Archive
August 2022
Vulnerabilities first published in this month (UTC), newest first.
2,333 results · Feed
-
Unscored —
An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects to a wolfSSL server and SSL_clear is ca…
-
Unscored —CVE-2022-36620 EPSS 24%
D-link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img is vulnerable to Buffer Overflow via /goform/addRouting.
-
Unscored —
A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple c…
-
Unscored —
There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1
-
Unscored —
It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 call…
-
Unscored —
A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can …
-
Unscored —
A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbe…
-
Unscored —CVE-2022-37130 EPSS 27%
In D-Link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img a command injection vulnerability occurs in /goform/Diag…
-
Unscored —
RPi-Jukebox-RFID v2.3.0 was discovered to contain a command injection vulnerability via the component /htdocs/utils/Fil…
-
Unscored —
PicUploader v2.6.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /master/index…
-
Unscored —
Razor v0.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the function uploadchannel().
-
Medium 6.1
LibreNMS vulnerable to Cross-Site Scripting (XSS)
LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component print-customoid.php.
-
Medium 6.1
LibreNMS vulnerable to Cross-Site Scripting (XSS)
LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php.
-
High 7.5
Overload/denial of service affects HCL VersionVault Express
An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service.
-
Medium 6.0
An insufficiently protected credential vulnerability affects HCL VersionVault Express
HCL VersionVault Express exposes administrator credentials.
-
Unscored —
Library Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /…
-
Medium —
Captcha Bypass in strapi-plugin-ezforms
### Impact Users using any captcha providers ### Patches >0.1.0 ### References [Issue](https://github.com/excl-networks/strapi-plugin-ezforms/issues/15)
-
High 7.1
Cross-site scripting from content entered in the tags and multiselect fields
### Introduction Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with …
-
Unscored —
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /adm…
-
Unscored —
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /adm…
-
Unscored —
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /admin…
-
Unscored —
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /librari…
-
Unscored —
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /lib…
-
Unscored —
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /lib…
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0322.
-
Low —
Command Injection in moment-timezone
### Impact All versions of moment-timezone from 0.1.0 contain build tasks vulnerable to command injection. * if Alice uses tzdata pipeline to package moment-timezone on her own (for example via `grunt data:2014d`, where `2014d` stands for the version of the t…
-
Medium —
Cleartext Transmission of Sensitive Information in moment-timezone
### Impact * if Alice uses `grunt data` (or `grunt release`) to prepare a custom-build, moment-timezone with the latest tzdata from IANA's website * and Mallory intercepts the request to IANA's unencrypted ftp server, Mallory can serve data which might exploi…
-
High 8.8
Dell Container Storage Modules 1.2 contains a path traversal vulnerability in goiscsi and gobrick libraries. A remote a…
-
High 8.8
Dell Container Storage Modules 1.2 contains an OS command injection in goiscsi and gobrick libraries. A remote authenti…
-
Medium 6.1
Dell EMC NetWorker 19.2.1.x 19.3.x, 19.4.x, 19.5.x, 19.6.x and 19.7.0.0 contain an Improper Handling of Insufficient Pe…
-
Medium 5.4
Dell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could p…
-
High 8.6
SmartFabric storage software version 1.0.0 contains a Command-Injection vulnerability. A remote unauthenticated attacke…
-
Medium 4.3
Network Policies & (Clusterwide) Cilium Network Policies with namespace label selectors may unexpectedly select pods with maliciously crafted labels
### Impact If a user has Network Policies with namespace selectors selecting labels of namespaces, or (clusterwide) Cilium Network Policies matching on namespace labels, then it is possible for an attacker with Kubernetes pod deploy rights (either directly or…
-
Unscored —
An issue in the installer of gvim 9.0.0000 allows authenticated attackers to execute arbitrary code via a binary hijack…
-
Unscored —
Incorrect access control in the install directory (C:\Wamp64) of Wamp v3.2.6 and below allows authenticated attackers t…
-
Unscored —
Incorrect access control in the install directory (C:\msys64) of Msys2 v20220603 and below allows authenticated attacke…
-
Unscored —
Incorrect access control in the install directory (C:\Strawberry) of StrawberryPerl v5.32.1.1 and below allows authenti…
-
Unscored —
Incorrect access control in the install directory (C:\RailsInstaller) of Rubyinstaller2 v3.1.2 and below allows authent…
-
Unscored —
Incorrect access control in the install directory (C:\Ruby31-x64) of Rubyinstaller2 v3.1.2 and below allows authenticat…
-
Unscored —
XPDF v4.0.4 was discovered to contain a segmentation violation via the component /xpdf/AcroForm.cc:538.