Archive
30 September 2022
Vulnerabilities first published on this day (UTC), newest first.
69 results · Feed
-
High 7.2
AP Manager in Innovaphone before 13r2 Service Release 17 allows command injection via a modified service ID during app …
-
Medium 6.6
AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This i…
-
High 7.8
Joplin Remote Code Execution
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existi…
-
High 7.8
Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a …
-
Medium 4.8
WordPress Comment Guestbook plugin <= 0.8.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Comment Guestbook plugin <= 0.8.0 at WordPress.
-
Medium 4.8
WordPress Social Media Follow Buttons Bar plugin <= 4.73 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73 at WordPress.
-
High 8.8CVE-2022-36961 EPSS 74%
Orion Platform SQL Injection Privilege Escalation Vulnerability
A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution.
-
Medium 5.4
PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentica…
-
High 7.2
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinvento…
-
High 7.2
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinvento…
-
High 7.2
Billing System Project v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /ph…
-
Medium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attacker…
-
High 7.5
No limit in length of "Token name" parameter results in DOS attack /memory corruption in ikus060/rdiffweb prior to 2.5.0a3 in ikus060/rdiffweb
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.
-
High 7.5
Multiple DoS Attack Vectors in sflow packet handling
sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service.
-
Medium 4.9
Relative Path Traversal in dnnsoftware/dnn.platform
Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0.
-
Medium 4.2
drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse funct…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expression in the parser of Colors.js.
-
High 8.1
Lithium vulnerable to Cross Site Scripting in provided Swagger-UI
### Impact A XSS vulnerability in the provided (outdated) Swagger-UI is exploitable in applications using lithium with Swagger-UI enabled. This allows an attacker gain Remote Code Execution (RCE) and potentially exfiltrate secrets in the context of this swagg…
-
Medium 5.5
An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_Array<AP4_ElstEn…
-
Medium 5.5
An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_DataBuffer::Real…
-
Medium 5.5
An issue was discovered in Bento4 1.6.0-639. A memory leak exists in AP4_StdcFileByteStream::Create(AP4_FileByteStream*…
-
Medium 5.5
An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_File::ParseStream in Core…
-
Medium 5.5
An issue was discovered in Xpdf 4.04. There is a crash in gfseek(_IO_FILE*, long, int) in goo/gfile.cc.
-
Medium 5.5
An issue was discovered in Xpdf 4.04. There is a crash in convertToType0 in fofi/FoFiType1C.cc, a different vulnerabili…
-
Medium 5.5
An issue was discovered in Xpdf 4.04. There is a crash in XRef::fetch(int, int, Object*, int) in xpdf/XRef.cc, a differ…
-
Critical 9.8
In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.
-
Unscored —
drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if …
-
Unscored —
roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant …