Archive
10 October 2022
Vulnerabilities first published on this day (UTC), newest first.
51 results · Feed
-
Low —
Incorrect default cookie name and recommendation
### Impact _What kind of vulnerability is it? Who is impacted?_ The default cookie name (and documentation recommendation) was prefixed with `Host__` instead of `__Host-`. The point of this prefix is for additional security, to ensure that, when no domain opt…
-
High 7.5
Dell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH. An unauthenticated remote att…
-
Medium 6.8
Dell Wyse ThinOS 2205 contains a Regular Expression Denial of Service Vulnerability in UI. An admin privilege attacker …
-
Medium 6.3
IBM Sterling Partner Engagement Manager 2.0 does not invalidate session after logout which could allow an authenticated…
-
Medium 4.6
Cisco IOS XE ROM Monitor Software for Catalyst Switches Information Disclosure Vulnerability
A vulnerability in the password-recovery disable feature of Cisco IOS XE ROM Monitor (ROMMON) Software for Cisco Catalyst Switches could allow an unauthenticated, local attacker to recover the configuration or reset the enable password. This vulnerability is …
-
High 8.6
Cisco IOS XE Software DNS NAT Protocol Application Layer Gateway Denial of Service Vulnerability
A vulnerability in the DNS application layer gateway (ALG) functionality that is used by Network Address Translation (NAT) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability is du…
-
High 7.7
Cisco IOS and IOS XE Software SSH Denial of Service Vulnerability
A vulnerability in the SSH implementation of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. This vulnerability is due to improper handling of resources during an exceptional si…
-
High 7.4
Cisco IOS XE Software IPv6 VPN over MPLS Denial of Service Vulnerability
A vulnerability in the implementation of IPv6 VPN over MPLS (6VPE) with Zone-Based Firewall (ZBFW) of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerabilit…
-
Medium 6.1
Cisco IOS XE Software for Catalyst 9200 Series Switches Arbitrary Code Execution Vulnerability
A vulnerability in the software image verification functionality of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches could allow an unauthenticated, physical attacker to execute unsigned code at system boot time. This vulnerability is due to an i…
-
High 8.6
Cisco IOS XE Software for Catalyst Switches MPLS Denial of Service Vulnerability
A vulnerability in the egress MPLS packet processing function of Cisco IOS XE Software for Cisco Catalyst 3650, Catalyst 3850, and Catalyst 9000 Family Switches could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly…
-
Medium 5.3
Cisco Software-Defined Application Visibility and Control on Cisco vManage Authentication Bypass Vulnerability
A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of Cisco SD-AVC without authentication. This vulnerability exi…
-
Medium 6.8
An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] …
-
Critical 9.8
An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] …
-
Critical 9.8
An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] …
-
Medium 6.7
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface…
-
High 8.1
An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiTester Telnet port 2.3.0 t…
-
High 7.5CVE-2022-39288 EPSS 59%
Denial of service in Fastify via Content-Type header
fastify is a fast and low overhead web framework, for Node.js. Affected versions of fastify are subject to a denial of service via malicious use of the Content-Type header. An attacker can send an invalid Content-Type header that can cause the application to …
-
High 7.5
Exposure of sensitive Slack webhook URLs in debug logs and traces
Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit. Debug logs expose sensitive URLs for Slack webhooks that contain private information. The problem is fixed in version 1.3.2 which redacts sensitive URLs for webhooks…
-
High 7.5
A access of uninitialized pointer in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.8, 6.2.0 th…
-
High 7.6
USBX Host CDC ECM integer underflow with buffer overflow
Azure RTOS USBx is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX and available for all Azure RTOS ThreadX–supported processors. Azure RTOS USBX implementation of host support for USB CDC ECM includes an integ…
-
Unscored —
Soledad < 8.2.5 - Reflected Cross-site Scripting
The soledad WordPress theme before 8.2.5 does not sanitise the {id,datafilter[type],...} parameters in its penci_more_slist_post_ajax AJAX action, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
-
Low 3.5
Crealogix EBICS ebics.aspx cross site scripting
A vulnerability was found in Crealogix EBICS 7.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /ebics-server/ebics.aspx. The manipulation leads to cross site scripting. The attack may be launched remotely.…
-
Unscored —
Simple File List < 4.4.12 - Admin+ Stored Cross-Site Scripting
The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (…
-
Unscored —
TaskBuilder < 1.0.8 - Subscriber+ Stored XSS via SVG file upload
The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (such as subscriber) creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file
-
Unscored —
Hash flooding vulnerability in aeson
The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service.
-
Medium 5.7
Open Redirect in ikus060/rdiffweb
Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.
-
Unscored —
Social Rocket < 1.3.3 - Admin+ Stored Cross-Site Scripting
The Social Rocket WordPress plugin before 1.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for …
-
Unscored —
Simple File List < 4.4.13 - Page Creation via CSRF
The Simple File List WordPress plugin before 4.4.12 does not implement nonce checks, which could allow attackers to make a logged in admin create new page and change it's content via a CSRF attack.
-
Unscored —
Multiple Plugins from Viszt Peter - Multiple CSRF
The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which cou…
-
Unscored —
Advanced Comment Form < 1.2.1 - Admin+ Authenticated Stored XSS
The Advanced Comment Form WordPress plugin before 1.2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
-
Unscored —
reSmush.it Image Optimizer < 0.4.6 - Admin+ Cross-Site Scripting
The reSmush.it WordPress plugin before 0.4.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when unfiltered_html is disallowed.
-
Unscored —
Slider, Gallery, and Carousel by MetaSlider < 3.27.9 - Admin+ Stored Cross Site Scripting
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.27.9 does not sanitise and escape some of its Gallery Image parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the…
-
Unscored —
Enable Media Replace < 4.0.0 - Admin+ Path Traversal
The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege users such as admin to move them outside to the web root directory via a path traversal attack for examp…
-
Unscored —
Top Bar < 3.0.4 - Admin+ Stored Cross-Site Scripting
The Top Bar WordPress plugin before 3.0.4 does not sanitise and escape some of its settings before outputting them in frontend pages, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_…
-
Unscored —
Disable User Login <= 1.0.1 - Unauthenticated Settings Update
The Disable User Login WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating its settings, allowing unauthenticated attackers to block (or unblock) users at will.
-
Unscored —
WP 2FA < 2.3.0 - Time-Based Side-Channel Attack
The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared.
-
Unscored —
Download Monitor < 4.5.98 - Admin+ Arbitrary File Download
The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened enviro…
-
Unscored —
An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field.
-
Unscored —
An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Product Affected" field.
-
Unscored —
A registry permissions vulnerability in the Trend Micro Apex One Data Loss Prevention (DLP) module could allow a local …