Archive
July 2022
Vulnerabilities first published in this month (UTC), newest first.
1,993 results · Feed
-
Medium 6.3
WordPress Social Share Buttons by Supsystic plugin <= 2.2.3 - Multiple Broken Access Control vulnerabilities
Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.
-
High 8.5
WordPress Social Share Buttons by Supsystic plugin <= 2.2.3 - Multiple Authenticated SQL Injection (SQLi) vulnerabilities
Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.
-
Medium 5.4CVE-2022-29495 Scanner template
WordPress Popup Builder plugin <= 4.1.11 - Cross-Site Request Forgery (CSRF) leading to plugin settings update
Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.11 at WordPress allows an attacker to update plugin settings.
-
Medium 4.3
Itech Movie Portal Script movie.php Reflected cross site scripting
A vulnerability was found in Itech Movie Portal Script 7.36. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /movie.php. The manipulation of the argument f with the input <img src=i onerror=prompt(1)> leads t…
-
Medium 6.3
Itech Movie Portal Script show_news.php Error sql injection
A vulnerability was found in Itech Movie Portal Script 7.36. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /show_news.php. The manipulation of the argument id with the input AND (SELECT 1222 FROM(SELE…
-
Medium 4.3
Potential XSS on Special:SearchCenter
Cross-site Scripting (XSS) vulnerability in "Extension:ExtendedSearch" of Hallo Welt! GmbH BlueSpice allows attacker to inject arbitrary HTML (XSS) on page "Special:SearchCenter", using the search term in the URL.
-
Medium 4.3
Potential XSS in title URL parameter
Cross-site Scripting (XSS) vulnerability in the "commonuserinterface" component of BlueSpice allows an attacker to inject arbitrary HTML into a page using the title parameter of the call URL.
-
Unscored —
information leakage vulnerability exists in the Xiaomi SmartHome APP. This vulnerability is caused by illegal calls of …
-
Unscored —
Information leakage vulnerability exists in the Mi Sound APP. This vulnerability is caused by illegal calls of some sen…
-
Medium 4.3
Denial-of-Service (DoS) Vulnerability
A Denial-of-Service vulnerability was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed APK file it is possible that can crash the scanning engine.
-
Medium 4.3
Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aepack.dll component can crash the scanning engine.
-
High 8.1
Advantech iView
The affected product is vulnerable to a SQL injection with high attack complexity, which may allow an unauthorized attacker to disclose information.
-
Critical 9.8
Advantech iView
The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.
-
High 8.8
Advantech iView
The affected product is vulnerable to multiple SQL injections that require low privileges for exploitation and may allow an unauthorized attacker to disclose information.
-
High 7.5CVE-2022-2135 EPSS 11%
Advantech iView
The affected product is vulnerable to multiple SQL injections, which may allow an unauthorized attacker to disclose information.
-
High 8.2CVE-2022-2138 EPSS 12%
Advantech iView
The affected product is vulnerable due to missing authentication, which may allow an attacker to read or modify sensitive data and execute arbitrary code, resulting in a denial-of-service condition.
-
Medium 6.5CVE-2022-2139 EPSS 16%
Advantech iView
The affected product is vulnerable to directory traversal, which may allow an attacker to access unauthorized files and execute arbitrary code.
-
Medium 4.9
Advantech iView
The affected product is vulnerable to two SQL injections that require high privileges for exploitation and may allow an unauthorized attacker to disclose information
-
Medium 5.3
Metasys ADS/ADX/OAS with MUI
Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users.
-
Unscored —
An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon sessio…
-
Medium 6.5
Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21.
-
Unscored —
The eziod package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party.
-
Critical 9.8
The scu-captcha package in PyPI v0.0.1 to v0.0.4 included a code execution backdoor inserted by a third party.
-
Unscored —
The wikifaces package in PyPI v1.0 included a code execution backdoor inserted by a third party.
-
Unscored —
The PyCrowdTangle package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party.
-
Unscored —
Radare2 v5.7.2 was discovered to contain a NULL pointer dereference via the function r_bin_file_xtr_load_buffer at bin/…
-
Unscored —
QPDF v8.4.2 was discovered to contain a heap buffer overflow via the function QPDF::processXRefStream. This vulnerabili…
-
Unscored —
Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function consume_encoded_name_new at format/was…
-
Unscored —
The bin-collect package in PyPI before v0.1 included a code execution backdoor inserted by a third party.
-
Unscored —
The bin-collection package in PyPI before v0.1 included a code execution backdoor inserted by a third party.
-
Medium 5.4
Zulip Server insufficient authorization for changing bot roles
Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is f…
-
Unscored —
The Better PDF Exporter add-on 10.0.0 for Atlassian Jira is prone to stored XSS via a crafted description to the PDF Te…
-
Unscored —
Safety issues in `pkcs11`
### Impact The interface of `pkcs11` is subject to a number of safety issues, mainly related to handling of raw pointers. Despite presenting a safe interface, many of the functions and methods that rely on inputs which contain pointers (attributes and mechani…
-
Medium 6.8
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.21.
-
Medium 6.3
Cross-site Scripting (XSS) - Stored in openemr/openemr
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.
-
High 8.3
Data Access from Outside Expected Data Manager Component in openemr/openemr
Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.
-
Unscored —
An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers…
-
Unscored —
Type confusion in V8 in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corr…
-
High 7.5
Use-after-free in io_uring ad work_flags in Linux Kernel
io_uring use work_flags to determine which identity need to grab from the calling process to make sure it is consistent with the calling process when executing IORING_OP. Some operations are missing some types, which can lead to incorrect reference counts whi…
-
Critical 10.0
Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository
### Impact This vulnerability would allow any user, regardless of permissions, to upload content into a repository. This affects installations of Islandora core 2.0 or greater. ### Patches Upgrade immediately to the [latest release](https://github.com/Islando…