Archive
September 2022
Vulnerabilities first published in this month (UTC), newest first.
2,174 results · Feed
-
Medium 5.3
A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for th…
-
High 7.5
SwiftNIO vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
NIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack. This occurs when a HTTP/1.1 server accepts user generated input from an incoming request and reflects it into a HTTP/1.1 response header in some f…
-
Medium 5.3
ConnectWise - ScreenConnect Session Code Bypass
ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unautho…
-
Medium 6.5
When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/r…
-
Medium 6.1
An HTML injection/reflected Cross-site scripting (XSS) vulnerability was found in the ovirt-engine. A parameter "error_…
-
Medium 5.4
A stored Cross-Site Scripting (XSS) vulnerability exists in version 1.0 of the Expense Management System application th…
-
Low 3.3
readelf in ToaruOS 2.0.1 has some arbitrary address read vulnerabilities when parsing a crafted ELF file.
-
Medium 4.3
IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they sho…
-
Medium 6.4
IBM Jazz for Service Management is vulnerable to stored cross-site scripting. This vulnerability allows users to embed …
-
Medium 4.3
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending…
-
Medium 5.4
IBM Application Gateway is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaS…
-
High 8.2
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. There is an SMM memory corruption vulnerabilit…
-
Low 3.5
Open5GS UDP Packet ogs-tlv-msg.c denial of service
A vulnerability has been found in Open5GS up to 2.4.10 and classified as problematic. This vulnerability affects unknown code in the library lib/core/ogs-tlv-msg.c of the component UDP Packet Handler. The manipulation leads to denial of service. The exploit h…
-
Critical 9.8
Tenda TX3 US_TX3V1.0br_V16.03.13.11 is vulnerable to stack overflow via compare_parentcontrol_time.
-
Medium 6.1
ETAP Lighting International NV ETAP Safety Manager 1.0.0.32 is vulnerable to Cross Site Scripting (XSS). Input passed t…
-
Medium 6.1
Reflected XSS in Carlo Gavazzi UWP 3.0
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy is prone to reflected XSS which only affects the Sentilo service.
-
Low 2.7
SQL-Injection in Carlo Gavazzi UWP 3.0 Sentilo Proxy
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy server was discovered to contain a SQL injection vulnerability allowing an attacker to query other tables of the Sentilo service.
-
Critical 9.8
Path traversal in Carlo Gavazzi UWP 3.0 could lead to full device access
Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability which enables remote attackers to read arbitrary files and gain full control of the device.
-
Critical 9.8
Use of Hard-coded Credentials in UWP3.0 allows SuperUser authentication bypass in Car Park Server.
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain SuperUser access to the device.
-
Critical 9.8
Possible command injection in Car Park Server in Carlo Gavazzi UWP3.0
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could utilize an improper input validation on an API-submitted parameter to execute arbitrary OS commands.
-
Critical 9.8
Missing authentication for API in Carlo Gavazzi UWP 3.0 Car Park Server
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a missing authentication allows for full access via API.
-
Critical 9.4
SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database access
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an unauthenticated remote attacker could utilize a SQL-Injection vulnerability to gain full database access, modify users and stop services .
-
High 7.2
Command injection in restore function of Carlo Gavazzi UWP3.0 allows for command injection
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function
-
High 7.5
Carlo Gavazzi UWP 3.0 WebApp allows for authentication bypass
An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows an authentication bypass to the context of an unauthorised user if free-access is disabled.
-
Critical 9.8
Hard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the device
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain full access to the device.
-
Critical 9.6CVE-2022-40083 Scanner template
Labstack Echo Open Redirect vulnerability
Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).
-
High 7.5
Hertz contains path traversal via normalizePath function
Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function.
-
High 8.8
TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 57450(5553) was discovered to allow authenticated att…
-
Medium 6.8
Sony PS4/PS5 exFAT UVFAT_readupcasetable heap-based overflow
A vulnerability was found in Sony PS4 and PS5. It has been classified as critical. This affects the function UVFAT_readupcasetable of the component exFAT Handler. The manipulation of the argument dataLength leads to heap-based buffer overflow. It is possible …
-
Unscored —
Library exclusively intended to inject UB into safe Rust.
Quoting from the crate description: > This crate is created purely to inject undefined behavior into stable, safe rust. Specifically, the `inconceivable!` macro is insta-UB if the `ub_inconceivable` feature is enabled by *any* reverse dependency. The value th…
-
Critical 9.1
An authorization bypass in b2evolution allows remote, unauthenticated attackers to predict password reset tokens for an…
-
Medium 4.3
bytebase - Improper Authorization
The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues by “Admin” and the affected endpoint is “/issue”.
-
Medium 4.3
bytebase - Improper Authorization
The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=${userId}”.
-
Medium 6.1
ovs - buffer over-read
In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function could lead access to an unmapped region of memory. This vulnerability is capable of crashing the software, memory modificati…
-
High 7.8
notepad-plus-plus - DLL Hijacking
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the context of Notepad++.
-
Medium 6.5
Exposure of Sensitive Information to an Unauthorized Actor in tooljet/tooljet
Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is needed to be an editor in the same app as the victim.
-
Low 3.5
Zephyr Project Manager REST Call cross site scripting
A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to…
-
Medium 6.3
SourceCodester Food Ordering Management System POST Parameter router.php sql injection
A vulnerability classified as critical has been found in SourceCodester Food Ordering Management System. This affects an unknown part of the file router.php of the component POST Parameter Handler. The manipulation of the argument username leads to sql inject…
-
Medium 6.1
COWELL INFORMATION SYSTEM CO., LTD. enterprise travel management system - Reflected XSS
Cowell enterprise travel management system has insufficient filtering for special characters within web URL. An unauthenticated remote attacker can inject JavaScript and perform XSS (Reflected Cross-Site Scripting) attack.
-
Medium 6.1
HEIMAVISTA INC. Rpage - Reflected XSS
Heimavista Rpage has insufficient filtering for platform web URL. An unauthenticated remote attacker can inject JavaScript and perform XSS (Reflected Cross-Site Scripting) attack.