Archive
September 2022
Vulnerabilities first published in this month (UTC), newest first.
2,174 results · Feed
-
Unscored —
A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arb…
-
Unscored —
A SQL injection vulnerability in Stocks.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbi…
-
Unscored —
A SQL injection vulnerability in SupplierDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute…
-
Unscored —
Multiple persistent cross-site scripting (XSS) vulnerabilities in index.php in tramyardg Hotel Management System 1.0 al…
-
Unscored —
Cross-site scripting vulnerability in Movable Type plugin A-Form versions prior to 4.1.1 (for Movable Type 7 Series) an…
-
Unscored —
In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket h…
-
Critical 9.8
Pebble Templates protection mechanism bypass can lead to arbitrary code execution
Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus e…
-
Unscored —
In Simple Online Book Store System 1.0 in /admin_book.php the Title, Author, and Description parameters are vulnerable …
-
Unscored —
In Library Management System 1.0 the /card/in-card.php file id_no parameters are vulnerable to SQL injection.
-
Unscored —
SysAid Help Desk before 22.1.65 allows XSS via the Asset Dashboard, aka FR# 67262.
-
Unscored —
SysAid Help Desk before 22.1.65 allows XSS via the Linked SRs field, aka FR# 67258.
-
Unscored —
SysAid Help Desk before 22.1.65 allows XSS in the Password Services module, aka FR# 67241.
-
Unscored —
SysAid Help Desk before 22.1.65 allows XSS, aka FR# 66542 and 65579.
-
Medium 5.4
Open Redirect
This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url.Parse(r.FormValue("next")) to extract path and eventually redirect user to a relative URL, but if n…
-
Medium 5.3CVE-2022-26049 Public exploit
Arbitrary File Write via Archive Extraction (Zip Slip)
This affects the package com.diffplug.gradle:goomph before 3.37.2. It allows a malicious zip file to potentially break out of the expected destination directory, writing contents into arbitrary locations on the file system. Overwriting certain files/directori…
-
Critical 9.8
Apache Calcite: potential XEE attacks
Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefo…
-
Unscored —
PDF Labs pdftk-java v3.2.3 was discovered to contain an infinite loop via the component /text/pdf/PdfReader.java.
-
Unscored —
cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.
-
Critical 9.1
Casdoor arbitrary file write vulnerability
Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.
-
High 8.8
Netmaker vulnerable to Insufficient Granularity of Access Control
Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their au…
-
High 7.5
Hyperledger Indy DOS vulnerability
indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity. In vulnerable versions of indy-node, an attacker can max out the number of client connections allowed by the ledger, leaving the ledger unable …
-
Medium 5.4
Markdown-Nice v1.8.22 vulnerable to Cross-site Scripting
A cross-site scripting (XSS) vulnerability in Markdown-Nice v1.8.22 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Community Posting field.
-
Unscored —
An issue was discovered in Active Intelligent Visualization 5. The Vdc header is used in a SQL query without being sani…
-
Unscored —
In man2html 1.6g, a filename can be created to overwrite the previous size parameter of the next chunk and the fd, bk, …
-
Unscored —
In man2html 1.6g, a specific string being read in from a file will overwrite the size parameter in the top chunk of the…
-
High 7.0
OS Command Injection in jgraph/drawio
OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0.
-
Medium 5.3
Moby vulnerability relating to supplementary group permissions
Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementa…
-
Unscored —CVE-2022-40317 Public exploit
OpenKM 6.3.11 allows stored XSS related to the javascript: substring in an A element.
-
Unscored —CVE-2022-39810 EPSS 58%
An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting (XSS) vulnerability has b…
-
Unscored —
An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting (XSS) vulnerability has b…
-
Unscored —
An issue in the IGB Files and OutfileService features of SmartVista Cardgen v3.28.0 allows attackers to list and downlo…
-
Unscored —
SmartVista SVFE2 v2.2.22 was discovered to contain multiple SQL injection vulnerabilities via the UserForm:j_id88, User…
-
Medium 5.4
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 2…
-
Unscored —
aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized A…
-
Unscored —
aEnrich eHRD Learning Management Key Performance Indicator System 5+ has Improper Access Control. The web application d…
-
Unscored —
aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion (LFI) vulnerability t…
-
Unscored —
A Path Traversal vulnerability in SmartVista Cardgen v3.28.0 allows authenticated attackers to read arbitrary files in …
-
Unscored —
Arq Backup 7.19.5.0 and below stores backup encryption passwords using reversible encryption. This issue allows attacke…
-
Medium 4.8
WordPress Word Search Puzzles game plugin <= 2.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in WHA's Word Search Puzzles game plugin <= 2.0.1 at WordPress.
-
Medium 4.1
WordPress Gallery PhotoBlocks plugin <= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress.