Archive
August 2022
Vulnerabilities first published in this month (UTC), newest first.
2,333 results · Feed
-
Medium 6.3
SourceCodester Guest Management System front.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Guest Management System. This issue affects some unknown processing of the file /guestmanagement/front.php. The manipulation of the argument rid leads to sql injection. The at…
-
Low 3.5
MotoPress Timetable and Event Schedule Calendar cross site scripting
A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=1&method=adddetails&id=2 of the co…
-
Low 3.5
MotoPress Timetable and Event Schedule Quick Edit admin-ajax.php cross site scripting
A vulnerability was found in MotoPress Timetable and Event Schedule. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /wp-admin/admin-ajax.php of the component Quick Edit. The manipulation of the argument post…
-
Medium 4.3
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.…
-
Medium 4.3
IBM Sterling File Gateway 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow a r…
-
Medium 6.3
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.…
-
Medium 5.4
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.…
-
High 8.7
TIBCO Statistica Stored Cross Site Scripting (XSS) Vulnerability
The Web Console component of TIBCO Software Inc.'s TIBCO Data Science - Workbench, TIBCO Statistica, TIBCO Statistica - Estore Edition, and TIBCO Statistica Trial contains an easily exploitable vulnerability that allows a low privileged attacker with network …
-
High 7.3
TIBCO Statistica Reflected Cross Site Scripting (XSS) Vulnerability
The Web Console component of TIBCO Software Inc.'s TIBCO Data Science - Workbench, TIBCO Statistica, TIBCO Statistica - Estore Edition, and TIBCO Statistica Trial contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow a lo…
-
Medium 5.4
There is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.
A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’…
-
High 7.5
There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1
There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access an API that may induce Esri Portal for ArcGIS to read arbitrary URLs.
-
Medium 6.1
There is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.
A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’…
-
Medium 6.1
Code injection issue in Portal for ArcGIS (10.7.1 and 10.8.1)
There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings which could potentially cause arbitrary code execution.
-
Medium 6.7
Portal for ArcGIS system properties are not properly encrypted (10.8.1 only)
In Esri Portal for ArcGIS versions 10.8.1, a system property is not properly encrypted. This may lead to a local user reading sensitive information from a properties file.
-
Unscored —
Clinic's Patient Management System v1.0 is vulnerable to SQL Injection via /pms/update_medicine.php?id=.
-
High 8.8
Docker Provider <3.0 RCE vulnerability in example dag
Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host.
-
Critical 9.8
Mingsoft MCMS SQL injection vulnerability in /mdiy/model/delete URI via models List
Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists.
-
Critical 9.8
Mingsoft MCMS SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter
Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter.
-
Unscored —
Tenda AC9 V15.03.2.21_cn is vulnerable to command injection via goform/SetSysTimeCfg.
-
Unscored —
The Emerson ROC and FloBoss RTU product lines through 2022-05-02 perform insecure filesystem operations. They utilize t…
-
Unscored —
An issue was discovered in rageframe2 2.6.37. There is a XSS vulnerability in the user agent related parameters of the …
-
Unscored —
upsMonitor in ViewPower (aka ViewPowerHTML) 1.04-21012 through 1.04-21353 has insecure permissions for the service bina…
-
Unscored —
Emerson OpenBSI through 2022-04-29 mishandles credential storage. It is an engineering environment for the ControlWave …
-
Unscored —
In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced …
-
Unscored —
OS command injection vulnerability in Nintendo Wi-Fi Network Adaptor WAP-001 All versions allows an attacker with an ad…
-
Unscored —
An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple pr…
-
Unscored —
Buffer overflow vulnerability in Nintendo Wi-Fi Network Adaptor WAP-001 All versions allows an attacker with an adminis…
-
Unscored —
'Hulu / フールー' App for Android from version 3.0.47 to the version prior to 3.1.2 uses a hard-coded API key for an extern…
-
Unscored —
The image file management page of SolarView Compact SV-CPT-MC310 Ver.7.23 and earlier, and SV-CPT-MC310F Ver.7.23 and e…
-
Unscored —
'Hulu / フールー' App for iOS versions prior to 3.0.81 improperly verifies server certificates, which may allow an attacker…
-
Unscored —
CENTUM VP / CS 3000 controller FCS (CP31, CP33, CP345, CP401, and CP451) contains an issue in processing communication …
-
High 7.5
Mapbox is vulnerable to Integer Overflow
An integer overflow exists in Mapbox's closed source gl-native library prior to version 10.6.1, which is bundled with multiple Mapbox products including open source libraries. The overflow is caused by large image height and width values when creating a new I…
-
Unscored —
Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI. This …
-
Unscored —
Airspan AirVelocity 1500 prior to software version 15.18.00.2511 is vulnerable to injection leading to XSS in the SNMP …
-
Unscored —
Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, …
-
Unscored —CVE-2022-36309 EPSS 25%
Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the Ac…
-
Unscored —
Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18…
-
Unscored —
The AirVelocity 1500 prints SNMP credentials on its physically accessible serial port during boot. This was fixed in Ai…
-
Unscored —
An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS pr…
-
Unscored —
A privilege escalation to root exists in Eternal Terminal prior to version 6.2.0. This is due to the combination of a r…