Archive
August 2022
Vulnerabilities first published in this month (UTC), newest first.
2,333 results · Feed
-
Unscored —
An out-of-bounds read vulnerability was discovered in linux kernel in the smc protocol stack, causing remote dos.
-
Unscored —
A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h'. This vuln…
-
High 7.5
A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a c…
-
Medium 4.9
Pinniped Supervisor Insufficient Session Expiration vulnerability
An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper…
-
Unscored —
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter a…
-
Unscored —
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month paramete…
-
Unscored —
Ingredients Stock Management System v1.0 was discovered to contain an arbitrary file deletion vulnerability via the com…
-
Unscored —
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month paramete…
-
Unscored —
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month paramete…
-
High 7.5
Hitachi Kokusai Electric Newtork products for monitoring system (Camera, Decoder and Encoder) and below allows attckers…
-
High 7.5
An improper authentication for critical function issue in Hitachi Kokusai Electric Network products for monitoring syst…
-
Medium 4.8
Subrion CMS 4.2.1 vulnerable to cross-site scripting in admin panel
Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field
-
Unscored —
Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from the function Pollers > Broker Configuration by adding…
-
Critical 10.0
An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bi…
-
High 7.1
Improper Access Control in tooljet/tooljet
The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a valid on…
-
High 8.1
Arbitrary Code Execution
All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor.
-
Critical 9.8
Arbitrary Code Execution
All versions of package @pendo324/get-process-by-name are vulnerable to Arbitrary Code Execution due to improper sanitization of getProcessByName function.
-
Critical 9.8
Arbitrary Command Injection
All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the child_process.exec() function.
-
Unscored —
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, mishandle hidden and incremental…
-
High 7.8
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use…
-
Unscored —
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use…
-
Unscored —
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use…
-
Unscored —
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use…
-
Unscored —CVE-2021-41784 Public exploit
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use…
-
Unscored —
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use…
-
Unscored —
Foxit PDF Reader before 11.2.2 and PDF Editor before 11.2.2, and PhantomPDF before 10.1.8, mishandle cross-reference in…
-
Critical 9.8
NVFLARE unsafe deserialization due to Pickle
NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrit…
-
Unscored —
A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly rela…
-
Unscored —
The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not al…
-
Unscored —
Advancecomp v2.3 was discovered to contain a heap buffer overflow via the component __interceptor_memcpy at /sanitizer_…
-
Unscored —
Advancecomp v2.3 was discovered to contain a heap buffer overflow via le_uint32_read at /lib/endianrw.h.
-
Unscored —
Advancecomp v2.3 contains a segmentation fault.
-
Unscored —
Advancecomp v2.3 was discovered to contain a segmentation fault.
-
Unscored —
Advancecomp v2.3 was discovered to contain a segmentation fault.
-
Unscored —
Advancecomp v2.3 was discovered to contain a heap buffer overflow.
-
Unscored —
Advancecomp v2.3 was discovered to contain a heap buffer overflow.
-
Unscored —CVE-2022-1043 Public exploit
A flaw was found in the Linux kernel’s io_uring implementation. This flaw allows an attacker with a local account to co…
-
Unscored —
A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. Th…
-
High 7.5
A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radi…
-
Medium 6.1
jsoup may not sanitize Cross-Site Scripting (XSS) attempts if SafeList.preserveRelativeLinks is enabled
jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow XSS attacks when a reader subsequently clicks that l…