Archive
August 2022
Vulnerabilities first published in this month (UTC), newest first.
2,333 results · Feed
-
Unscored —CVE-2022-38794 Scanner template
Zaver through 2020-12-15 allows directory traversal via the GET /.. substring.
-
Critical 9.8
exotel-py includes code execution backdoor inserted by a third party
The exotel (aka exotel-py) package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party.
-
Unscored —
stricter rules on chroot names
Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.
-
Low 3.5
oretnom23 Fast Food Ordering System cross site scripting
A vulnerability, which was classified as problematic, has been found in oretnom23 Fast Food Ordering System. This issue affects some unknown processing of the file admin/?page=reports. The manipulation of the argument date leads to cross site scripting. The a…
-
Low 3.5
SourceCodester Simple Task Managing System cross site scripting
A vulnerability classified as problematic was found in SourceCodester Simple Task Managing System. This vulnerability affects unknown code. The manipulation of the argument student_add leads to cross site scripting. The attack can be initiated remotely. The i…
-
Medium 6.3
SourceCodester Simple Task Managing System loginVaLidation.php sql injection
A vulnerability classified as critical has been found in SourceCodester Simple Task Managing System. This affects an unknown part of the file /loginVaLidation.php. The manipulation of the argument login leads to sql injection. It is possible to initiate the a…
-
Medium 6.3
oretnom23 Fast Food Ordering System index.php sql injection
A vulnerability was found in oretnom23 Fast Food Ordering System. It has been rated as critical. Affected by this issue is some unknown functionality of the file ffos/admin/reports/index.php. The manipulation of the argument date leads to sql injection. The a…
-
Critical 9.1
The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 3, a diffe…
-
Unscored —
In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream …
-
Unscored —
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability at /p…
-
Unscored —
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a Cross-Site Request Forgery (CSRF) via /patient/settin…
-
Unscored —
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at…
-
Unscored —
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /…
-
Unscored —
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /…
-
Unscored —
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /…
-
Unscored —
An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitr…
-
Unscored —
A Heap-based Buffer Overflow vulnerability in the SonicWall SMA100 appliance allows a remote authenticated attacker to …
-
Unscored —
Kensite CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities via the name and oldname parameters a…
-
Unscored —
Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tool…
-
Unscored —
The deep-translator project on PyPI was taken over via user account compromise via a phishing attack and a new maliciou…
-
Unscored —
The spam project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release m…
-
Unscored —
The exotel project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release…
-
Unscored —
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML fea…
-
Unscored —
A race condition was found in vdsm. Functionality to obfuscate sensitive values in log files that may lead to values be…
-
High 7.5
XNIO `notifyReadClosed` method logging message to unexpected end
A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related perf…
-
Medium 5.4
Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown
A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.
-
Unscored —
A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c…
-
Medium 5.4
IBM Maximo Asset Management 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbit…
-
High 8.8
IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an atta…
-
Unscored —
A malicious unauthorized PAM user can access the administration configuration data and change the values.
-
Unscored —
A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed i…
-
Unscored —
A flaw was found in satellite. When giving granular permission related to the organization, other permissions allowing …
-
Unscored —
A flaw was found in openstack-tripleo-heat-templates. Plain passwords from RHSM exist in the logs during OSP13 deployme…
-
Critical 9.1
Openstack Keystone Incorrect Authorization vulnerability
A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confid…
-
High 7.5
Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow
A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow.
-
Unscored —
A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the p…
-
Unscored —
A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segm…
-
Unscored —
A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while…
-
Low 3.3
wildfly-core allows user with access to management interface to access vault expression, retrieve item from vault
A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should no…
-
Unscored —
It was found that the CVE-2021-27918, CVE-2021-31525 and CVE-2021-33196 have been incorrectly mentioned as fixed in RHS…