Archive
28 July 2022
Vulnerabilities first published on this day (UTC), newest first.
93 results · Feed
-
Unscored —CVE-2022-34555 EPSS 23%
TP-LINK TL-R473G 2.0.1 Build 220529 Rel.65574n was discovered to contain a remote code execution vulnerability which is…
-
Unscored —CVE-2022-36752 Public exploit
png2webp v1.0.4 was discovered to contain an out-of-bounds write via the function w2p. This vulnerability is exploitabl…
-
Unscored —CVE-2022-36234 Public exploit
SimpleNetwork TCP Server commit 29bc615f0d9910eb2f59aa8dff1f54f0e3af4496 was discovered to contain a double free vulner…
-
Unscored —CVE-2022-34556 Public exploit
PicoC v3.2.2 was discovered to contain a NULL pointer dereference at variable.c.
-
Unscored —
Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at …
-
Critical 9.8
WMAgent arbitrary code execution via a crafted dbs-client package
WMAgent v1.3.3rc2 and 1.3.3rc1, reqmgr 2 1.4.1rc5 and 1.4.0rc2, reqmon 1.4.1rc5, and global-workqueue 1.4.1rc5 allows attackers to execute arbitrary code via a crafted dbs-client package.
-
High 7.4
IBM QRadar SIEM 7.3, 7.4, and 7.5 is vulnerable to local privilege escalation if this could be combined with other unkn…
-
Unscored —
Use after free in WebGPU in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap …
-
Unscored —
Realtek rtl819x-SDK before v3.6.1 allows command injection over the web interface.
-
Unscored —
Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the add…
-
Unscored —CVE-2022-30287 EPSS 69%
Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can insta…
-
Critical 10.0
sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that c…
-
Unscored —
DPTech VPN v8.1.28.0 was discovered to contain an arbitrary file read vulnerability.
-
Unscored —
Open Source Point of Sale v3.3.7 was discovered to contain an arbitrary file upload vulnerability via the Update Brandi…
-
Unscored —
Possible cross-site scripting vulnerability in libxml after commit 960f0e2.
-
Unscored —
WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, incl…
-
Unscored —
Input passed to the Pdf() function is shell escaped and passed to child_process.exec() during PDF rendering. However, t…
-
Unscored —
In zulip before 1.3.12, deactivated users could access messages if SSO was enabled.
-
Unscored —
In zulip before 1.3.12, bot API keys were accessible to other users in the same realm.
-
Unscored —
Saia Burgess Controls (SBC) PCD through 2022-05-06 allows Authentication bypass. According to FSCT-2022-0062, there is …
-
Unscored —
Saia Burgess Controls (SBC) PCD through 2022-05-06 uses a Broken or Risky Cryptographic Algorithm. According to FSCT-20…
-
Unscored —
Honeywell Experion PKS Safety Manager through 2022-05-06 has Missing Authentication for a Critical Function. According …
-
Unscored —
Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded Credentials. According to FSCT-2022-0052, there is a Honeywe…
-
Unscored —
Honeywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient Verification of Data Authenticit…
-
Unscored —
Honeywell Experion PKS Safety Manager 5.02 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0…
-
High 7.0CVE-2022-2564 EPSS 31%
Prototype Pollution in automattic/mongoose
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
-
Unscored —
In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in $file_link in class/KippoInput.cl…
-
Unscored —
In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in xss_clean() in class/KippoInput.c…
-
High 8.7
An issue has been discovered in GitLab affecting all versions starting from 15.0 before 15.0.1. Missing validation of i…
-
Medium 4.8
WordPress GS Testimonial Slider plugin <= 1.9.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress.
-
Unscored —
When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero …
-
High 8.8
Ovarro TBox Code Injection
The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution.
-
High 7.5
Ovarro TBox Use of Hard-coded Cryptographic Key
Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key.
-
High 8.8
Ovarro TBox Incorrect Permission Assignment for Critical Resource
Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file.
-
High 7.5
Ovarro TBox Relative Path Traversal
An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code execution.
-
High 7.5
Ovarro TBox Insufficiently Protected Credentials
An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks.
-
High 7.5
Ovarro TBox Uncontrolled Resource Consumption
An attacker could use specially crafted invalid Modbus frames to crash the Ovarro TBox system.
-
Unscored —
Unauthenticated redirection to a malicious website
Unauthenticated redirection to a malicious website
-
Low 3.6
In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was miss…
-
Low 3.9
In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible