 60%
This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation I…
-
Low 3.5
Stored Cross Site-Scripting in Agent Manager
In Pandora FMS v7.0NG.761 and below, in the agent creation section, the alias parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administrator privileges logged in the system.
-
Low 3.5
Stored Cross Site-Scripting in File Manager
In Pandora FMS v7.0NG.761 and below, in the file manager section, the dirname parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administrator privileges logged in the system.
-
High 7.2
WordPress Flipbox plugin <= 2.6.0 - Authenticated WordPress Options Change vulnerability
Authenticated WordPress Options Change vulnerability in Biplob Adhikari's Flipbox plugin <= 2.6.0 at WordPress.
-
Unscored —CVE-2022-24992 Public exploit
A vulnerability in the component process.php of QR Code Generator v5.2.7 allows attackers to perform directory traversa…
-
Medium 5.3
IBM Security Verify Information Queue 10.0.2 could allow a user to obtain sensitive information that could be used in f…
-
Medium 6.8
IBM Security Verify Information Queue 10.0.2 contains hard-coded credentials, such as a password or cryptographic key, …
-
Medium 6.5
IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker …
-
Medium 5.3
IBM Security Verify Information Queue 10.0.2 could disclose sensitive information due to a missing or insecure SameSite…
-
Unscored —CVE-2022-34962 Public exploit
OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) v…
-
Critical 9.8
Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks.
-
Medium 6.1CVE-2022-35653 Scanner template
Moodle LTI module reflected XSS risk
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrar…
-
Medium 6.1
Moodle Open redirect risk in mobile auto-login feature
An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/d…
-
Medium 6.1
Moodle Stored XSS and blind SSRF possible via SCORM track details
A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and s…
-
High 7.5
Moodle Arbitrary file read when importing lesson questions
The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks.…
-
Critical 9.8CVE-2022-35649 Public exploit
Moodle PostScript Code Injection
The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation…
-
Unscored —
OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) v…
-
Unscored —CVE-2022-34961 Public exploit
OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) v…
-
Medium 5.0
HTTP Response Splitting in Hitachi Energy’s MSM Product
A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitting, which if exploited could lead an attacker to channel down harmful code into the user’s web brows…
-
Medium 5.0
Cross Site Request Forgery (CSRF) in Hitachi Energy’s MSM Product
A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This cause a Cross Site Request Forgery (CSRF),…
-
Unscored —CVE-2022-34963 Public exploit
OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) v…