Archive
3 October 2022
Vulnerabilities first published on this day (UTC), newest first.
50 results · Feed
-
Low —
SQLite3 addresses vulnerability in packaged version of libsqlite
### Summary The rubygem sqlite3 v1.5.1 upgrades the packaged version of libsqlite from v3.39.3 to [v3.39.4](https://sqlite.org/releaselog/3_39_4.html). libsqlite v3.39.4 addresses a vulnerability described as follows in the release notification: > Version 3.3…
-
Unscored —
pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component. This …
-
Unscored —
phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.p…
-
Unscored —
Under certain conditions, an attacker could create an unintended sphere of control through a vulnerability present in f…
-
Unscored —
Arbitrary file upload vulnerability in php uploader
-
Medium 5.3
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary serve…
-
Medium 4.3
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary serve…
-
Medium 5.4
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary serve…
-
Critical 9.0
An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is…
-
High 8.0
An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is…
-
High 8.0
An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is…
-
Medium 5.3
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary serve…
-
Medium 6.5
An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access ca…
-
Medium 5.3
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary serve…
-
Critical 9.0
An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access ca…
-
Unscored —
A malicious crafted file consumed through Moldflow Synergy, Moldflow Adviser, Moldflow Communicator, and Advanced Mater…
-
High 7.8
A malicious crafted Dwg2Spd file when processed through Autodesk DWG application could lead to memory corruption vulner…
-
Unscored —
A maliciously crafted PDF file when parsed through Autodesk AutoCAD 2023 causes an unhandled exception. An attacker can…
-
Unscored —
A maliciously crafted X_B, CATIA, and PDF file when parsed through Autodesk AutoCAD 2023 and 2022 can be used to write …
-
Unscored —
Parsing a maliciously crafted X_B file can force Autodesk AutoCAD 2023 and 2022 to read beyond allocated boundaries. Th…
-
Unscored —
A maliciously crafted GIF or JPEG files when parsed through Autodesk Design Review 2018, and AutoCAD 2023 and 2022 coul…
-
High 7.8
Snyk CLI affected by Command Injection vulnerability
Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstr…
-
Unscored —
Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadBit function in mp4mux.
-
Unscored —
Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_Atom::TypeFromString function in mp4tag.
-
Unscored —
Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadBits function in mp4mux.
-
Unscored —
Bento4 v1.6.0-639 was discovered to contain a memory leak in the AP4_AvcFrameParser::Feed function in mp4mux.
-
Unscored —
Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_AtomFactory::CreateAtomFromStream function in mp4…
-
Unscored —
Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function i…
-
Unscored —
Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_SttsAtom::Create function in mp42hls.
-
Unscored —
Bento4 v1.6.0-639 was discovered to contain a segmentation violation in the mp4fragment component.
-
Unscored —
nasm v2.16 was discovered to contain a stack overflow in the Ndisasm component
-
Unscored —
Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_Processor::Process function in the mp4encrypt bin…
-
Unscored —
Goolytics - Simple Google Analytics < 1.1.2 - Admin+ Stored Cross-Site Scripting
The Goolytics WordPress plugin before 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
-
Unscored —
Donation Thermometer < 2.1.3 - Admin+ Stored Cross-Site Scripting
The Donation Thermometer WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowe…
-
Unscored —
Frontend File Manager < 21.3 - Subscriber+ Arbitrary File Upload
The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, like PHP, which could allow them to basically be able to upload arbitrary files on the server and ach…
-
Unscored —CVE-2022-3124 Scanner template
Frontend File Manager < 21.3 - Unauthenticated File Renaming
The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arb…
-
Unscored —
Zephyr Project Manager < 3.2.55 - Unauthorised AJAX Calls To Stored XSS
The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation an…
-
Unscored —
WP Socializer < 7.3 - Admin+ Stored Cross-Site Scripting
The WP Socializer WordPress plugin before 7.3 does not sanitise and escape some of its Icons settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (…
-
Unscored —
DSGVO All in one for WP < 4.2 - Admin+ Stored Cross-Site Scripting
The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallow…
-
Unscored —
mojoPortal v2.7 was discovered to contain a path traversal vulnerability via the "f" parameter at /DesignTools/CssEdito…