Archive
30 September 2022
Vulnerabilities first published on this day (UTC), newest first.
26 results · Clear filters · Feed
-
High 8.1
orchest vulnerable to cross-site request forgery that allows control of a user instance
### Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may cause actions to be performed on the website that can include inadvertent client or server data leakage, change of ses…
-
High 7.4
Cisco Catalyst 9100 Series Access Points Association Request Denial of Service Vulnerability
A vulnerability in the 802.11 association frame validation of Cisco Catalyst 9100 Series Access Points (APs) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to ins…
-
High 8.6
Cisco IOS and IOS XE Software Common Industrial Protocol Request Denial of Service Vulnerability
A vulnerability in the processing of malformed Common Industrial Protocol (CIP) packets that are sent to Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to unexpectedly reload, resulting…
-
High 8.8
mojoPortal v2.7 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbi…
-
High 8.6
Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Mobility Denial of Service Vulnerability
A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) Mobility messages in Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, remote attacker to cause a denial of s…
-
High 7.9
Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points Privilege Escalation Vulnerability
A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points could allow an authenticated, local attacker to escape the restricted controller shell and execute arbitrary commands on the…
-
High 8.6
Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst 9100 Series Access Points UDP Processing Denial of Service Vulnerability
A vulnerability in the UDP processing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst 9100 Series Access Points could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerabili…
-
High 8.6
Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family DHCP Processing Denial of Service Vulnerability
A vulnerability in the DHCP processing functionality of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to the impro…
-
High 7.8CVE-2022-20818 Public exploit
Cisco SD-WAN Software Privilege Escalation Vulnerabilities
Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit …
-
High 7.8
Cisco SD-WAN Software Privilege Escalation Vulnerability
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerab…
KEV Feb 25, 2026 -
High 7.4
Cisco Wireless LAN Controller AireOS Software FIPS Mode Denial of Service Vulnerability
A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) AireOS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insuf…
-
High 8.8
If folder security is misconfigured for Actian Zen PSQL BEFORE Patch Update 1 for Zen 15 SP1 (v15.11.005), Patch Update…
-
High 7.8
RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI ins…
-
High 8.1
Directory Traversal vulnerability in htmly before 2.8.1 allows remote attackers to perform arbitrary file deletions via…
-
High 7.4
Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 ver…
-
High 7.1
Moodle Stored Cross-site Scripting and page denial of service
Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load.
-
High 7.2
AP Manager in Innovaphone before 13r2 Service Release 17 allows command injection via a modified service ID during app …
-
High 7.8
Joplin Remote Code Execution
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existi…
-
High 7.8
Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a …
-
High 8.8CVE-2022-36961 EPSS 74%
Orion Platform SQL Injection Privilege Escalation Vulnerability
A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution.
-
High 7.2
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinvento…
-
High 7.2
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinvento…
-
High 7.2
Billing System Project v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /ph…
-
High 7.5
No limit in length of "Token name" parameter results in DOS attack /memory corruption in ikus060/rdiffweb prior to 2.5.0a3 in ikus060/rdiffweb
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.
-
High 7.5
Multiple DoS Attack Vectors in sflow packet handling
sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service.
-
High 8.1
Lithium vulnerable to Cross Site Scripting in provided Swagger-UI
### Impact A XSS vulnerability in the provided (outdated) Swagger-UI is exploitable in applications using lithium with Swagger-UI enabled. This allows an attacker gain Remote Code Execution (RCE) and potentially exfiltrate secrets in the context of this swagg…