Archive
August 2022
Vulnerabilities first published in this month (UTC), newest first.
2,333 results · Feed
-
Medium 5.4
Jfinal Cross-site Scripting vulnerability
Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module.
-
High 8.8
Cisco FXOS and NX-OS Software Cisco Discovery Protocol Denial of Service and Arbitrary Code Execution Vulnerability
A vulnerability in the Cisco Discovery Protocol feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affecte…
-
High 8.6
Cisco NX-OS Software OSPFv3 Denial of Service Vulnerability
A vulnerability in the OSPF version 3 (OSPFv3) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to incomplete input validation of spec…
-
Medium 6.7
Cisco FXOS Software Command Injection Vulnerability
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The attacker would need to have Administrator privileges on the device. This vulnerability is d…
-
High 8.8
Cisco ACI Multi-Site Orchestrator Privilege Escalation Vulnerability
A vulnerability in the API implementation of Cisco ACI Multi-Site Orchestrator (MSO) could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability is due to improper authorization on specific APIs. An attacker c…
-
Unscored —
Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the Postgre…
-
Unscored —
Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common …
-
Unscored —
There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/sr…
-
Unscored —
There is a Information Disclosure vulnerability in anjuta/plugins/document-manager/anjuta-bookmarks.c. This issue was c…
-
Unscored —
A vulnerability was found in rizin. The bug involves an ELF64 binary for the HPPA architecture. When a specially crafte…
-
High 7.5
Incorrect header handling in mod-wsgi
A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing.
-
Medium 4.7
WorkstationST - Reflected XSS in iHistorian Data Display Tags
A reflected cross-site scripting (XSS) vulnerability exists in the iHistorian Data Display of WorkstationST (<v07.09.15) could allow an attacker to compromise a victim's browser. WorkstationST is only deployed in specific, controlled environments rendering at…
-
Medium 4.7
WorkstationST - Response Splitting in AM Gateway Challenge-Response
An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST (<v07.09.15) and could allow an attacker to compromise a victim's browser/session. WorkstationST is only deployed in specific, controlled environments…
-
Unscored —
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.10P1 are susceptible to …
-
Unscored —
A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passw…
-
Medium 5.4
WordPress SEO Scout plugin <= 0.9.83 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in SEO Scout plugin <= 0.9.83 at WordPress allows attackers to trick users with administrative rights to unintentionally change the plugin settings.
-
High 8.6
ISaGRAF Workbench Deserialization of Untrusted Data CWE-502
Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Deserialization of Untrusted Data vulnerability. ISaGRAF Workbench does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a …
-
High 7.7
ISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22
Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. Crafted malicious files can allow an attacker to traverse the file system when opened by ISaGRAF Workbench. If successfully exploited, an…
-
Medium 6.1
ISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22
Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. A crafted malicious .7z exchange file may allow an attacker to gain the privileges of the ISaGRAF Workbench software when opened. If the …
-
Unscored —
A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of pro…
-
Unscored —
Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privi…
-
Unscored —CVE-2022-37159 EPSS 28%
Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload.
-
Unscored —
Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS) via SVG file upload.
-
Unscored —
Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS). An attacker can obtain javascript code executio…
-
Unscored —
RuoYi v3.8.3 has a Weak password vulnerability in the management system.
-
Unscored —
Tenda AX12 V22.03.01.21_CN is vulnerable to Buffer Overflow. This overflow is triggered in the sub_42FDE4 function, whi…
-
Unscored —
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the curren…
-
Unscored —
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the rulles…
-
Unscored —
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to HTTP Response splitting via the format pa…
-
Unscored —
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the data_l…
-
Unscored —
MDaemon Technologies SecurityGateway for Email Servers 8.5.2, is vulnerable to HTTP Response splitting via the data par…
-
Unscored —
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the whitel…
-
Unscored —
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to IFRAME Injectionvia the currentRequest pa…
-
Unscored —
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the Blackl…
-
Unscored —
Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the function fromSetRouteStatic.
-
Unscored —
Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the function fromSetIpMacBind.
-
Unscored —
Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the ddnsEn parameter in the function formSetSysToo…
-
Unscored —
Tenda AC1206 V15.03.06.23 was discovered to contain multiple stack overflows via the deviceMac and the device_id parame…
-
Unscored —
Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the shareSpeed parameter in the function fromSetWi…
-
Unscored —
Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the function fromSetIpMacBind.