Archive
September 2022
Vulnerabilities first published in this month (UTC), newest first.
2,174 results · Feed
-
High 8.8
Remote code execution in Indy's NODE_UPGRADE transaction
Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the `pool-upgrade` request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes withi…
-
Medium 6.3
An improper neutralization of special elements used in a template engine vulnerability [CWE-1336] in FortiSOAR manageme…
-
Medium 4.6
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.2.0, version…
-
Medium 6.3
An improper privilege management vulnerability [CWE-269] in FortiADC versions 6.2.1 and below, 6.1.5 and below, 6.0.4 a…
-
Medium 5.4
An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail of FortiMail befor…
-
High 7.0
An improper privilege management vulnerability [CWE-269] in Fortinet FortiSOAR before 7.2.1 allows a GUI user who has a…
-
Medium 6.3
Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiSOAR before 7.2.1 allows an authenticated at…
-
Low 2.3
A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the keytab files in FortiOS version…
-
High 7.8
An improper neutralization of special elements [CWE-89] used in an OS command vulnerability [CWE-78] in the command lin…
-
Medium 6.8
A improper verification of source of a communication channel in Fortinet FortiOS with IPS engine version 7.201 through …
-
High 8.1
Improper Handling of Length Parameter Inconsistency in francoisjacquet/rosariosis
Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0.
-
High 7.6
Improper Authorization in chatwoot/chatwoot
Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8.
-
High 7.2
OS Command Injection Vulnerability in RAID Manager Storage Replication Adapter
OS Command Injection vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated users to execute arbitrary OS commands. This issue affects: Hitachi RAID Manager Storage Replication Adapter 02.01.04 versions prior to 02.03.02…
-
Critical 9.0
Information Exposure Vulnerability in RAID Manager Storage Replication Adapter
Information Exposure Through an Error Message vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated users to gain sensitive information. This issue affects: Hitachi RAID Manager Storage Replication Adapter 02.01.04 vers…
-
Critical 9.8
A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to ac…
-
Unscored —CVE-2022-38131 Scanner template
RStudio Connect prior to 2023.01.0 is affected by an Open Redirect issue. The vulnerability could allow an attacker to …
-
Unscored —
GPAC v2.1-DEV-rev232-gfcaa01ebb-master was discovered to contain a stack overflow when processing ISOM_IOD.
-
Unscored —
Squiz Matrix CMS 6.20 is vulnerable to an Insecure Direct Object Reference caused by failure to correctly validate auth…
-
Critical 10.0
vm2 vulnerable to Sandbox Escape before v3.9.11
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerabil…
-
High 7.8
Rizin Out-of-bounds Write vulnerability in Mach-O binary plugin
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when parsing Mach-O files. A user opening a malicious Mach-O file could be affected by this vulnerability, allowing …
-
High 7.8
Rizin Double Free in bobj.c when using qnx binary plugin
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to a double free in bobj.c:rz_bin_reloc_storage_free() when freeing relocations generated from qnx binary plugin. A user opening a malicious q…
-
High 7.8
Rizin Out-of-bounds Write vulnerability in dyld cache binary plugin
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from dyld cache files. A user opening a malicious dyld cache file could be affected by this vulner…
-
High 7.8
Rizin Out-of-bounds Write vulnerability in Lua binary plugin
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from Luac files. A user opening a malicious Luac file could be affected by this vulnerability, all…
-
High 7.8
Rizin Out-of-bounds Write vulnerability in pyc/marshal.c
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from PYC(python) files. A user opening a malicious PYC file could be affected by this vulnerabilit…
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0389.
-
Unscored —
The Netic User Export add-on before 2.0.6 for Atlassian Jira does not perform authorization checks. This might allow an…
-
Unscored —
A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to…
-
Unscored —CVE-2022-39838 Public exploit
Systematic FIX Adapter (ALFAFX) 2.4.0.25 13/09/2017 allows remote file inclusion via a UNC share pathname, and also all…
-
Medium 6.3
SourceCodester Clinics Patient Management System medicine_details.php sql injection
A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file medicine_details.php. The manipulation of the argument medicine leads to sql inj…
-
Medium 4.3
SourceCodester Online Employee Leave Management System addemployee.php cross-site request forgery
A vulnerability was found in SourceCodester Online Employee Leave Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/addemployee.php. The manipulation leads to cross-site r…
-
Medium 5.5
Cross-site Scripting (XSS) - Stored in jgraph/drawio
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8.
-
Unscored —
Fast Flow < 1.2.13 - Admin+ Stored Cross-Site Scripting
The Fast Flow WordPress plugin before 1.2.13 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (…
-
Unscored —
Multivendor Marketplace Solution for WooCommerce < 3.8.12 - Unauthorised AJAX Calls
The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actions, which could allow any authenticated users, such as subscriber to call them and suspend vendors (reporter by the sub…
-
Unscored —
Visual Portfolio < 2.19.0 - Contributor+ CSS Injection
The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowing users with a role as low as contributor to call them and inject arbitrary CSS in arbitrary saved l…
-
Unscored —
Best Payments Plugin for WP < 4.2.1 - Unauthenticated Stored Cross-Site Scripting
The Simple Payment Donations & Subscriptions WordPress plugin before 4.2.1 does not sanitise and escape user input given in its forms, which could allow unauthenticated attackers to perform Cross-Site Scripting attacks against admins
-
Unscored —
Visual Portfolio < 2.18.0 - Unauthenticated CSS Injection
The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST endpoints, allowing unauthenticated users to call them and inject arbitrary CSS in arbitrary saved layouts
-
Unscored —CVE-2022-2376 Scanner template
Directorist < 7.3.1 - Unauthenticated Email Address Disclosure
The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users
-
Unscored —
WP Database Backup < 5.9 - Admin+ Stored Cross-Site Scripting
The WP Database Backup WordPress plugin before 5.9 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in mult…
-
Unscored —
Simple Single Sign On <= 4.1.0 - Authentication Bypass
The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth client_secret, which could be used by attackers to gain unauthorized access to the site.
-
High 8.8
Deserialization of Untrusted Data in GravityZone Console On-Premise (VA-10573)
Deserialization of Untrusted Data vulnerability in the message processing component of Bitdefender GravityZone Console allows an attacker to pass unsafe commands to the environment. This issue affects: Bitdefender GravityZone Console On-Premise versions prior…