Archive
8 September 2022
Vulnerabilities first published on this day (UTC), newest first.
58 results · Feed
-
Unscored —CVE-2022-40297 Public exploit
UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. This passcode …
-
Unscored —
The TSS (Tuple Space Search) algorithm in Open vSwitch 2.x through 2.17.2 and 3.0.0 allows remote attackers to cause a …
-
Critical 9.9
cruddl vulnerable to AQL injection through flexSearch
cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses `@flexSearchFulltext`, users of that sche…
-
Critical 9.9CVE-2022-36100 EPSS 74%
XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection
XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7 in XWiki Platform Applications Tag and prior to 13.10.6 and 14.4 in XWiki Platform Tag UI, the tags document `Main.Tag…
-
Unscored —
An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisi…
-
Unscored —
An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisi…
-
Unscored —
An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). l2_packet_receive_timeout in wpa_supplicant/s…
-
Unscored —
An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). cyassl_connect_step2 in curl/vtls/cyassl.c ha…
-
Unscored —
School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the comp…
-
Unscored —
School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the comp…
-
Unscored —
School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the comp…
-
High 8.9CVE-2022-36098 EPSS 72%
XWiki Platform Mentions UI vulnerable to Cross-site Scripting
XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a men…
-
Critical 9.9CVE-2022-36099 EPSS 76%
XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability
XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milestone-2 and prior to versions 13.10.6 and 14.4, it's possible to inject arbitrary wiki syntax including Groovy, Python…
-
High 8.9CVE-2022-36097 EPSS 58%
XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form
XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-rc-1 and prior to 14.4-rc-1, it's possible to store JavaScript in an attachment name, which will be e…
-
High 8.9CVE-2022-36096 EPSS 60%
XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list
The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone vi…
-
Medium 4.3
XWiki Cross-Site Request Forgery (CSRF) for actions on tags
XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF) attack for adding or removing tags on XWiki pages. The problem has been patched in XWiki 13.10.5 and 14.3. As a workar…
-
Unscored —
Apartment Visitor Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid paramet…
-
High 8.9CVE-2022-36094 EPSS 65%
XWiki Platform Web Parent POM vulnerable to XSS in the attachment history
XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the histor…
-
Critical 10.0
Improper Restriction of Rendered UI Layers or Frames in ikus060/rdiffweb
Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.
-
Unscored —
A local file inclusion (LFI) vulnerability in D-Link DIR 819 v1.06 allows attackers to cause a Denial of Service (DoS) …
-
Unscored —
TastyIgniter v3.5.0 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to exec…
-
High 8.5
XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard
XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any ema…
-
High 7.5
XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action
XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and direct…
-
Unscored —
Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /interview/d…
-
High 7.5
XWiki Platform Web Templates vulnerable to Missing Authorization and Exposure of Private Personal Information to an Unauthorized Actor
XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. Through the suggestion feature, string and list properties of objects the user shouldn't have access to can be accessed in versions prior to 13.10.4 and 14.2. This include…
-
Medium 4.0
IBM Planning Analytics Local 2.0 allows web pages to be stored locally which can be read by another user on the system.…
-
Unscored —
Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /inter…
-
Unscored —
Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of decoy users via a crafted GET re…
-
Unscored —
Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of monitored files and profiles via…
-
Unscored —
Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of excluded files and profiles via …
-
Unscored —
bilde2910 Hauk v1.6.1 requires a hardcoded password which by default is blank. This hardcoded password is hashed but st…
-
Unscored —
Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the…
-
Unscored —
Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized acc…
-
High 8.1
org.xwiki.platform:xwiki-platform-oldcore Improper Authorization check for inactive users
XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 13.1.0.5 and 14.3-rc-1, some resources are missing a check for inactive (not yet activated or disabled) users in XWiki, including the REST service. This m…
-
High 7.4
OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions
Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — …
-
Unscored —
Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjackin…
-
High 7.5
Cisco SD-WAN vManage Software Unauthenticated Access to Messaging Services Vulnerability
A vulnerability in the binding configuration of Cisco SD-WAN vManage Software containers could allow an unauthenticated, adjacent attacker who has access to the VPN0 logical network to also access the messaging service ports on an affected system. This vulner…
-
Medium 4.3
Cisco Webex Meetings App Character Interface Manipulation Vulnerability
A vulnerability in the messaging interface of Cisco Webex App, formerly Webex Teams, could allow an unauthenticated, remote attacker to manipulate links or other content within the messaging interface. This vulnerability exists because the affected software d…
-
Medium 4.0
Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers IPSec VPN Server Authentication Bypass Vulnerability
A vulnerability in the IPSec VPN Server authentication functionality of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to bypass authentication controls and access the IPSec VPN network. This vul…
-
Unscored —CVE-2022-30079 EPSS 25%
Command injection vulnerability was discovered in Netgear R6200 v2 firmware through R6200v2-V1.0.3.12 via binary /sbin/…