Archive
August 2022
Vulnerabilities first published in this month (UTC), newest first.
2,333 results · Feed
-
Low 3.7CVE-2021-3754 Public exploit
Keycloak's improper input validation allows using email as username
A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.
-
Medium 4.3
Keycloak has Files or Directories Accessible to External Parties
ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of ra…
-
Unscored —CVE-2021-3864 Public exploit
A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. …
-
Unscored —
A flaw was found in the Foreman project. The Datacenter plugin exposes the password through the API to an authenticated…
-
Unscored —
Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts.
-
Unscored —
Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /cla…
-
Unscored —
Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /cla…
-
Unscored —
mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add …
-
Unscored —
Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /cla…
-
Unscored —
Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /cla…
-
Unscored —
Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /adm…
-
Unscored —
Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /cla…
-
Unscored —
htmly v2.8.1 was discovered to contain an arbitrary file deletion vulnerability via the component \views\backup.html.ph…
-
Unscored —
mm-wiki v0.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the markdown editor.
-
Unscored —
There is an unauthorized access vulnerability in Online Diagnostic Lab Management System 1.0.
-
Unscored —
An issue was discovered in Online Diagnostic Lab Management System 1.0, There is a SQL injection vulnerability via "dob…
-
Unscored —
An issue was discovered in Online Diagnostic Lab Management System 1.0. There is a stored XSS vulnerability via firstna…
-
Unscored —CVE-2022-34303 Public exploit
A flaw was found in Eurosoft bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper wit…
-
Unscored —CVE-2022-34302 Public exploit
A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or…
-
Unscored —CVE-2022-34301 Public exploit
A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass …
-
Unscored —
A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-l…
-
Unscored —
A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs whi…
-
Unscored —
A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory whe…
-
High 7.5
ZK Framework vulnerable to malicious POST
ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
KEV Feb 27, 2023 -
Unscored —
It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the pa…
-
Medium 6.1
Deluge Web-UI vulnerable to XSS through a crafted torrent file
The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript…
-
Unscored —
A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detect…
-
High 7.5
Undertow vulnerable to Denial of Service (DoS) attacks
A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.
-
Unscored —
A directory traversal vulnerability was discovered in Wuzhicms 4.1.0. via /coreframe/app/attachment/admin/index.php:
-
Unscored —
SiteServerCMS 5.X has a Remote-download-Getshell-vulnerability via /SiteServer/Ajax/ajaxOtherService.aspx.
-
Unscored —
An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (bui…
-
Unscored —
In Ericsson Network Manager (ENM) releases before 21.2, users belonging to the same AMOS authorization group can retrie…
-
Unscored —
D-Link Wireless AC1200 Dual Band VDSL ADSL Modem Router DSL-3782 Firmware v1.01 allows unauthenticated attackers to cau…
-
Unscored —
A buffer overflow vulnerability in the Rubrik Backup Service (RBS) Agent for Linux or Unix-based systems in Rubrik CDM …
-
Unscored —
Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to…
-
Unscored —
An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue…
-
Unscored —
An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue…
-
Unscored —
An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue…
-
Unscored —
An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue…
-
Unscored —
An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue…