Archive
July 2022
Vulnerabilities first published in this month (UTC), newest first.
1,993 results · Feed
-
Medium 4.1
Sensitive Parameter Exposure in Puppet Bolt prior to 3.24
Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, such as via Puppet Enterprise.
-
Unscored —
Shanghai Feixun Data Communication Technology Co., Ltd router fir302b A2 was discovered to contain a remote command exe…
-
Unscored —CVE-2022-34024 Public exploit
Barangay Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the resident modul…
-
Unscored —
Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at …
-
Medium 5.4
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site scripting. This vul…
-
Medium 5.4
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery (S…
-
High 7.5
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to …
-
Medium 4.3
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery whi…
-
High 7.1
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injecti…
-
Unscored —
Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously.
-
Critical 9.8
Grails framework Remote Code Execution via Data Binding
In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 configurations are used), data binding allows a remote attacker to execute code by gaining access to the class loader.
-
Low 3.8
GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client
-
Unscored —
A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions…
-
Unscored —
A deserialization vulnerability in a .NET framework class used and not properly checked by Flexi Soft Designer in all v…
-
Medium 4.6
HCL BigFix Web Reports authorized users may perform HTML injection.
BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.
-
Medium 5.0
HCL BigFix Web Reports authorized users may see sensitive information in clear text
BigFix Web Reports authorized users may see SMTP credentials in clear text.
-
Critical 9.8
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote cod…
KEV Sep 22, 2022 -
Unscored —
Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance user…
-
High 7.5
Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attacke…
-
Medium 4.5
This issue affects: HYPR Windows WFA versions prior to 7.2; Unsafe Deserialization vulnerability in HYPR Workforce Acce…
-
High 7.5
Forced Browsing vulnerability in HYPR Server version 6.10 to 6.15.1 allows remote attackers with a valid one-time recov…
-
High 7.8
Use After Free in gpac/gpac
Use After Free in GitHub repository gpac/gpac prior to 2.1-DEV.
-
Medium 6.3
SourceCodester Garage Management System editbrand.php sql injection
A vulnerability was found in SourceCodester Garage Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /editbrand.php. The manipulation of the argument id leads to sql injection. The attack may be initiated…
-
High 7.3CVE-2022-2467 Scanner template
SourceCodester Garage Management System login.php sql injection
A vulnerability has been found in SourceCodester Garage Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument username with the input 1@a.com' AND (SELECT 6427 FROM (…
-
Unscored —
In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy.
-
Medium 6.5
A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was ident…
-
High 7.8CVE-2022-30526 Public exploit
A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 …
-
High 7.5
Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are re…
-
Unscored —
Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while parsing avi f…
-
Critical 9.8
If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Int…
-
High 7.8
Integer Overflow or Wraparound in gpac/gpac
Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.1-DEV.
-
Unscored —
A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL …
-
Medium 5.9
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…
-
Unscored —
RISCV ISA Sim commit ac466a21df442c59962589ba296c702631e041b5 implements the incorrect exception priotrity when accessi…
-
Unscored —
The component mcontrol.action in RISCV ISA Sim commit ac466a21df442c59962589ba296c702631e041b5 contains the incorrect m…
-
Unscored —
CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a and RISCV-Boom commit ad64c5419151e5e886daee7084d8399713b46b4b imp…
-
Unscored —
The *tval of ecall/ebreak in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a was discovered to be incorrect.
-
Unscored —
CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a treats non-standard fence instructions as illegal which can affect…