Archive
13 September 2022
Vulnerabilities first published on this day (UTC), newest first.
201 results · Feed
-
Unscored —
AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the component /admin/profile.php. T…
-
Unscored —
The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to send SCRIPT ta…
-
Unscored —
The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to fetch other us…
-
Unscored —
The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to fetch cleartex…
-
Unscored —
The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to bypass authori…
-
Unscored —CVE-2022-37191 Scanner template
The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files …
-
Unscored —
CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). An authenticated user can control both parameters (action an…
-
Unscored —
Penta Security Systems Inc WAPPLES v6.0 r3 4.10-hotfix1 allows attackers to escalate privileges via overwriting files u…
-
Unscored —
An arbitrary file download vulnerability in the downloadAction() function of Penta Security Systems Inc WAPPLES v6.0 r3…
-
Unscored —
WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configu…
-
Unscored —
Penta Security Systems Inc WAPPLES 4.0.*, 5.0.0.*, 5.0.12.* are vulnerable to Incorrect Access Control. The operating s…
-
Unscored —
Cross site Scripting (XSS) in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs.
-
Unscored —
A vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a user can plac…
-
Unscored —
Insufficient access control vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39…
-
Unscored —
Genymotion Desktop v3.2.1 was discovered to contain a DLL hijacking vulnerability which allows attackers to escalate pr…
-
Medium 5.4
Moodle Cross-site Scripting vulnerability
In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS…
-
High 8.4
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout …
-
Medium 6.5
IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service after entering…
-
High 8.4
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kerne…
-
Medium 5.4
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allow…
-
Medium 6.5
IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to an information disclosure in some …
-
Low 3.7
IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the …
-
Medium 4.3
IBM Control Desk 7.6.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be a…
-
Unscored —
In NOKIA 1350 OMS R14.2, an Open Redirect vulnerability occurs is the login page via next HTTP GET parameter.
-
Unscored —
In NOKIA 1350 OMS R14.2, multiple OS Command Injection vulnerabilities occurs. This vulnerability allow unauthenticated…
-
Unscored —
In NOKIA 1350 OMS R14.2, Insufficiently Protected Credentials (cleartext administrator password) occur in the edit conf…
-
Unscored —
In NOKIA 1350 OMS R14.2, multiple SQL Injection vulnerabilities occurs. Exploitation requires an authenticated attacker…
-
Unscored —
In NOKIA 1350 OMS R14.2, multiple OS Command Injection vulnerabilities occurs. This allows authenticated users to execu…
-
Unscored —CVE-2022-38637 Scanner template
Hospital Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the Username and P…
-
Unscored —
In NOKIA 1350 OMS R14.2, an Insertion of Sensitive Information into an Application Log File vulnerability occurs. The w…
-
Unscored —
WAVLINK Quantum D4G (WN531G3) CSRF
The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 does not utilize anti-CSRF tokens, which, when combined with other issues (such as CVE-2022-35518), can lead to remote, unauthenticated command execution.
-
Unscored —
WAVLINK Quantum D4G (WN531G3) Pass-The-Hash
Because the WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing mechanism does not rely on a server-supplied key, it is possible for an attacker with sufficient ne…
-
Unscored —
WAVLINK Quantum D4G (WN531G3) Session Management by IP Address
The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the s…
-
Medium 5.5
LIEF contains a segmentation violation
LIEF commit 365a16a was discovered to contain a segmentation violation via the component CoreFile.tcc:69.
-
Medium 5.5
LIEF commit 365a16a was discovered to contain a reachable assertion abort via the component BinaryStream.hpp.
-
High 7.8
LIEF vulnerable to heap based buffer overflow via print_binary function
LIEF commit 365a16a was discovered to contain a heap-buffer overflow via the function print_binary at /c/macho_reader.c.
-
Medium 5.5
LIEF contains segmentation violation
LIEF commit 5d1d643 was discovered to contain a segmentation violation via the function LIEF::MachO::SegmentCommand::file_offset() at /MachO/SegmentCommand.cpp.
-
Medium 5.5
LIEF vulnerable to heap based buffer overflow
LIEF commit 5d1d643 was discovered to contain a heap-buffer overflow in the component /core/CorePrPsInfo.tcc.
-
High 8.8
Unisys Data Exchange Management Studio before 6.0.IC2 and 7.x before 7.0.IC1 doesn't have an Anti-CSRF token to authent…
-
Unscored —
Improper Access Control vulnerability in the Duo SMS two-factor of Devolutions Remote Desktop Manager 2022.2.14 and ear…