Archive
July 2022
Vulnerabilities first published in this month (UTC), newest first.
1,993 results · Feed
-
Unscored —
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in nasmlib/alloc.c.
-
Unscored —
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer d…
-
Unscored —
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer d…
-
Unscored —
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer d…
-
Unscored —
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is Integer overfl…
-
Unscored —
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer o…
-
Unscored —
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There are memory leaks …
-
High 8.1
Zero Trust Secure Web Gateway policies bypass using WARP client subcommands
By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security policies (e.g. Secure Web Gateway policies) and features such as 'Lock WARP switch'.
-
Unscored —
Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to a…
-
High 7.5
untangle vulnerable to XML Entity Expansion
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service…
-
High 7.5
untangle vulnerable to Improper Restriction of XML External Entity Reference
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the contents of local fil…
-
Unscored —
Open redirect vulnerability in Booked versions prior to 3.3 allows a remote unauthenticated attacker to redirect a user…
-
High 8.2
Out-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioning
In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning.
-
High 8.2
Out-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioning
In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning.
-
Unscored —
The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and fr…
-
Medium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remot…
-
Unscored —
insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels unaware of L1TF…
-
Unscored —
A vulnerability in adm.cgi of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a cra…
-
Unscored —CVE-2022-34576 Scanner template
A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute ar…
-
Unscored —
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key inf…
-
Unscored —
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key inf…
-
Unscored —
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to arbitrarily config…
-
Unscored —
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the system …
-
Unscored —
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the telnet …
-
Unscored —
WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain th…
-
Critical 9.0CVE-2022-35131 Public exploit
Joplin is vulnerable to arbitrary code execution
Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.
-
Unscored —CVE-2022-34906 EPSS 11%
A hard-coded cryptographic key is used in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an …
-
Unscored —CVE-2022-34907 EPSS 16%
An authentication bypass vulnerability exists in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could al…
-
High 7.2
WordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerability
Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress.
-
High 8.2
Cross-site Scripting Vulnerability in USB Backups App
Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privileges access to drives being backed up to construct and inject JavaScript payloads into an authenticated user's browser.…
-
High 7.3
Weak Default SSL use in Port Forwarding Service
The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to configure port forwarding rules. This was enabled to maintain compatibility with old or outdated home routers. By using an "SSL" context instead of "TLS"…
-
Unscored —
OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an HTML injection vulnerability via t…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation …
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation …
-
High 8.1CVE-2022-35871 EPSS 41%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation …
-
High 8.8CVE-2022-35870 EPSS 44%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation …
-
High 7.5CVE-2022-35869 EPSS 60%
This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation I…
-
Low 3.5
Stored Cross Site-Scripting in Agent Manager
In Pandora FMS v7.0NG.761 and below, in the agent creation section, the alias parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administrator privileges logged in the system.
-
Low 3.5
Stored Cross Site-Scripting in File Manager
In Pandora FMS v7.0NG.761 and below, in the file manager section, the dirname parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administrator privileges logged in the system.
-
High 7.2
WordPress Flipbox plugin <= 2.6.0 - Authenticated WordPress Options Change vulnerability
Authenticated WordPress Options Change vulnerability in Biplob Adhikari's Flipbox plugin <= 2.6.0 at WordPress.