Archive
September 2022
Vulnerabilities first published in this month (UTC), newest first.
2,174 results · Feed
-
Unscored —CVE-2022-2753 EPSS 85%
Ketchup Restaurant Reservations <= 1.0.0 - Unauthenticated Stored XSS
The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation m…
-
Unscored —
Scroll To Top < 1.4.1 - Admin+ Stored Cross-Site Scripting
The Scroll To Top WordPress plugin before 1.4.1 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in mu…
-
Unscored —
Float to Top Button <= 2.3.6 - Admin+ Stored Cross-Site Scripting
The Float to Top Button WordPress plugin through 2.3.6 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for exampl…
-
Unscored —
Form Builder CP < 1.2.32 - Admin+ Stored Cross-Site Scripting
The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallow…
-
Unscored —
WordPress Ping Optimizer < 2.35.1.3.0 - Arbitrary Settings Update via CSRF
The WordPress Ping Optimizer WordPress plugin before 2.35.1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
-
Unscored —CVE-2022-1580 Scanner template
Site Offline < 1.5.3 - Access Bypass
The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main …
-
Unscored —
The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party…
-
Unscored —
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the voiceAudit:j_id97 parameter at…
-
Unscored —
A stored Cross-Site Scripting (XSS) vulnerability in OPSWAT MetaDefender ICAP Server before 4.13.0 allows attackers to …
-
Critical 9.8
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
KEV Mar 7, 2023 -
Unscored —
An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the edit…
-
Unscored —
A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Wh…
-
Unscored —
Safe Software FME Server v2021.2.5 and below does not employ server-side validation.
-
Critical 9.6
Safe Software FME Server v2021.2.5, v2022.0.0.2 and below contains a cross-site scripting (XSS) vulnerability which all…
-
Unscored —
A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for …
-
Unscored —
NEX-Forms < 7.9.7 - Authenticated SQLi
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default adm…
-
Unscored —CVE-2022-3141 Public exploit
Translatepress Multilinugal < 2.3.3 - Admin+ SQLi
The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time…
-
Unscored —
Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
-
Unscored —
A vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service could allow an attacker to bypass the pro…
-
Unscored —
Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used…
-
Unscored —CVE-2022-37032 Public exploit
An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of serv…
-
Unscored —
An issue was discovered in Bento4 through 1.6.0-639. There is a NULL pointer dereference in AP4_StszAtom::GetSampleSize.
-
Unscored —
An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_StszAtom::WriteFields.
-
Unscored —CVE-2022-40769 Public exploit
profanity through 1.60 has only four billion possible RNG initializations. Thus, attackers can recover private keys fro…
-
Medium 4.6
Cross-site Scripting (XSS)
The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.
-
Unscored —
Modern Campus Omni CMS (formerly OU Campus) 10.2.4 allows login-page SQL injection via a '" OR 1 = 1 -- - , <?php' subs…
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0490.
-
Unscored —
drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel m…
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb
Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.5.
-
Unscored —
The Netic Group Export add-on before 1.0.3 for Atlassian Jira does not perform authorization checks. This might allow a…
-
Medium 5.6
Cross-site Scripting (XSS) - Stored in librenms/librenms
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.9.0.
-
Medium 4.3
Improper Authentication in snipe/snipe-it
Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483.
-
Medium 5.8
Improper Neutralization of Formula Elements in a CSV File in ghas-to-csv
some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an …
-
Medium 4.3
Last video frame is still sent after video is disabled in a call in Nextcloud Talk
Nextcloud Talk is an open source chat, video & audio calls client for the Nextcloud platform. In affected versions an attacker could see the last video frame of any participant who has video disabled but a camera selected. It is recommended that the Nextcloud…
-
Low 3.2
Access to internal files of the Nextcloud Android app
Nextcloud android is the official Android client for the Nextcloud home server platform. Internal paths to the Nextcloud Android app files are not properly protected. As a result access to internal files of the from within the Nextcloud Android app is possibl…
-
Low 3.0
Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud Server
Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nextcloud Server is upgraded to 23.0.8 or 24.0.4. It is recommend…
-
Medium 5.9
Integer overflow in math ops in TensorFlow
TensorFlow is an open source platform for machine learning. When `RangeSize` receives values that do not fit into an `int64_t`, it crashes. We have patched the issue in GitHub commit 37e64539cd29fcfb814c4451152a60f5d107b0f0. The fix will be included in Tensor…
-
Medium 5.9
Assertion fail on MLIR empty edge names in TensorFlow
TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it crashes. We have patched the issue in GitHub commit ad069af92392efee1418c48ff561fd3070a03d7b. The fix will…
-
Medium 5.9
Floating point exception in `Conv2D` in TensorFlow
TensorFlow is an open source platform for machine learning. If `Conv2D` is given empty `input` and the `filter` and `padding` sizes are valid, the output is all-zeros. This causes division-by-zero floating point exceptions that can be used to trigger a denial…