Archive
13 September 2022
Vulnerabilities first published on this day (UTC), newest first.
201 results · Feed
-
High 7.8
.NET Framework Remote Code Execution Vulnerability
.NET Framework Remote Code Execution Vulnerability
-
High 7.0
Windows Photo Import API Elevation of Privilege Vulnerability
Windows Photo Import API Elevation of Privilege Vulnerability
-
Critical 9.0
Access Control Bypass in Onedev
Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take over a OneDev instance if there is no properly configured reverse proxy. The /git-prereceive-callback endpoint is used …
-
Medium 6.4CVE-2022-40635 Public exploit
Improper Control of Dynamically-Managed Code Resources in Crafter Studio
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.
-
Medium 6.4CVE-2022-40634 Public exploit
Improper Control of Dynamically-Managed Code Resources in Crafter Studio
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.
-
High 8.8
Parsing issue in matrix-org/node-irc leading to room takeovers
matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to grant themselves pe…
-
Unscored —
A vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a low-privilege…
-
Medium 4.3
IRC mode parameter confusion in matrix-appservice-irc
matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat (IRC) protocol allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affected versions of matri…
-
Medium 5.3
User Enumeration via Response Timing in TYPO3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user authentication (backend and frontend) can be used to distinguish between existing and non-existing user…
-
Medium 5.4
Missing check for expiration time of password reset token in TYPO3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be …
-
Medium 6.5
Stored Cross-Site Scripting via FileDumpController
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `FileDumpController` (backend and frontend context) is vulnerable to cross-site scripting when malicious files are displayed using this…
-
Medium 5.9
Denial of Service via Page Error Handling in TYPO3/cms
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error m…
-
Medium 6.5
Cross-Site Scripting in typo3/cms-core
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `f:asset.css` view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Update to TYPO3 vers…
-
Unscored —
Failure to strip relative path components in net/url
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from …
-
High 7.2
Talos worker join token can be used to get elevated access level to the Talos API
Talos Linux is a Linux distribution built for Kubernetes deployments. Talos worker nodes use a join token to get accepted into the Talos cluster. Due to improper validation of the request while signing a worker node CSR (certificate signing request) Talos con…
-
Medium 6.1
Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer
The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. Due to a parsing issue in the upstream package `masterminds/html5`, malicious markup used in a se…
-
High 7.1
Weak Password Requirements in ikus060/rdiffweb
Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2.
-
Unscored —
Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console (CMC) - version …
-
High 7.5
SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session eve…
-
Medium 6.1
An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchp…
-
Unscored —
SAP NetWeaver Enterprise Portal (KMC) - version 7.50, does not sufficiently encode user-controlled inputs, resulting in…
-
Unscored —
An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Se…
-
Unscored —
In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed withi…
-
Unscored —
An out-of-bounds access issue was found in the Linux kernel sound subsystem. It could occur when the 'id->name' provide…
-
High 7.5
Fatal error on incorrect base64 data in RRDP
In NLnet Labs Routinator 0.9.0 up to and including 0.11.2, due to a mistake in error handling, data in RRDP snapshot and delta files that isn’t correctly base 64 encoded is treated as a fatal error and causes Routinator to exit. Worst case impact of this vuln…
-
Medium 5.9
Pal Electronics Systems - Pal Gate Authorization Errors
Pal Electronics Systems - Pal Gate Authorization Errors. The vulnerability is an authorization problem in PalGate device management android client app. Gates of bulidings and parking lots with a simple button in any smartphone. The API was found after a decom…
-
Medium 6.5
Synel - eHarmony Stored XSS
insert HTML / js code inside input how to get to the vulnerable input : Workers > worker nickname > inject in this input the code.
-
Medium 4.9
Avdor CIS - crystal quality Credentials Management Errors
Avdor CIS - crystal quality Credentials Management Errors. The product is phone call recorder, you can hear all the recorded calls without authenticate to the system. Attacker sends crafted URL to the system: ip:port//V=2;ChannellD=number;Ext=number;Command=s…
-
Medium 6.5CVE-2022-36779 Public exploit
PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection
PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection Proscend M330-w / M33-W5 / M350-5G / M350-W5G / M350-6 / M350-W6 / M301-G / M301-GW ADVICE ICR 111WG / https://www.proscend.com/en/category/in…
-
Low 3.0
Contec Health CMS8000
Multiple binary application files on the CMS8000 device are compiled with 'not stripped' and 'debug_info' compilation settings. These compiler settings greatly decrease the level of effort for a threat actor to reverse engineer sensitive code and identify add…
-
Medium 5.7
Contec Health CMS8000
The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point. A threat actor could create an SSID with a malicious name, including non-standard characters that, when the device attempts connecting to the malicious SSID, t…
-
Medium 4.3
Contec Health CMS8000
Multiple globally default credentials exist across all CMS8000 devices, that once exposed, allow a threat actor with momentary physical access to gain privileged access to any device. Privileged credential access enables the extraction of sensitive patient in…
-
High 7.5
Contec Health CMS8000
The CMS800 device fails while attempting to parse malformed network data sent by a threat actor. A threat actor with network access can remotely issue a specially formatted UDP request that will cause the entire device to crash and require a physical reboot. …
-
Medium 6.8
Contec Health CMS8000
A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resulting in permanent changes to device functionality. No authentication or controls are in place to prevent a threat actor from maliciously m…
-
Unscored —
A potential security vulnerability has been identified in HP ThinPro 7.2 Service Pack 8 (SP8). The security vulnerabili…
-
Unscored —
Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the kil…
-
Unscored —
Archery v1.7.5 to v1.8.5 was discovered to contain a SQL injection vulnerability via the where parameter at /archive/ap…
-
Medium 5.4
WordPress RD Station plugin <= 5.2.0 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in RD Station plugin <= 5.2.0 at WordPress.
-
High 7.1
Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used t…
-
High 7.1
Podman's incorrect handling of the supplementary groups may lead to data disclosure, modification
An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to…