Archive
July 2022
Vulnerabilities first published in this month (UTC), newest first.
530 results · Clear filters · Feed
-
Medium 6.1
Adobe RoboHelp Reflected XSS could lead to Arbitrary code execution
Adobe RoboHelp versions 2020.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within t…
-
Medium 5.5
Adobe Photoshop U3D File Parsing Access of Uninitialized Pointer Information Disclosure Vulnerability
Adobe Photoshop versions 22.5.7 (and earlier) and 23.3.2 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such…
-
Medium 5.5
Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerab…
-
Medium 5.5
Adobe Acrobat Reader DC Doc print Use-After-Free Information Disclosure Vulnerability
Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability…
-
Medium 5.5
Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerab…
-
Medium 5.5
Adobe Acrobat Reader DC Font Parsing Use-After-Free Information Disclosure Vulnerability
Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability…
-
Medium 5.5
Adobe Acrobat Reader DC Annotation print Use-After-Free Information Disclosure Vulnerability
Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability…
-
Medium 5.5
Adobe Acrobat Reader DC Doc printWithParams Use-After-Free Information Disclosure Vulnerability
Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability…
-
Medium 6.1
Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog
Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.
-
Medium 6.6
Gradle's dependency verification can ignore checksum verification when signature verification cannot be performed
Gradle is a build tool. Dependency verification is a security feature in Gradle Build Tool that was introduced to allow validation of external dependencies either through their checksum or cryptographic signatures. In versions 6.2 through 7.4.2, there are som…
-
Medium 5.1
IBM Security Verify Identity Manager 10.0 uses weaker than expected cryptographic algorithms that could allow an attack…
-
Medium 5.3
IBM Security Verify Identity Manager 10.0 uses an inadequate account lockout setting that could allow a remote attacker…
-
Medium 4.3
Guest accounts can list all public channels
The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels.
-
Medium 4.3
Malicious imports can lead to Denial of Service
The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the server by importing large files via the Slack import REST API.
-
Medium 6.5
Team members could access sensitive information of other users via an API call
Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.
-
Medium 6.5
IBM Security Verify Information Queue 10.0.2 could allow an authenticated user to cause a denial of service with a spec…
-
Medium 6.1
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to …
-
Medium 5.4
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTTP header …
-
Medium 6.5
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose highly sensiti…
-
Medium 4.3
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose sensitive info…
-
Medium 5.7
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker…
-
Medium 4.3
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 does not sufficiently monitor…
-
Medium 5.4
IBM Engineering Lifecycle Optimization - Publishing 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This v…
-
Medium 5.9
relay_cgi.cgi on Dingtian DT-R002 2CH relay devices with firmware 3.1.276A allows an attacker to replay HTTP post reque…
-
Medium 4.3
Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aeheur.dll component can crash the scanning engine. The exploit can be triggered remotely by an attacker.
-
Medium 6.3
LogoStore search.php sql injection
A vulnerability was found in LogoStore. It has been classified as critical. Affected is an unknown function of the file /LogoStore/search.php. The manipulation of the argument query with the input test' UNION ALL SELECT CONCAT(CONCAT('qqkkq','VnPVWVaYxljWqGpL…
-
Medium 5.5
A CWE-73: External Control of File Name or Path vulnerability exists that could cause loading of unauthorized firmware …
-
Medium 5.9
A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could caus…
-
Medium 5.9
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could cause loading of unauthorized…
-
Medium 5.9
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that coul…
-
Medium 5.1
A CWE-20: Improper Input Validation vulnerability exists that could cause the device watchdog function to be disabled i…
-
Medium 6.7
A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists where weak cipher suites can be used f…
-
Medium 6.8
A CWE-269: Improper Privilege Management vulnerability exists that could allow elevated functionality when guessing cre…
-
Medium 6.5
Insufficient AccessToken Expiration Check in FlyteAdmin
FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. In versions 1.1.30 and prior, authenticated users using an external identity provider can continue to use Access Tokens and ID Tokens even after…
-
Medium 5.5
The Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfb_read() fu…
-
Medium 5.4
IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary …
-
Medium 5.4
RuoYi 4.7.3 vulnerable to arbitrary file upload in background management module
An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary code via a crafted HTML file.
-
Medium 6.5
Command Injection
This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method.
-
Medium 4.6CVE-2022-32114 Public exploit
Strapi 4.1.12 Cross-site Scripting via crafted file
An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create (upload)" permission …
-
Medium 6.1
brotkrueml/typo3-matomo-integration vulnerable to Cross-Site Scripting
The matomo_integration (aka Matomo Integration) extension before 1.3.2 for TYPO3 allows XSS.