Archive
September 2022
Vulnerabilities first published in this month (UTC), newest first.
2,174 results · Feed
-
Unscored —
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list.
-
Unscored —
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list.
-
Unscored —
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list.
-
Unscored —
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list.
-
Unscored —
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list.
-
Unscored —
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list.
-
Unscored —
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list.
-
Unscored —
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list.
-
Unscored —
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list.
-
Unscored —
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list.
-
Unscored —
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list.
-
Unscored —
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list.
-
Unscored —
In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permission…
-
High 7.2
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in…
-
Critical 9.0
Cross-site Scripting (XSS) - Stored in appwrite/appwrite
Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1.
-
High 7.3
Command Injection
The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.
-
Unscored —
A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network,…
-
Unscored —
In Singular before 4.3.1, a predictable /tmp pathname is used (e.g., by sdb.cc), which allows local users to gain the p…
-
Medium 6.2
A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text")…
-
Unscored —
An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denia…
-
Medium 5.7
OAuthLib vulnerable DoS when attacker provides malicious IPV6 URI
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions…
-
Unscored —
A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_…
-
Unscored —
A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The…
-
Unscored —
A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_strea…
-
Unscored —
An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call f…
-
Unscored —
An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition …
-
Unscored —CVE-2022-40297 Public exploit
UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. This passcode …
-
Unscored —
The TSS (Tuple Space Search) algorithm in Open vSwitch 2.x through 2.17.2 and 3.0.0 allows remote attackers to cause a …
-
Critical 9.9
cruddl vulnerable to AQL injection through flexSearch
cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses `@flexSearchFulltext`, users of that sche…
-
Critical 9.9CVE-2022-36100 EPSS 74%
XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection
XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7 in XWiki Platform Applications Tag and prior to 13.10.6 and 14.4 in XWiki Platform Tag UI, the tags document `Main.Tag…
-
Unscored —
An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisi…
-
Unscored —
An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisi…
-
Unscored —
An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). l2_packet_receive_timeout in wpa_supplicant/s…
-
Unscored —
An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). cyassl_connect_step2 in curl/vtls/cyassl.c ha…
-
Unscored —
School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the comp…
-
Unscored —
School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the comp…
-
Unscored —
School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the comp…
-
High 8.9CVE-2022-36098 EPSS 72%
XWiki Platform Mentions UI vulnerable to Cross-site Scripting
XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a men…
-
Critical 9.9CVE-2022-36099 EPSS 76%
XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability
XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milestone-2 and prior to versions 13.10.6 and 14.4, it's possible to inject arbitrary wiki syntax including Groovy, Python…
-
High 8.9CVE-2022-36097 EPSS 58%
XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form
XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-rc-1 and prior to 14.4-rc-1, it's possible to store JavaScript in an attachment name, which will be e…