Archive
25 August 2022
Vulnerabilities first published on this day (UTC), newest first.
232 results · Feed
-
Unscored —
A heap-based buffer over-read was discovered in the get_le32 function in bele.h in UPX 4.0.0 via a crafted Mach-O file.
-
Unscored —
A heap-based buffer over-read was discovered in the acc_ua_get_be32 function in miniacc.h in UPX 4.0.0 via a crafted Ma…
-
Unscored —
An invalid memory address reference was discovered in the adjABS function in p_lx_elf.cpp in UPX 4.0.0 via a crafted Ma…
-
Unscored —
An invalid memory address reference was discovered in the elf_lookup function in p_lx_elf.cpp in UPX 4.0.0 via a crafte…
-
Unscored —
A heap-based buffer over-read was discovered in the invert_pt_dynamic function in p_lx_elf.cpp in UPX 4.0.0 via a craft…
-
Medium 6.1
SmallRye Health UI Cross-site Scripting vulnerability
It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to conduct cross-site scripting attacks.
-
Unscored —CVE-2021-3929 Public exploit
A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-202…
-
Unscored —
A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function startread() in hcom.c file. The vulne…
-
Unscored —
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allow…
-
Unscored —
A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function lsx_read_w_buf() in formats_i.c file.…
-
Unscored —
A floating point exception (divide-by-zero) issue was discovered in SoX in functon read_samples() of voc.c file. An att…
-
Unscored —
A floating point exception (divide-by-zero) issue was discovered in SoX in functon startread() of wav.c file. An attack…
-
Medium 5.4
Jfinal Cross-site Scripting vulnerability
Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module.
-
High 8.8
Cisco FXOS and NX-OS Software Cisco Discovery Protocol Denial of Service and Arbitrary Code Execution Vulnerability
A vulnerability in the Cisco Discovery Protocol feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affecte…
-
High 8.6
Cisco NX-OS Software OSPFv3 Denial of Service Vulnerability
A vulnerability in the OSPF version 3 (OSPFv3) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to incomplete input validation of spec…
-
Medium 6.7
Cisco FXOS Software Command Injection Vulnerability
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The attacker would need to have Administrator privileges on the device. This vulnerability is d…
-
High 8.8
Cisco ACI Multi-Site Orchestrator Privilege Escalation Vulnerability
A vulnerability in the API implementation of Cisco ACI Multi-Site Orchestrator (MSO) could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability is due to improper authorization on specific APIs. An attacker c…
-
Unscored —
Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the Postgre…
-
Unscored —
Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common …
-
Unscored —
There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/sr…
-
Unscored —
There is a Information Disclosure vulnerability in anjuta/plugins/document-manager/anjuta-bookmarks.c. This issue was c…
-
Unscored —
A vulnerability was found in rizin. The bug involves an ELF64 binary for the HPPA architecture. When a specially crafte…
-
High 7.5
Incorrect header handling in mod-wsgi
A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing.
-
Medium 4.7
WorkstationST - Reflected XSS in iHistorian Data Display Tags
A reflected cross-site scripting (XSS) vulnerability exists in the iHistorian Data Display of WorkstationST (<v07.09.15) could allow an attacker to compromise a victim's browser. WorkstationST is only deployed in specific, controlled environments rendering at…
-
Medium 4.7
WorkstationST - Response Splitting in AM Gateway Challenge-Response
An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST (<v07.09.15) and could allow an attacker to compromise a victim's browser/session. WorkstationST is only deployed in specific, controlled environments…
-
Unscored —
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.10P1 are susceptible to …
-
Unscored —
A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passw…
-
Medium 5.4
WordPress SEO Scout plugin <= 0.9.83 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in SEO Scout plugin <= 0.9.83 at WordPress allows attackers to trick users with administrative rights to unintentionally change the plugin settings.
-
High 8.6
ISaGRAF Workbench Deserialization of Untrusted Data CWE-502
Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Deserialization of Untrusted Data vulnerability. ISaGRAF Workbench does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a …
-
High 7.7
ISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22
Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. Crafted malicious files can allow an attacker to traverse the file system when opened by ISaGRAF Workbench. If successfully exploited, an…
-
Medium 6.1
ISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22
Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. A crafted malicious .7z exchange file may allow an attacker to gain the privileges of the ISaGRAF Workbench software when opened. If the …
-
Unscored —
A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of pro…
-
Unscored —
Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privi…
-
Unscored —CVE-2022-37159 EPSS 28%
Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload.
-
Unscored —
Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS) via SVG file upload.
-
Unscored —
Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS). An attacker can obtain javascript code executio…
-
Unscored —
RuoYi v3.8.3 has a Weak password vulnerability in the management system.
-
Unscored —
Tenda AX12 V22.03.01.21_CN is vulnerable to Buffer Overflow. This overflow is triggered in the sub_42FDE4 function, whi…
-
Unscored —
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the curren…
-
Unscored —
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the rulles…