Archive
August 2022
Vulnerabilities first published in this month (UTC), newest first.
2,333 results · Feed
-
Unscored —
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameter hiddenSSID32g and SSID2…
-
Unscored —
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameter macAddr, which leads to…
-
Unscored —
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 qos.cgi has no filtering on parameters: qos_bandwith and qos_dat, …
-
Unscored —
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameters: mac_5g and Newname, w…
-
Unscored —
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameters: delete_list, delete_a…
-
Medium 6.1
An issue was discovered in EyouCMS 1.5.8. There is a Storage XSS vulnerability that can allows an attacker to execute a…
-
Medium 4.6
TIBCO eFTL Secret Jacking
The ftlserver component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, TIBCO eFTL - Enterpr…
-
Medium 6.7
TIBCO FTL Privilege Escalation
The ftlserver component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, and TIBCO FTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacke…
-
Unscored —
TOTOLINK A3002RU V3.0.0-B20220304.1804 has a hardcoded password for root in /etc/shadow.sample.
-
Unscored —
UCMS 1.6 is vulnerable to arbitrary file upload via ucms/sadmin/file PHP file.
-
Unscored —CVE-2022-37024 EPSS 80%
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtil…
-
Critical 10.0
Improper Restriction of Rendered UI Layers or Frames in openemr/openemr
Improper Restriction of Rendered UI Layers or Frames in GitHub repository openemr/openemr prior to 7.0.0.1.
-
High 8.3
Missing Authorization in openemr/openemr
Missing Authorization in GitHub repository openemr/openemr prior to 7.0.0.1.
-
Critical 9.6
Cross-site Scripting (XSS) - Reflected in openemr/openemr
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.
-
Medium 5.4
Cross-site Scripting (XSS) - Reflected in openemr/openemr
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.
-
Medium 5.4
Cross-site Scripting (XSS) - DOM in openemr/openemr
Cross-site Scripting (XSS) - DOM in GitHub repository openemr/openemr prior to 7.0.0.1.
-
Medium 6.5
Authorization Bypass Through User-Controlled Key in openemr/openemr
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1.
-
Medium 6.3
SourceCodester Gym Management System index.php sql injection
A vulnerability was found in SourceCodester Gym Management System. It has been rated as critical. Affected by this issue is some unknown functionality of the file /mygym/admin/index.php. The manipulation of the argument edit_tran leads to sql injection. The a…
-
Medium 6.3
SourceCodester Gym Management System login.php sql injection
A vulnerability was found in SourceCodester Gym Management System. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /mygym/admin/login.php. The manipulation of the argument admin_email/admin_pass leads t…
-
Medium 6.3
SEMCMS Ant_Check.php sql injection
A vulnerability classified as critical has been found in SEMCMS. This affects an unknown part of the file Ant_Check.php. The manipulation of the argument DID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclose…
-
Low 3.5
SourceCodester Company Website CMS add-blog.php cross site scripting
A vulnerability was found in SourceCodester Company Website CMS. It has been rated as problematic. Affected by this issue is some unknown functionality of the file add-blog.php. The manipulation leads to cross site scripting. The attack may be launched remote…
-
Medium 6.3
SourceCodester Employee Management System aprocess.php sql injection
A vulnerability was found in SourceCodester Employee Management System. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /process/aprocess.php. The manipulation of the argument mailuid leads to sql injec…
-
Medium 6.3
SourceCodester Employee Management System eprocess.php sql injection
A vulnerability was found in SourceCodester Employee Management System. It has been classified as critical. Affected is an unknown function of the file /process/eprocess.php. The manipulation of the argument mailuid/pwd leads to sql injection. It is possible …
-
Medium 6.3
SourceCodester Simple Student Information System manage_course.php sql injection
A vulnerability was found in SourceCodester Simple Student Information System and classified as critical. This issue affects some unknown processing of the file manage_course.php. The manipulation of the argument id leads to sql injection. The attack may be i…
-
High 7.5
Integer overflow when reading corrupted .avro file in Avro Rust SDK
It is possible to crash (panic) an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which add…
-
High 7.5
Memory overconsumption in Avro Rust SDK
It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to ap…
-
High 7.5
Denial of service while reading data in Avro Rust SDK
It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro versi…
-
Medium 6.3
SourceCodester Employee Management System eloginwel.php sql injection
A vulnerability has been found in SourceCodester Employee Management System and classified as critical. This vulnerability affects unknown code of the file eloginwel.php. The manipulation of the argument id leads to sql injection. The attack can be initiated …
-
High 7.5
Prototype Pollution
The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function.
-
Medium 4.7
Windows Defender Credential Guard Information Disclosure Vulnerability
Windows Defender Credential Guard Information Disclosure Vulnerability
-
Medium 4.9
Azure Site Recovery Elevation of Privilege Vulnerability
Azure Site Recovery Elevation of Privilege Vulnerability
-
Unscored —
Stack exhaustion from deeply nested XML documents in encoding/xml
Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.
-
Unscored —
An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technolo…
-
Unscored —
Path traversal via Clean on Windows in path/filepath
Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.
-
Medium 6.5
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of mall…
-
Unscored —
The th_read() function doesn’t free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory…
-
Unscored —
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of mall…
-
Unscored —
The th_read() function doesn’t free a variable t->th_buf.gnu_longname after allocating memory, which may cause a memory…
-
Unscored —
websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcode…
-
Unscored —
wolfSSL before 5.4.0 allows remote attackers to cause a denial of service via DTLS because a check for return-routabili…