Archive
12 September 2022
Vulnerabilities first published on this day (UTC), newest first.
49 results · Feed
-
Unscored —
Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /ma…
-
Unscored —
Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /em…
-
Unscored —
Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /ma…
-
Unscored —
UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning.
-
Unscored —
An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP in…
-
Unscored —
Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via r…
-
Unscored —
On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, (and potentially other vendors/devices due to …
-
Unscored —
FreshService macOS Agent < 4.4.0 and FreshServce Linux Agent < 3.4.0 are vulnerable to TLS Man-in-The-Middle via the Fr…
-
Unscored —
FreshService Windows Agent < 2.11.0 and FreshService macOS Agent < 4.2.0 and FreshService Linux Agent < 3.3.0. are vuln…
-
Unscored —
An issue was discovered in AnyDesk before 6.2.6 and 6.3.x before 6.3.3. An unnecessarily open listening port on a machi…
-
Unscored —
An issue was discovered in AnyDesk before 6.2.6 and 6.3.x before 6.3.5. An upload of an arbitrary file to a victim's lo…
-
Unscored —CVE-2022-38296 Scanner template
Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager.
-
Unscored —CVE-2022-38295 Scanner template
Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /table_manager/view/cu_user_groups. Th…
-
Unscored —
SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the…
-
Unscored —
SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via…
-
High 7.3
Signature checks not applied to some retrieved missing events
Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events` path did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide in…
-
Unscored —
Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/e…
-
Unscored —
Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/e…
-
Unscored —
Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ed…
-
Medium 6.3
Acess control list bypassed via crafted specific URLs
Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACL could be bypassed. Users could execute actions, which they are normally not able to do. Users are advised to update t…
-
Medium 5.4
Sensitive data in backend customer module
Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID. These fields are now explicitly unset in version …
-
High 8.5
A vulnerability exists in the Workplace X WebUI in which an authenticated user is able to execute any MicroSCADA internal scripts irrespective of the authenticated user's role.
Improper Authorization vulnerability exists in the Workplace X WebUI of the Hitachi Energy MicroSCADA X SYS600 allows an authenticated user to execute any MicroSCADA internal scripts irrespective of the authenticated user's role. This issue affects: Hitachi E…
-
High 7.8
Omron CX-Programmer
Opening a specially crafted file could cause the affected product to fail to release its memory reference potentially resulting in arbitrary code execution.
-
Medium 5.4
WordPress Photospace Gallery plugin <= 2.3.5 - Broken Access Control vulnerability
Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin <= 2.3.5 at WordPress allows users with subscriber or higher role to change plugin settings.
-
High 7.1
Dell BIOS versions contain a Stack-based Buffer Overflow vulnerability. A local authenticated malicious user could pote…
-
Low 3.0
Dell BIOS versions contain an Unchecked Return Value vulnerability. A local authenticated administrator user could pote…
-
Low 2.0
Dell BIOS versions contain an Improper Protection Against Voltage and Clock Glitches vulnerability. An attacker with ph…
-
Low 2.3
Dell BIOS versions contain an Improper Neutralization of Null Byte vulnerability. A local authenticated administrator u…
-
Low 2.3
Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability. A local authenticated …
-
Low 2.3
Dell BIOS versions contain an Information Exposure vulnerability. A local authenticated administrator user could potent…
-
Low 3.0
Dell BIOS versions contain an Unchecked Return Value vulnerability. A local authenticated administrator user could pote…
-
High 7.5
Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Los…
-
Critical 9.8
A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized a…
-
Unscored —CVE-2022-37860 EPSS 80%
The web configuration interface of the TP-Link M7350 V3 with firmware version 190531 is affected by a pre-authenticatio…
-
High 7.8
Buffer Over-read in gpac/gpac
Buffer Over-read in GitHub repository gpac/gpac prior to 2.1.0-DEV.
-
High 7.5
graphql-java vulnerable to Denial of Service via GraphQL query that consumes CPU resources
graphql-java before19.0 is vulnerable to Denial of Service. An attacker can send a malicious GraphQL query that consumes CPU resources. The fixed versions are 19.0 and later, 18.3, and 17.4, and 0.0.0-2022-07-26T05-45-04-226aabd9.
-
Unscored —
Torguard VPN 4.8, has a vulnerability that allows an attacker to dump sensitive information, such as credentials and in…
-
Unscored —
An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to download arbitrary files …
-
Unscored —
An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to write arbitrary files to …
-
Unscored —
An issue in the Feature Navigator of Micro-Star International MSI Feature Nagivator v1.0.1808.0901 allows attackers to …