Archive
August 2022
Vulnerabilities first published in this month (UTC), newest first.
2,333 results · Feed
-
High 8.8
Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot
Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0.
-
Unscored —
Wellcms 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF).
-
Unscored —
jizhicms v2.3.1 has SQL injection in the background.
-
Unscored —
An issue was discovered in jizhicms v2.3.1. There is a CSRF vulnerability that can add a admin.
-
Unscored —
DolphinPHP 1.5.1 is vulnerable to Cross Site Scripting (XSS) via Background - > System - > system function - > configur…
-
Unscored —
EyouCMS V1.5.8-UTF8-SP1 is vulnerable to Cross Site Request Forgery (CSRF) via the background, column management functi…
-
Unscored —
XunRuiCMS V4.5.6 is vulnerable to Cross Site Request Forgery (CSRF).
-
Unscored —
StreamLabs Desktop Application 1.9.0 is vulnerable to Incorrect Access Control via obs64.exe. An attacker can execute a…
-
Unscored —
Ywoa before v6.1 was discovered to contain a SQL injection vulnerability via /oa/setup/checkPool?database.
-
Unscored —
Yimioa v6.1 was discovered to contain a SQL injection vulnerability via the orderbyGET parameter.
-
Unscored —
Tenda-AC18 V15.03.05.05 was discovered to contain a remote command execution (RCE) vulnerability.
-
Unscored —
Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-m…
-
Unscored —
Mealie 1.0.0beta3 was discovered to contain an Insecure Direct Object Reference (IDOR) vulnerability which allows attac…
-
Unscored —
Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to …
-
Unscored —
Kiosk breakout (without quit password) in Safe Exam Browser (Windows) <3.4.0, which allows an attacker to achieve code …
-
High 7.6
Insecure Storage of Sensitive Information in chatwoot/chatwoot
Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0.
-
Medium 5.0
Laravel deserialization
A vulnerability, which was classified as critical, was found in Laravel 5.1. Affected is an unknown function. The manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used…
-
High 8.8
Incorrect Access Control and Cross Site Scripting in Jellyfin
In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality.
-
Unscored —
In Jellyfin before 10.8, stored XSS allows theft of an admin access token.
-
Unscored —CVE-2022-29805 EPSS 28%
A Java Deserialization vulnerability in the Fishbowl Server in Fishbowl Inventory before 2022.4.1 allows remote attacke…
-
Unscored —
In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build informat…
-
Unscored —
In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project T…
-
Unscored —
In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload funct…
-
Unscored —
In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview.
-
Unscored —
Cross Site Scripting (XSS) vulnerability exists in the phpgurukul Online Marriage Registration System 1.0 allows attack…
-
Unscored —
Printix Cloud Print Management v1.3.1149.0 for Windows was discovered to contain insecure permissions.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0225.
-
Critical 9.8
OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value
lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.
-
Critical 9.8
Use of Hard-coded Credentials in AgileConfig.Client
Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access.
-
Unscored —
Unsafe Parsing of a PNG tRNS chunk in FastStone Image Viewer through 7.5 results in a stack buffer overflow.
-
Unscored —
Improper input validation in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privilege…
-
Medium 6.9
Improper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged …
-
High 7.8
Improper buffer restrictions in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privil…
-
High 7.8
Improper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged …
-
High 7.8
Improper input validation in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privilege…
-
High 7.8
Improper buffer restriction in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privile…
-
Medium 5.5
Insufficiently protected credentials in the Intel(R) Team Blue mobile application in all versions may allow an authenti…
-
High 7.5
Insufficiently protected credentials in the Intel(R) Datacenter Group Event iOS application, all versions, may allow an…
-
High 7.8
Uncontrolled search path in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated user t…
-
High 7.8
Incorrect default permissions in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated u…