Archive
23 August 2022
Vulnerabilities first published on this day (UTC), newest first.
90 results · Feed
-
Medium 6.1
WordPress Notification Bar for WordPress plugin <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in 8 Degree Themes otification Bar for WordPress plugin <= 1.1.8 at WordPress.
-
Medium 4.8
WordPress Uploading SVG, WEBP and ICO files plugin <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.
-
Medium 6.4
Improper Restriction of Rendered UI Layers or Frames in notrinos/notrinoserp
Improper Restriction of Rendered UI Layers or Frames in GitHub repository notrinos/notrinoserp prior to 0.7.
-
Unscored —
BlueCMS 1.6 has SQL injection in line 132 of admin/article.php
-
Unscored —
BlueCMS 1.6 has SQL injection in line 55 of admin/model.php
-
Unscored —CVE-2022-37113 EPSS 16%
Bluecms 1.6 has SQL injection in line 132 of admin/area.php
-
Critical 9.8
SQL injection in jflyfox jfinal
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list.
-
Critical 9.8
SQL injection in jflyfox jfinal
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list.
-
Unscored —
An arbitrary file deletion vulnerability was discovered in taocms 3.0.2, that allows attacker to delete file in server …
-
Unscored —
An access control issue in TrendNet TV-IP572PI v1.0 allows unauthenticated attackers to access sensitive system informa…
-
Unscored —
The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without aut…
-
Low 3.5
ConsoleTVs Noxen users.php cross site scripting
A vulnerability classified as problematic has been found in ConsoleTVs Noxen. Affected is an unknown function of the file /Noxen-master/users.php. The manipulation of the argument create_user_username with the input "><script>alert(/xss/)</script> leads to cr…
-
Medium 5.3
CODESYS Visualization vulnerable to user enumeration
All CODESYS Visualization versions before V4.2.0.0 generate a login dialog vulnerable to information exposure allowing a remote, unauthenticated attacker to enumerate valid users.
-
Medium 6.7
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4.
-
Medium 6.1
Stored cross-site scripting vulnerability in PukiWiki versions 1.3.1 to 1.5.3 allows a remote attacker to inject an arb…
-
Unscored —
Path traversal vulnerability in PukiWiki versions 1.4.5 to 1.5.3 allows a remote authenticated attacker with an adminis…
-
Unscored —
Reflected cross-site scripting vulnerability in PukiWiki versions 1.5.1 to 1.5.3 allows a remote attacker to inject an …
-
High 7.5
Denial of Service (DoS)
All versions of package asneg/opcuastack are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending…
-
High 7.5
Denial of Service (DoS)
The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimite…
-
High 7.5
Denial of Service (DoS)
The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can ex…
-
High 7.5
Denial of Service (DoS)
All versions of package freeopcua/freeopcua are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.
-
High 7.5
Denial of Service (DoS)
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an …
-
High 7.5
Denial of Service (DoS)
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit.
-
High 7.5
Denial of Service (DoS)
All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vu…
-
High 7.5
Denial of Service (DoS)
All versions of package asneg/opcuastack are vulnerable to Denial of Service (DoS) due to a missing handler for failed casting when unvalidated data is forwarded to boost::get function in OpcUaNodeIdBase.h. Exploiting this vulnerability is possible when sendi…
-
High 8.8
Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
-
Unscored —
Missing authentication for critical function vulnerability in UNIMO Technology digital video recorders (UDR-JA1004/JA10…
-
Unscored —
Fiserv Prologue through 2020-12-16 does not properly protect the database password. If an attacker were to gain access …
-
Unscored —CVE-2022-34919 Public exploit
The file upload wizard in Zengenti Contensis Classic before 15.2.1.79 does not correctly check that a user has authenti…
-
Medium 6.1
Path Traversal in Gravitee API Management
HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /management/users/register request.
-
Unscored —
TP-Link Archer A7 Archer A7(US)_V5_210519 is affected by a command injection vulnerability in /usr/bin/tddp. The vulner…
-
Medium 5.3
Exposure of Sensitive Information in OPCFoundation.NetStandard.Opc.Ua.Server
OPC UA .NET Standard Reference Server 1.04.368 allows a remote attacker to cause the application to access sensitive information.
-
Unscored —
A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png fil…
-
Medium 6.1
HTML Injection in ActiveMQ Artemis Web Console
In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.
-
Unscored —
VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with lo…
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0246.
-
Unscored —
A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is disabled by d…
-
Medium 6.5
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multip…
-
Unscored —
An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control…
-
Unscored —
A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this …