Archive
September 2022
Vulnerabilities first published in this month (UTC), newest first.
2,174 results · Feed
-
Medium 6.1
Smart eVision - Stored XSS
Smart eVision has insufficient filtering for special characters in the POST Data parameter in the specific function. An unauthenticated remote attacker can inject JavaScript to perform XSS (Stored Cross-Site Scripting) attack.
-
Medium 6.5
Smart eVision - Path Traversal -2
Smart eVision has a path traversal vulnerability in the Report API function due to insufficient filtering for special characters in URLs. A remote attacker with general user privilege can exploit this vulnerability to bypass authentication, access restricted …
-
Critical 9.8
Smart eVision - Path Traversal -1
Smart eVision’s file acquisition function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication, access restrict…
-
High 8.8
Smart eVision - Improper Privilege Management
Smart eVision has an improper privilege management vulnerability. A remote attacker with general user privilege can exploit this vulnerability to escalate to administrator privilege, and then perform arbitrary system command or disrupt service.
-
Medium 5.3
Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -3
Smart eVision has insufficient authorization for task acquisition function. An unauthorized remote attacker can exploit this vulnerability to acquire the Session IDs of other general users only.
-
High 7.5
Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -2
smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly authorized to access the information, can access sensitive information.
-
Medium 6.5
Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -1
Smart eVision has inadequate authorization for the database query function. A remote attacker with general user privilege, who is not explicitly authorized to access the information, can access sensitive information.
-
Medium 5.9
ASUS Armoury Crate Service - Arbitrary File Creation via Elevation of Privilege Flaw
Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing…
-
High 8.6
Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as…
-
High 7.5
Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shie…
-
Medium 4.3
Matrix Javascript SDK improper beacon events can cause availability issues
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process…
-
High 7.5
Twig may load a template outside a configured directory when using the filesystem loader
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` st…
-
High 8.6
nheko vulnerable to secret poisoning using MITM on secret requests by the homeserver
nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this is…
-
High 7.5
SQL-injection in Car Park Server 3.0 allows for full database access.
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of an SQL-injection to gain access to a volatile temporary database with the current states of the device.
-
High 7.8
In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.
-
Medium 4.3
In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have acce…
-
Critical 9.8
XXL-JOB contains a Command execution vulnerability in background tasks
XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. NOTE: this is disputed because the issues/4929 report is about an intended and supported use case (running arbitrary Bash scripts on behalf of users).
-
Low 3.7
Apache Tomcat: Information disclosure
The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.…
-
High 8.8
Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code ex…
-
Critical 9.8
SQL Injection vulnerability exists in version 1.0 of the Resumes Management and Job Application Website application log…
-
Medium 4.7
L2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with an invalid length during Ethernet to Wifi frame translation
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length and Ethernet to Wifi frame conversion (and optionally VLAN0 headers).
-
Medium 4.7
L2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with invalid lengths
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length (and optionally VLAN0 headers)
-
Medium 4.7
L2 network filtering bypass using stacked VLAN0, LLC/SNAP headers, and Ethernet to Wifi frame translation
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using combinations of VLAN 0 headers, LLC/SNAP headers, and converting frames from Ethernet to Wifi and its reverse.
-
Medium 5.3
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct…
-
Medium 4.7
L2 network filtering can be bypassed using stacked VLAN0 and LLC/SNAP headers
Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers.
-
High 8.4
readelf in ToaruOS 2.0.1 has a global overflow allowing RCE when parsing a crafted ELF file.
-
Medium 5.4
ISAMS 22.2.3.2 is prone to stored Cross-site Scripting (XSS) attack on the title field for groups, allowing an attacker…
-
Medium 5.4
Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template m…
-
Critical 9.8
Exam Reviewer Management System 1.0 is vulnerable to SQL Injection via the ‘id’ parameter.
-
High 8.8CVE-2022-40878 EPSS 24%
In Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profile page to ac…
-
Medium 6.5
Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad's asset handling mechanism has logic to ensure that cust…
-
Medium 4.3
Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents …
-
High 8.1CVE-2022-39258 Scanner template
mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI
mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credent…
-
Critical 9.0
Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.
Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability…
-
Low 1.8
Buffer Overflow Vulnerability in Western Digital My Cloud Home Products and SanDisk ibi
A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessing the system locally to read information from /etc/version file. This vulnerability can only be exp…
-
High 7.5CVE-2022-3323 EPSS 29%
An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet…
-
High 7.2
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parame…
-
High 7.2
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parame…
-
High 7.2
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parame…
-
High 8.8CVE-2022-37209 Public exploit
JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filter…