Archive
August 2022
Vulnerabilities first published in this month (UTC), newest first.
2,333 results · Feed
-
High 8.8
User Group Privilege Escalation
A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also …
-
Medium 6.1CVE-2022-28732 EPSS 83%
Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin
A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upg…
-
Medium 6.5CVE-2022-28731 EPSS 59%
Apache JSPWiki CSRF in UserPreferences.jsp
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login p…
-
Medium 6.1CVE-2022-28730 EPSS 86%
Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp
A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages…
-
Medium 6.1CVE-2022-27166 EPSS 86%
XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2
A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
-
Unscored —
TripleCross v0.1.0 was discovered to contain a stack overflow which occurs because there is no limit to the length of p…
-
Unscored —
GVRET Stable Release as of Aug 15, 2015 was discovered to contain a buffer overflow via the handleConfigCmd function at…
-
Unscored —
A segmentation fault in TripleCross v0.1.0 occurs when sending a control command from the client to the server. This oc…
-
Unscored —
A vulnerability in the lua parser of TscanCode tsclua v2.15.01 allows attackers to cause a Denial of Service (DoS) via …
-
Medium 5.3
HCL Launch could allow an authenticated user to obtain sensitive information (CVE-2022-27551)
HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking.
-
High 8.4
AES Crypt for Linux Password Security Vulnerability
AES Crypt is a file encryption software for multiple platforms. AES Crypt for Linux built using the source on GitHub and having the version number 3.11 has a vulnerability with respect to reading user-provided passwords and confirmations via command-line prom…
-
Medium 5.8
Cross-site scripting caused by the editor instance destroying process in ckeditor5
CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special c…
-
Unscored —
Luadec v0.9.9 was discovered to contain a heap-buffer overflow via the function UnsetPending.
-
Medium 4.1
In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution
-
High 7.5
This vulnerability allows local attackers to escalate privileges on affected installations of xhyve. An attacker must f…
-
High 7.3
This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It! 20.21.2…
-
Medium 5.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It!…
-
Medium 6.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Centreon. Aut…
-
High 7.2
This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication…
-
Critical 9.8
This vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server 3.0.…
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentic…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pr…
-
Unscored —CVE-2022-34973 EPSS 16%
D-Link DIR820LA1_FW106B02 was discovered to contain a buffer overflow via the nextPage parameter at ping.ccp.
-
Unscored —CVE-2022-35620 EPSS 33%
D-LINK DIR-818LW A1:DIR818L_FW105b01 was discovered to contain a remote code execution (RCE) vulnerability via the func…
-
Unscored —
D-LINK DIR-818LW A1:DIR818L_FW105b01 was discovered to contain a remote code execution (RCE) vulnerability via the func…
-
Unscored —CVE-2022-34974 EPSS 24%
D-Link DIR810LA1_FW102B22 was discovered to contain a command injection vulnerability via the Ping_addr function.
-
Medium 4.3
An improper access control vulnerability [CWE-284] in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.…
-
Medium 5.4
A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x allows an authentica…
-
Low 3.3
OpenStack Nova Changing vnic_type breaks compute service restart
An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnic_type, creating an instance bound to that port, and then changing the vnic_type of the bound port to macvtap, a…
-
Medium 5.5
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syn…
-
Medium 6.8
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syn…
-
Medium 6.8
Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Cli…
-
Medium 4.3
Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Brows…
-
Medium 6.8
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syn…
-
Medium 5.0
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syn…
-
High 7.2
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi comp…
-
Unscored —
An issue in the fetch_step function in Percona Server for MySQL v8.0.28-19 allows attackers to cause a Denial of Servic…
-
Unscored —
PingCAP TiDB v6.1.0 was discovered to contain a NULL pointer dereference.
-
Unscored —
The assertion `stmt->Dbc->FirstStmt' failed in MonetDB Database Server v11.43.13.
-
Unscored —
Yuba u5cms v8.3.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component savepage.php. This vu…