Archive
August 2022
Vulnerabilities first published in this month (UTC), newest first.
2,333 results · Feed
-
Medium 6.1
Mutable pending intent in Google Play services SDK
Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected…
-
Medium 5.3
JetBrain Ktor before 2.1.0 vulnerable to selection of wrong authentication provider
In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases
-
Medium 4.7
JetBrains Ktor before 2.1.0 was vulnerable to a Reflect File Download attack
JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack
-
Medium 6.3
SourceCodester Gas Agency Management System oneWord.php unrestricted upload
A vulnerability classified as critical was found in SourceCodester Gas Agency Management System. Affected by this vulnerability is an unknown functionality of the file /gasmark/assets/myimages/oneWord.php. The manipulation of the argument shell leads to unres…
-
Medium 5.3
`undici.request` vulnerable to SSRF using absolute URL on `pathname`
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `htt…
-
Medium 6.5
Gitea allowed assignment of private issues
In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker…
-
Medium 6.9
Linux Kernel LoadPin bypass via dm-verity table reload
Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the …
-
Unscored —
In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onl…
-
Unscored —
An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. When using preauth…
-
Critical 9.8
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts f…
KEV Aug 11, 2022 -
Unscored —
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. …
-
High —
django-sendfile2 before 0.7.0 contains reflected file download vulnerability
Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an…
-
Medium —
`temporary` makes use of uninitialized memory
Uninitialized memory is used as a RNG seed in temporary. This has been resolved in the 0.6.4 release. The crate is not intended to be used outside of a testing environment. For a general purpose crate to create temporary directories, [`tempfile`](https://crat…
-
High 8.2
Cronos vulnerable to DoS through unintended Contract Selfdestruct
In Cronos nodes running versions before v0.7.0, the contract selfdestruct invocation permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in Ethermint, all contracts that used the identical bytecode (i.e sha…
-
Medium —
mofh Vulnerable to Improper Restriction of XML External Entity Reference
The `xml.etree.ElementTree` module that mofh used up until version `1.0.1` implements a simple and efficient API for parsing and creating XML data. But it makes the application vulnerable to: - [Billion Laughs attack](https://en.wikipedia.org/wiki/Billion_lau…
-
Unscored —
A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s…
-
Unscored —
A local disclosure of sensitive information and a local unauthorized data modification vulnerability were discovered in…
-
Unscored —
A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolated process…
-
Unscored —
A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolated process…
-
Unscored —
A potential arbitrary code execution and a denial of service (DoS) vulnerability within an isolated process were discov…
-
Unscored —
A potential arbitrary code execution and a denial of service (DoS) vulnerability within an isolated process were discov…
-
Unscored —
A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s…
-
Unscored —
A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s…
-
Unscored —
A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s…
-
Unscored —
A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s…
-
Unscored —
A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s…
-
Unscored —
A stack overflow vulnerability exists in /goform/WifiMacFilterSet in Tenda W6 V1.0.0.9(4122) version, which can be expl…
-
Unscored —
A stack overflow vulnerability exists in /goform/wifiSSIDset in Tenda W6 V1.0.0.9(4122) version, which can be exploited…
-
Unscored —CVE-2022-35559 EPSS 12%
A stack overflow vulnerability exists in /goform/setAutoPing in Tenda W6 V1.0.0.9(4122), which allows an attacker to co…
-
Unscored —
A stack overflow vulnerability exists in /goform/WifiMacFilterGet in Tenda W6 V1.0.0.9(4122) version, which can be expl…
-
Unscored —
A stack overflow vulnerability exists in /goform/wifiSSIDget in Tenda W6 V1.0.0.9(4122) version, which can be exploited…
-
Unscored —CVE-2022-35555 EPSS 40%
A command injection vulnerability exists in /goform/exeCommand in Tenda W6 V1.0.0.9(4122), which allows attackers to co…
-
Unscored —
In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML sourc…
-
High —
`rustdecimal` is a malicious crate
The Rust Security Response WG and the crates.io team [were notified][1] on 2022-05-02 of the existence of the malicious crate `rustdecimal`, which contained malware. The crate name was intentionally similar to the name of the popular [`rust_decimal`][2] crate…
-
High —
tower-http's improper validation of Windows paths could lead to directory traversal attack
`tower_http::services::fs::ServeDir` didn't correctly validate Windows paths, meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users could potentially rea…
-
Unscored —
In Bluetooth, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execut…
-
Unscored —
In WiFi, there is a possible disclosure of WiFi password to the end user due to an insecure default value. This could l…
-
Unscored —
In ConnectivityService, there is a possible bypass of network permissions due to a missing permission check. This could…
-
Unscored —
In SELinux policy, there is a possible way of inferring which websites are being opened in the browser due to a missing…
-
Unscored —
In Android, there is a possible access of network neighbor table information due to an insecure SEpolicy configuration.…