Archive
August 2022
Vulnerabilities first published in this month (UTC), newest first.
506 results · Clear filters · Feed
-
Medium 6.3
SourceCodester Loan Management System delete_lplan.php sql injection
A vulnerability was found in SourceCodester Loan Management System and classified as critical. This issue affects some unknown processing of the file delete_lplan.php. The manipulation of the argument lplan_id leads to sql injection. The attack may be initiat…
-
Medium 6.3
SourceCodester Simple E-Learning System classroom.php sql injection
A vulnerability classified as critical was found in SourceCodester Simple E-Learning System. Affected by this vulnerability is an unknown functionality of the file classroom.php. The manipulation of the argument post_id leads to sql injection. The attack can …
-
Medium 5.9
Out-of-bounds read in IPv6 neighbor solicitation in Contiki-NG
Contiki-NG is an open-source, cross-platform operating system for IoT devices. Because of insufficient validation of IPv6 neighbor discovery options in Contiki-NG, attackers can send neighbor solicitation packets that trigger an out-of-bounds read. The proble…
-
Medium 4.8
Raneto vulnerable to Cross-site Scripting
Renato v0.17.0 was discovered to contain a cross-site scripting (XSS) vulnerability.
-
Medium 6.5
NGINX Instance Manager vulnerability CVE-2022-35241
In versions 2.x before 2.3.1 and all versions of 1.x, when NGINX Instance Manager is in use, undisclosed requests can cause an increase in disk resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
Medium 4.8
Traffic intelligence feeds vulnerability CVE-2022-34865
In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic Intelligence feeds, which use HTTPS, do not verify the remote endpoint identity, allowing for potential data poisoning. Note: Software versions which have rea…
-
Medium 4.3
BIG-IP and BIG-IQ iControl SOAP vulnerability CVE-2022-34851
In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ Centralized Management all versions of 8.x, an authenticated attacker may cause iControl SOAP to become u…
-
Medium 5.9
BIG-IP and BIG-IQ AWS vulnerability CVE-2022-34844
In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, and all versions of BIG-IQ 8.x, when the Data Plane Development Kit (DPDK)/Elastic Network Adapter (ENA) driver is used with BIG-IP or BIG-IQ on Amazon Web Services (AWS) systems, undisclos…
-
Medium 6.7
BIG-IP iRule vulnerability CVE-2022-33962
In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, certain iRules commands may allow an attacker to bypass the access control restrictions for a self IP address, regar…
-
Medium 5.4
BIG-IP DNS TMUI Vulnerability CVE-2022-33947
In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, a vulnerability exists in undisclosed pages of the BIG-IP DNS Traffic Management User Interface (TMUI) that allows an authenticated attacker wit…
-
Medium 6.8
BIG-IP APM Appliance mode vulnerability CVE-2022-31473
In BIG-IP Versions 16.1.x before 16.1.1 and 15.1.x before 15.1.4, when running in Appliance mode, an authenticated attacker may be able to bypass Appliance mode restrictions due to a directory traversal vulnerability in an undisclosed page within iApps. A suc…
-
Medium 6.5
NGINX Ingress Controller vulnerability CVE-2022-30535
In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versions which have reached End of Technical Support (EoTS) are n…
-
Medium 6.5
Missing brute force protection on cloud federation sharing in Nextcloud Server
Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares (`a-zA-Z0-9` ^ 15). It is recommend…
-
Medium 6.3
SourceCodester Multi Language Hotel Management Software sql injection
A vulnerability classified as critical has been found in SourceCodester Multi Language Hotel Management Software. Affected is an unknown function. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The…
-
Medium 6.3
SourceCodester Multi Language Hotel Management Software sql injection
A vulnerability was found in SourceCodester Multi Language Hotel Management Software. It has been rated as critical. This issue affects some unknown processing. The manipulation of the argument room_id leads to sql injection. The attack may be initiated remot…
-
Medium 5.5
SourceCodester Online Admission System GET Parameter sql injection
A vulnerability was found in SourceCodester Online Admission System and classified as critical. This issue affects some unknown processing of the component GET Parameter Handler. The manipulation of the argument eid leads to sql injection. The exploit has bee…
-
Medium 6.3
SourceCodester Online Admission System POST Parameter sql injection
A vulnerability has been found in SourceCodester Online Admission System and classified as critical. This vulnerability affects unknown code of the component POST Parameter Handler. The manipulation of the argument shift leads to sql injection. The attack can…
-
Medium 6.1CVE-2022-28732 EPSS 83%
Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin
A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upg…
-
Medium 6.5CVE-2022-28731 EPSS 59%
Apache JSPWiki CSRF in UserPreferences.jsp
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login p…
-
Medium 6.1CVE-2022-28730 EPSS 86%
Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp
A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages…
-
Medium 6.1CVE-2022-27166 EPSS 86%
XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2
A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
-
Medium 5.3
HCL Launch could allow an authenticated user to obtain sensitive information (CVE-2022-27551)
HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking.
-
Medium 5.8
Cross-site scripting caused by the editor instance destroying process in ckeditor5
CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special c…
-
Medium 4.1
In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution
-
Medium 5.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It!…
-
Medium 6.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Centreon. Aut…
-
Medium 4.3
An improper access control vulnerability [CWE-284] in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.…
-
Medium 5.4
A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x allows an authentica…
-
Medium 5.5
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syn…
-
Medium 6.8
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syn…
-
Medium 6.8
Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Cli…
-
Medium 4.3
Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Brows…
-
Medium 6.8
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syn…
-
Medium 5.0
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syn…
-
Medium 5.3
Missing rate limit in Authentication in bookwyrm
BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force attacks. This issue has been patched in version 0.4.5. Admins with existing instances will need to upd…
-
Medium 6.5
TIBCO iWay Service Manager Directory Traversal Vulnerability
The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains an easily exploitable Directory Traversal vulnerability that allows a low privileged attacker with network access to read arbitrary resources on the affect…
-
Medium 5.7
XSS vulnerability in Citadel
The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions.
-
Medium 6.8
HiCOS Citizen verification component - Stack Buffer Overflow
HiCOS Citizen verification component has a stack-based buffer overflow vulnerability due to insufficient parameter length validation. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate system command or d…
-
Medium 5.4
TEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-2
Teamplus Pro community discussion has an ‘allocation of resource without limits or throttling’ vulnerability on thread subject field. A remote attacker with general user privilege posting a thread subject with large content can cause the server to allocate to…
-
Medium 5.5
NHI card’s web service component - Stack-based Buffer Overflow-2
The NHI card’s web service component has a stack-based buffer overflow vulnerability due to insufficient validation for network packet key parameter. A LAN attacker with general user privilege can exploit this vulnerability to disrupt service.