Archive
25 July 2022
Vulnerabilities first published on this day (UTC), newest first.
28 results · Clear filters · Feed
-
High 7.2
WordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerability
Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress.
-
High 8.2
Cross-site Scripting Vulnerability in USB Backups App
Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privileges access to drives being backed up to construct and inject JavaScript payloads into an authenticated user's browser.…
-
High 7.3
Weak Default SSL use in Port Forwarding Service
The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to configure port forwarding rules. This was enabled to maintain compatibility with old or outdated home routers. By using an "SSL" context instead of "TLS"…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation …
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation …
-
High 8.1CVE-2022-35871 EPSS 41%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation …
-
High 8.8CVE-2022-35870 EPSS 44%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation …
-
High 7.5CVE-2022-35869 EPSS 60%
This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation I…
-
High 7.2
WordPress Flipbox plugin <= 2.6.0 - Authenticated WordPress Options Change vulnerability
Authenticated WordPress Options Change vulnerability in Biplob Adhikari's Flipbox plugin <= 2.6.0 at WordPress.
-
High 7.5
Moodle Arbitrary file read when importing lesson questions
The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks.…
-
High 8.5
OpenKM XXE Injection
OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack.
-
High 7.5
Prototype Pollution
All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.
-
High 7.3
Cross-site Scripting (XSS)
This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped.
-
High 7.3
Command Injection
This affects all versions of package google-cloudstorage-commands.
-
High 7.3
Prototype Pollution
This affects the package properties-reader before 2.2.0.
-
High 8.6
Arbitrary Code Execution
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.
-
High 8.6
Arbitrary Code Execution
This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located in line 79 in the index file "index.js".
-
High 7.3
Prototype Pollution
This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context.
-
High 7.3
Prototype Pollution
This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context.
-
High 7.3
Prototype Pollution
This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context.
-
High 7.3
Cross-site Scripting (XSS)
This affects all versions of package markdown-it-decorate. An attacker can add an event handler or use javascript:xxx for the link.
-
High 8.0
Cross-site Scripting (XSS) - Reflected in beancount/fava
Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.
-
High 8.0
Cross-site Scripting (XSS) - Reflected in beancount/fava
The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.
-
High 8.0CVE-2022-36450 EPSS 21%
Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open i…
-
High 8.6
An issue was discovered in Atos Unify OpenScape SBC 9 and 10 before 10R2.2.1, Atos Unify OpenScape Branch 9 and 10 befo…
-
High 8.6
Mistune vulnerable to catastrophic backtracking
In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.
-
High 7.2
OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerabilit…
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061.