Archive
23 September 2022
Vulnerabilities first published on this day (UTC), newest first.
203 results · Feed
-
Medium 5.4
WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 at WordPress.
-
Medium 5.4
WordPress Mega Addons For WPBakery Page Builder plugin <= 4.2.7 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Topdigitaltrends Mega Addons For WPBakery Page Builder plugin <= 4.2.7 at WordPress.
-
Medium 4.1
WordPress Meet My Team plugin <= 2.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Meet My Team plugin <= 2.0.5 at WordPress.
-
Critical 9.8
Tenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function setSmartPowerManagement…
-
Medium 6.7
The “LANDesk(R) Management Agent” service exposes a socket and once connected, it is possible to launch commands only f…
-
High 7.8
A local privilege escalation vulnerability in UI Desktop for Windows (Version 0.55.1.2 and earlier) allows a malicious …
-
Critical 9.8
Tenda AC15 and AC18 routers V15.03.05.19 contain heap overflow vulnerabilities in the function setSchedWifi with the re…
-
Medium 4.1
WordPress Blossom Recipe Maker plugin <= 1.0.7 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Blossom Recipe Maker plugin <= 1.0.7 at WordPress.
-
Medium 5.4
WordPress WHA Crossword plugin <= 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WHA Crossword plugin <= 1.1.10 at WordPress.
-
Critical 9.8
Tenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function fromDhcpListClient with…
-
Critical 9.8
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firew…
KEV Sep 23, 2022 -
High 7.7
Unchecked Download size in Uboot
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physi…
-
Critical 9.0
Heap-memory write in FFMPEG
A heap out-of-bounds memory write exists in FFMPEG since version 5.1. The size calculation in `build_open_gop_key_points()` goes through all entries in the loop and adds `sc->ctts_data[i].count` to `sc->sample_offsets_count`. This can lead to an integer overf…
-
Medium 6.7
Arbitrary Memory read in BPF Linux Kernel
There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpf_sys_bpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAP_BPF can arbitrarily re…
-
Medium 4.4
In JetBrains TeamCity before 2022.04.4 environmental variables of "password" type could be logged when using custom Per…
-
High 7.5
An issue has been found in PBC through 2022-8-27. A SEGV issue detected in the function pbc_wmessage_integer in src/wme…
-
Medium 5.9
Disabled Certificate Validation makes Broker, Proxy Admin Clients vulnerable to MITM attack
Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connecti…
-
Medium 5.9
Disabled Hostname Verification makes Brokers, Proxies vulnerable to MITM attack
TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster connections and geo-replication connecti…
-
Medium 5.9
Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITM
Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack. Connections from the Pulsar Java Client to the Pulsar Broker/Proxy and connections from the Pulsar Proxy to the Pulsar …
-
Medium 6.5
Apache Pulsar Proxy target broker address isn't validated
Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that originate from the Pulsar Proxy's IP address. When the Apache Pulsar Proxy component is used, it is possible to attempt to o…
-
Medium 6.4
Session Fixation in ikus060/rdiffweb
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.
-
Critical 9.8
Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support
In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pi…
-
Medium 4.2
Improper Authentication in Arvados when using PAM as identity provider
Arvados is an open source platform for managing and analyzing biomedical big data. In versions prior to 2.4.3, when using Portable Authentication Modules (PAM) for user authentication, if a user presented valid credentials but the account is disabled or other…
-
Medium 6.1
nefly-ipx subject to Server-Side Request Forgery and Stored Cross-Site Scripting via Cache Poisoning and Improper Host Validation
netlify-ipx is an on-Demand image optimization for Netlify using ipx. In versions prior to 1.2.3, an attacker can bypass the source image domain allowlist by sending specially crafted headers, causing the handler to load and return arbitrary images. Because t…
-
Low 3.7
Parse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumvented
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.16, or from 5.0.0 to 5.2.6, validation of the authentication adapter app ID for _Facebook_ and _Spotify_ may be circumvented. Con…
-
Medium 6.5
Security issue in fhir-works-on-aws-authz-smart
fhir-works-on-aws-authz-smart is an implementation of the authorization interface from the FHIR Works interface. Versions 3.1.1 and 3.1.2 are subject to Exposure of Sensitive Information to an Unauthorized Actor. This issue allows a client of the API to retri…
-
Critical 9.1CVE-2022-39227 Public exploit
Python-jwt subject to Authentication Bypass by Spoofing
python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitr…
-
Medium 4.3
Parse Server subject to Incorrect Resource Transfer Between Spheres
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.15, or 5.0.0 and above prior to 5.2.6, a user can write to the session object of another user if the session object ID is known. …
-
High 8.1
hoek subject to prototype pollution via the clone function.
hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
-
High 7.8
In Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code …
-
Medium 6.5
Veritas System Recovery (VSR) versions 18 and 21 store a network destination password in the Windows registry during co…
-
Unscored —
Netgear N300 wireless router wnr2000v4-V1.0.0.70 is vulnerable to Buffer Overflow via uhttpd. There is a stack overflow…
-
Critical 9.8
Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134_10.2.119 is vulnerable to Buffer Overflo…
-
High 7.0
Redis subject to Integer Overflow leading to Remote Code Execution via Heap Overflow
Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an `XAUTOCLAIM` command on a stream key in a specific state, with a specially crafted `COUNT` argument may cause an…
-
Low 3.7
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when …
-
Medium 5.5
An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 15.6 and iPad…
-
High 7.8
A type confusion issue was addressed with improved state handling. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 1…
-
Critical 9.8
Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase conte…
-
Medium 6.8
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552.
-
Medium 6.5
HashiCorp Consul vulnerable to authorization bypass
HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13…