Archive
July 2022
Vulnerabilities first published in this month (UTC), newest first.
1,993 results · Feed
-
Unscored —
VMware vRealize Log Insight in versions prior to 8.8.2 contain a stored cross-site scripting vulnerability due to impro…
-
Critical 9.8
Pyramid Solutions EtherNet/IP Adapter Development Kit Out-of-bound Write
Pyramid Solutions' affected products, the Developer and DLL kits for EtherNet/IP Adapter and EtherNet/IP Scanner, are vulnerable to an out-of-bounds write, which may allow an unauthorized attacker to send a specially crafted packet that may result in a denial…
-
Critical 9.9
Improper access control allows admin privilege escalation in Argo CD
All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.
-
Unscored —
Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /dev/pts/ and /dev/…
-
High 8.2
Git for Windows' installer can be tricked into executing an untrusted binary
Git for Windows is a fork of Git that contains Windows-specific patches. This vulnerability in versions prior to 2.37.1 lets Git for Windows' installer execute a binary into `C:\mingw64\bin\git.exe` by mistake. This only happens upon a fresh install, not when…
-
Medium 4.9
Zulip Server public data export contains attachments that are non-public
Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server administrators, which provides a way to download a "public data" export. While this export is only acces…
-
Unscored —
A vulnerability was found in libguestfs. This issue occurs while calculating the greatest possible number of matching k…
-
Unscored —
Under special integration scenario of SAP Business one and SAP HANA - version 10.0, an attacker can exploit HANA cockpi…
-
Unscored —
SAP Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled…
-
Unscored —
SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would o…
-
Unscored —
SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-…
-
Unscored —
A vulnerability in SAP NW EP (WPC) - versions 7.30, 7.31, 7.40, 7.50, which does not sufficiently validate user-control…
-
Unscored —
SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-…
-
Unscored —
When a user opens manipulated JPEG 2000 (.jp2, jp2k.x3d) files received from untrusted sources in SAP 3D Visual Enterpr…
-
Unscored —
SAP BusinessObjects Business Intelligence Platform (LCM) - versions 420, 430, allows an attacker with an admin privileg…
-
Unscored —
SAP NetWeaver Enterprise Portal does - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, not sufficiently encode user-…
-
Unscored —
Due to improper input sanitization of XML input in SAP Business One - version 10.0, an attacker can perform a denial-of…
-
Unscored —
SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution…
-
Unscored —
Due to missing input validation in the Manage Checkbooks component of SAP S/4HANA - version 101, 102, 103, 104, 105, 10…
-
Unscored —
SAP Business One client - version 10.0 allows an attacker with low privileges, to inject code that can be executed by t…
-
Unscored —
SAP BusinessObjects BW Publisher Service - versions 420, 430, uses a search path that contains an unquoted element. A l…
-
Unscored —
Within SAP S/4HANA - versions S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE 127, the application business partner exten…
-
Unscored —
Due to missing authentication check, SAP Business one License service API - version 10.0 allows an unauthenticated atta…
-
Unscored —
Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.x - versions 420,430 allows user Administ…
-
Unscored —
The application SAP Enterprise Extension Defense Forces & Public Security - versions 605, 606, 616,617,618, 802, 803, 8…
-
Unscored —
Due to insufficient input validation, SAP Business Objects - version 420, allows an authenticated attacker to submit a …
-
Unscored —
SAP Busines Objects Business Intelligence Platform (Visual Difference Application) - versions 420, 430, allows an authe…
-
Medium 6.8
Command Injection Vulnerability on My Cloud Home
Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially allowed an attacker to execute unsigned code on My Cloud Home devices.
-
High 8.0
Protecting AWS credentials stored in plaintext on My Cloud Home
Implemented protections on AWS credentials that were not properly protected.
-
High 8.1
Race Condition in October CMS upload process
October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the `fromData` method, an un…
-
Low 3.7
IBM QRadar SIEM 7.3, 7.4, and 7.5 may be vulnerable to partial denial of service attack, resulting in some protocols no…
-
Medium 5.3
IBM QRadar Network Security 5.4.0 and 5.5.0 discloses sensitive information to unauthorized users which could be used t…
-
Medium 6.8
IBM QRadar Network Security 5.4.0 and 5.5.0 contains hard-coded credentials, such as a password or cryptographic key, w…
-
Low 3.5
SourceCodester Simple Parking Management System category cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester Simple Parking Management System 1.0. This affects an unknown part of the file /ci_spms/admin/category. The manipulation of the argument vehicle_type with the input "><script>al…
-
Low 3.5
SourceCodester Simple Parking Management System cross site scripting
A vulnerability, which was classified as problematic, has been found in SourceCodester Simple Parking Management System 1.0. Affected by this issue is some unknown functionality of the file /ci_spms/admin/search/searching/. The manipulation of the argument se…
-
High 7.3
SourceCodester Clinics Patient Management System Login Page index.php sql injection
A vulnerability has been found in SourceCodester Clinics Patient Management System 2.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /pms/index.php of the component Login Page. The manipulation of the argum…
-
Medium 6.3CVE-2022-2297 Public exploit
SourceCodester Clinics Patient Management System unrestricted upload
A vulnerability, which was classified as critical, was found in SourceCodester Clinics Patient Management System 2.0. Affected is an unknown function of the file /pms/update_user.php?user_id=1. The manipulation of the argument profile_picture with the input <…
-
Unscored —CVE-2022-29900 Public exploit
Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain mic…
-
High 8.1
AccessKeyID validation bypass
A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.
-
Medium 5.4
Cross-site Scripting (XSS)
The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects …