Archive
27 September 2022
Vulnerabilities first published on this day (UTC), newest first.
33 results · Feed
-
High 8.8
Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code ex…
-
Critical 9.8
SQL Injection vulnerability exists in version 1.0 of the Resumes Management and Job Application Website application log…
-
Medium 4.7
L2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with an invalid length during Ethernet to Wifi frame translation
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length and Ethernet to Wifi frame conversion (and optionally VLAN0 headers).
-
Medium 4.7
L2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with invalid lengths
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length (and optionally VLAN0 headers)
-
Medium 4.7
L2 network filtering bypass using stacked VLAN0, LLC/SNAP headers, and Ethernet to Wifi frame translation
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using combinations of VLAN 0 headers, LLC/SNAP headers, and converting frames from Ethernet to Wifi and its reverse.
-
Medium 5.3
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct…
-
Medium 4.7
L2 network filtering can be bypassed using stacked VLAN0 and LLC/SNAP headers
Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers.
-
High 8.4
readelf in ToaruOS 2.0.1 has a global overflow allowing RCE when parsing a crafted ELF file.
-
Medium 5.4
ISAMS 22.2.3.2 is prone to stored Cross-site Scripting (XSS) attack on the title field for groups, allowing an attacker…
-
Medium 5.4
Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template m…
-
Critical 9.8
Exam Reviewer Management System 1.0 is vulnerable to SQL Injection via the ‘id’ parameter.
-
High 8.8CVE-2022-40878 EPSS 24%
In Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profile page to ac…
-
Medium 6.5
Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad's asset handling mechanism has logic to ensure that cust…
-
Medium 4.3
Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents …
-
High 8.1CVE-2022-39258 Scanner template
mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI
mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credent…
-
Critical 9.0
Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.
Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability…
-
Low 1.8
Buffer Overflow Vulnerability in Western Digital My Cloud Home Products and SanDisk ibi
A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessing the system locally to read information from /etc/version file. This vulnerability can only be exp…
-
High 7.5CVE-2022-3323 EPSS 29%
An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet…
-
High 7.2
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parame…
-
High 7.2
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parame…
-
High 7.2
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parame…
-
High 8.8CVE-2022-37209 Public exploit
JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filter…
-
High 8.8
Strapi mishandles hidden attributes within admin API responses
Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.
-
High 7.4
Chipolo ONE Bluetooth tracker (2020) Chipolo iOS app version 4.13.0 is vulnerable to Incorrect Access Control. Chipolo …
-
High 8.8
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. This occurs bec…
-
Low 2.7
EC-CUBE Directory traversal vulnerability
Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information.
-
Medium 5.4
EC-CUBE DOM-based cross-site scripting vulnerability
DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page.
-
Critical 9.8
EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability w…
-
Critical 9.8
An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Local file inclusion can occur.
-
Critical 9.8
An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Unauthenticated SQL injection can occur.
-
High 7.5
In ambiot amb1_sdk (aka SDK for Ameba1) before 2022-06-20 on Realtek RTL8195AM devices before 284241d70308ff2519e40afd7…
-
Medium 4.7
A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL po…
-
High 7.8
Stack-based Buffer Overflow in vim/vim
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598.