Archive
29 August 2022
Vulnerabilities first published on this day (UTC), newest first.
102 results · Feed
-
Unscored —
Leaflet Maps Marker < 3.12.5 - Admin+ SQLi
The Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) WordPress plugin before 3.12.5 does not properly sanitize some parameters before inserting them into SQL queries. As a result, high privilege users could perform SQL injection attacks.
-
Unscored —CVE-2022-36200 Public exploit
In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed.
-
Unscored —
A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user conn…
-
Unscored —
A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime li…
-
Unscored —
A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to cra…
-
Unscored —
A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel() function of quantum-private.h file. This vulner…
-
Unscored —
A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. …
-
Unscored —
There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the comma…
-
Unscored —
A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace.
-
Unscored —
There is a flaw in convert2rhel. When the --activationkey option is used with convert2rhel, the activation key is subse…
-
Unscored —
A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.
-
Unscored —
An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux Kernel. This fla…
-
Unscored —
A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancil…
-
Unscored —
A vulnerbiility was found in Openscad, where a DXF-format drawing with particular (not necessarily malformed!) properti…
-
Unscored —
A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory ex…
-
Unscored —
A vulnerbiility was found in Openscad, where a .scad file with no trailing newline could cause an out-of-bounds read du…
-
Unscored —
A flaw was found in the copying tool `nbdcopy` of libnbd. When performing multi-threaded copies using asynchronous nbd …
-
Medium 4.9
python-oslo-utils has improper password parsing
A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.
-
Unscored —
An out-of-bounds read vulnerability was discovered in linux kernel in the smc protocol stack, causing remote dos.
-
Unscored —
A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h'. This vuln…
-
High 7.5
A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a c…
-
Medium 4.9
Pinniped Supervisor Insufficient Session Expiration vulnerability
An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper…
-
Unscored —
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter a…
-
Unscored —
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month paramete…
-
Unscored —
Ingredients Stock Management System v1.0 was discovered to contain an arbitrary file deletion vulnerability via the com…
-
Unscored —
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month paramete…
-
Unscored —
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month paramete…
-
High 7.5
Hitachi Kokusai Electric Newtork products for monitoring system (Camera, Decoder and Encoder) and below allows attckers…
-
High 7.5
An improper authentication for critical function issue in Hitachi Kokusai Electric Network products for monitoring syst…
-
Medium 4.8
Subrion CMS 4.2.1 vulnerable to cross-site scripting in admin panel
Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field
-
Unscored —
Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from the function Pollers > Broker Configuration by adding…
-
Critical 10.0
An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bi…
-
High 7.1
Improper Access Control in tooljet/tooljet
The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a valid on…
-
High 8.1
Arbitrary Code Execution
All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor.
-
Critical 9.8
Arbitrary Code Execution
All versions of package @pendo324/get-process-by-name are vulnerable to Arbitrary Code Execution due to improper sanitization of getProcessByName function.
-
Critical 9.8
Arbitrary Command Injection
All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the child_process.exec() function.
-
Unscored —
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, mishandle hidden and incremental…
-
High 7.8
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use…
-
Unscored —
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use…
-
Unscored —
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use…