Archive
August 2022
Vulnerabilities first published in this month (UTC), newest first.
2,333 results · Feed
-
High 7.0
Session Fixation in namelessmc/nameless
Session Fixation in GitHub repository namelessmc/nameless prior to v2.0.2.
-
Critical 9.8
Missing Critical Step in Authentication in namelessmc/nameless
Missing Critical Step in Authentication in GitHub repository namelessmc/nameless prior to v2.0.2.
-
Low 3.7
Authentication Bypass by Primary Weakness in octoprint/octoprint
An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts.
-
Critical 9.8
Improper Removal of Sensitive Information Before Storage or Transfer in cockpit-hq/cockpit
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.2.2.
-
Unscored —CVE-2022-2535 Scanner template
SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure
The SearchWP Live Ajax Search WordPress plugin before 1.6.2 does not ensure that users making a live search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with the…
-
Unscored —
Digital Publications by Supsystic < 1.7.4 - Admin+ Stored Cross-Site Scripting
The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
-
Unscored —
E Unlocked - Student Result <= 1.0.4 - Arbitrary File Upload via CSRF
The E Unlocked - Student Result WordPress plugin through 1.0.4 is lacking CSRF and validation when uploading the School logo, which could allow attackers to make a logged in admin upload arbitrary files, such as PHP via a CSRF attack
-
Unscored —CVE-2022-2379 Scanner template
Easy Student Results <= 2.2.8 - Sensitive Information Disclosure via REST API
The Easy Student Results WordPress plugin through 2.2.8 lacks authorisation in its REST API, allowing unauthenticated users to retrieve information related to the courses, exams, departments as well as student's grades and PII such as email address, physical …
-
Unscored —
Easy Student Results <= 2.2.8 - Reflected Cross-Site Scripting
The Easy Student Results WordPress plugin through 2.2.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
-
Unscored —
WP-DBManager < 2.80.8 - Admin+ Remote Command Execution
The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite installations, where only super-administrators should.
-
Unscored —
VR Calendar < 2.3.2 - Unauthenticated Arbitrary Function Call
The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site.
-
Unscored —
GREYD.SUITE < 1.2.7 - Unauthenticated File Upload to RCE
The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unauthenticated attacker to upload arbitrary files including php source files, leading to possible rem…
-
Unscored —
Duplicate Page and Post Plugin < 2.8 - Admin+ Stored Cross-Site Scripting
The Duplicate Page and Post WordPress plugin before 2.8 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
-
Unscored —
Elementor Contact Form DB < 1.8.0 - Reflected Cross-Site Scripting
The Contact Form DB WordPress plugin before 1.8.0 does not sanitise and escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting
-
Low 3.5
SourceCodester Simple and Nice Shopping Cart Script login.php cross site scripting
A vulnerability has been found in SourceCodester Simple and Nice Shopping Cart Script and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /mkshope/login.php. The manipulation of the argument msg leads to cross…
-
Unscored —
There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by …
-
Unscored —
A buffer overflow in the FTcpListener thread in The Isle Evrima (the dedicated server on Windows and Linux) 0.9.88.07 b…
-
Unscored —
Segv on unknown address in jpeg_read_scanlines
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50217 https://pillow.readthedocs.io/en/stable/releasenotes/9.3.0.html#decode-jpeg-compressed-blp1-data-in-original-mode ``` Crash type: Segv on unknown address Crash state: jpeg_read_scanl…
-
Unscored —CVE-2020-21365 Public exploit
Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclos…
-
Unscored —
There is an out-of-bounds write in checkType located in etc.c in w3m 0.5.3. It can be triggered by sending a crafted HT…
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211.
-
High 7.8
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0213.
-
Medium 4.3
SourceCodester Guest Management System cleartext storage
A vulnerability, which was classified as problematic, was found in SourceCodester Guest Management System. Affected is an unknown function. The manipulation leads to cleartext storage of passwords in the database. The identifier of this vulnerability is VDB-2…
-
High 7.3
SourceCodester Guest Management System index.php sql injection
A vulnerability classified as critical was found in SourceCodester Guest Management System. This vulnerability affects unknown code of the file index.php. The manipulation of the argument username/pass leads to sql injection. The attack can be initiated remot…
-
Low 3.5
SourceCodester Guest Management System myform.php cross site scripting
A vulnerability classified as problematic has been found in SourceCodester Guest Management System. This affects an unknown part of the file myform.php. The manipulation of the argument name leads to cross site scripting. It is possible to initiate the attack…
-
Medium 6.1CVE-2022-36007 Public exploit
Partial Path Traversal in com.github.jlangch:venice
Venice is a Clojure inspired sandboxed Lisp dialect with excellent Java interoperability. A partial path traversal issue exists within the functions `load-file` and `load-resource`. These functions can be limited to load files from a list of load paths. Assum…
-
High 7.9
Authenticated remote code execution due to insecure deserialization (GHSL-2022-063)
Arvados is an open source platform for managing, processing, and sharing genomic and other large scientific and biomedical data. A remote code execution (RCE) vulnerability in the Arvados Workbench allows authenticated attackers to execute arbitrary code via …
-
High 7.9
ECDSA signature malleability in OpenZeppelin Contracts
OpenZeppelin Contracts is a library for secure smart contract development. The functions `ECDSA.recover` and `ECDSA.tryRecover` are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 b…
-
Medium 5.0
Delimiter injection vulnerability in @actions/core exportVariable
The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The `core.exportVariable` function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables.…
-
Unscored —
Apache OpenOffice Weak Master Keys
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where master key was poorly encoded re…
-
Unscored —
Apache OpenOffice Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Password
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where the required initialization vect…
-
Medium 5.3
CRLF Injection in Nodejs ‘undici’ via Content-Type
undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { re…
-
Critical 9.3
loopback-connector-postgresql Vulnerable to Improper Sanitization of `contains` Filter
Improper input validation on the `contains` LoopBack filter may allow for arbitrary SQL injection. When the extended filter property `contains` is permitted to be interpreted by the Postgres connector, it is possible to inject arbitrary SQL which may affect t…
-
Medium 5.9
SameSite may allow cross-site request forgery (CSRF) protection to be bypassed
Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/s…
-
Medium 5.8
update_by_case before 0.1.3 vulnerable to sql injection
This Rails gem adds two methods to the ActiveRecord::Base class that allow you to update many records on a single database hit, using a case sql statement for it. Before version 0.1.3 `update_by_case` gem used custom sql strings, and it was not sanitized, mak…
-
High 7.1
URL Redirection to Untrusted Site ('Open Redirect') in bookwyrm
BookWyrm is a social network for tracking your reading, talking about books, writing reviews, and discovering what to read next. Some links in BookWyrm may be vulnerable to tabnabbing, a form of phishing that gives attackers an opportunity to redirect a user …
-
Medium 6.3
SourceCodester Zoo Management System apply_vacancy.php unrestricted upload
A vulnerability was found in SourceCodester Zoo Management System. It has been classified as critical. Affected is an unknown function of the file /pages/apply_vacancy.php. The manipulation of the argument filename leads to unrestricted upload. It is possible…
-
Medium 6.3
SourceCodester Zoo Management System animals.php sql injection
A vulnerability was found in SourceCodester Zoo Management System and classified as critical. This issue affects some unknown processing of the file /pages/animals.php. The manipulation of the argument class_id leads to sql injection. The attack may be initia…
-
High 7.3
SourceCodester Gas Agency Management System login.php sql injection
A vulnerability has been found in SourceCodester Gas Agency Management System and classified as critical. This vulnerability affects unknown code of the file gasmark/login.php. The manipulation of the argument username leads to sql injection. The attack can b…