Archive
11 October 2022
Vulnerabilities first published on this day (UTC), newest first.
269 results · Feed
-
Medium 4.3
CCURE Observable Response Discrepancy
Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions.
-
Medium 5.4
WordPress Shortcodes Ultimate plugin <= 5.12.0 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Shortcodes Ultimate plugin <= 5.12.0 at WordPress leading to plugin preset settings change.
-
Medium 4.2
WordPress Profile Builder plugin <= 3.6.0 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder plugin <= 3.6.0 at WordPress allows uploading the JSON file and updating the options. Requires Import and Export add-on.
-
High 7.5
Redirection for Contact Form 7 <= 2.4.0 - Unauthenticated Options Change and Content Injection vulnerability
Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at WordPress allows attackers to change options and inject scripts into the footer HTML. Requires an additional extension (plugin) Ac…
-
Medium 4.8
WordPress Asset CleanUp: Page Speed Booster plugin <= 1.3.8.4 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability
Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Gabe Livan's Asset CleanUp: Page Speed Booster plugin <= 1.3.8.4 at WordPress.
-
Medium 6.1
WordPress FontMeister plugin <= 1.08 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting (XSS) vulnerability FontMeister plugin <= 1.08 at WordPress.
-
Medium 6.7
Cloud Mobility for Dell Storage versions 1.3.0 and earlier contains an Improper Access Control vulnerability within the…
-
High 7.3
Dell Hybrid Client below 1.8 version contains a gedit vulnerability. A guest attacker could potentially exploit this vu…
-
Medium 6.5
Dell Hybrid Client below 1.8 version contains a guest user profile corruption vulnerability. A WMS privilege attacker c…
-
High 7.1
Dell Hybrid Client below 1.8 version contains a Zip Bomb Vulnerability in UI. A guest privilege attacker could potentia…
-
High 8.8
Dell Container Storage Modules 1.2 contains an OS Command Injection in goiscsi and gobrick libraries. A remote unauthen…
-
High 8.8
Dell Container Storage Modules 1.2 contains an Improper Limitation of a Pathname to a Restricted Directory in goiscsi a…
-
High 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exp…
-
High 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exp…
-
Medium 4.0
IBM Navigator Mobile Android 3.4.1.1 and 3.4.1.2 app could allow a local user to obtain sensitive information due to im…
-
High 7.5CVE-2022-3358 Public exploit
Using a Custom Cipher with NID_undef may lead to NULL encryption
OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to imp…
-
Critical 9.0CVE-2022-32174 EPSS 58%
Gogs - XSS
In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.
-
Medium 5.4
AdGuardHome - CSRF
In AdGuardHome, versions v0.95 through v0.108.0-b.13 are vulnerable to Cross-Site Request Forgery (CSRF), in the custom filtering rules functionality. An attacker can persuade an authorized user to follow a malicious link, resulting in deleting/modifying the …
-
Unscored —
The Xiaomi Security Center expresses heartfelt thanks to ADLab of VenusTech ! At the same time, we also welcome more ou…
-
Unscored —
A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, whic…
-
High 7.5CVE-2022-34689 EPSS 38%
Windows CryptoAPI Spoofing Vulnerability
Windows CryptoAPI Spoofing Vulnerability
-
High 8.1
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
-
High 7.8
Windows GDI+ Remote Code Execution Vulnerability
Windows GDI+ Remote Code Execution Vulnerability
-
Unscored —
Arm: unbounded memory consumption for 2nd-level page tables Certain actions require e.g. removing pages from a guest's …
-
High 7.5
Windows TCP/IP Driver Denial of Service Vulnerability
Windows TCP/IP Driver Denial of Service Vulnerability
-
Unscored —
P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of s…
-
Unscored —
XAPI open file limit DoS It is possible for an unauthenticated client on the network to cause XAPI to hit its file-desc…
-
Unscored —
lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an err…
-
Unscored —
SAP SQL Anywhere - version 17.0, and SAP IQ - version 16.1, allows an attacker to leverage logical errors in memory man…
-
Unscored —
A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8…
-
Unscored —
The application SAP Enable Now does not sufficiently encode user-controlled inputs over the network before it is placed…
-
Unscored —
SAP Data Services Management allows an attacker to copy the data from a request and echoed into the application's immed…
-
Medium 6.5
Windows NTLM Spoofing Vulnerability
Windows NTLM Spoofing Vulnerability
-
Unscored —
Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System…
-
Medium 6.2CVE-2022-35829 EPSS 18%
Service Fabric Explorer Spoofing Vulnerability
Service Fabric Explorer Spoofing Vulnerability
-
Unscored —
Due to lack of proper memory management, when a victim opens a manipulated Computer Graphics Metafile (.cgm, CgmTransla…
-
High 8.6
Path traversal in MelisAssetManager
MelisAssetManager provides deliveries of Melis Platform's assets located in every module's public folder. Attackers can read arbitrary files on affected versions of `melisplatform/melis-asset-manager`, leading to the disclosure of sensitive information. Condu…
-
Unscored —
Due to lack of proper memory management, when a victim opens a manipulated SolidWorks Part (.sldprt, CoreCadTranslator.…
-
High 7.5
Traefik HTTP/2 connections management could cause a denial of service
Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. There is a potential vulnerability in Traefik managing HTTP/2 connections. A closing HTTP/2 server connection could hang forever because of …
-
Unscored —
Due to lack of proper memory management, when a victim opens a manipulated ACIS Part and Assembly (.sat, CoreCadTransla…