Archive
12 October 2022
Vulnerabilities first published on this day (UTC), newest first.
71 results · Feed
-
Unscored —
This module enables themers to get partial data from field render arrays. It gives them more control over the output wi…
-
High 7.5
Dell Client BIOS Versions prior to the remediated version contain an improper input validation vulnerability. A local a…
-
High 7.5
Dell BIOS contains a use of uninitialized variable vulnerability. A local authenticated malicious user may potentially …
-
High 7.1
Dell GeoDrive, Versions 1.0 - 2.2, contain a Path Traversal Vulnerability in the reporting function. A local, low privi…
-
High 7.0
Dell GeoDrive, versions prior to 2.2, contains Insecure File and Folder Permissions vulnerabilities. A low privilege at…
-
High 7.0
Dell GeoDrive, versions prior to 2.2, contains Multiple DLL Hijacking Vulnerabilities. A low privilege attacker could p…
-
High 7.8
Dell GeoDrive, versions prior to 2.2, contains an Unquoted File Path vulnerability. A low privilege attacker could pote…
-
High 7.8
Dell GeoDrive, versions 2.1 - 2.2, contains an information disclosure vulnerability in GUI. An authenticated non-admin …
-
Medium 5.5
Dell GeoDrive, Versions 2.1 - 2.2, contains an information disclosure vulnerability. An authenticated non-admin user co…
-
Medium 6.0
Dell BIOS contains an Stack-Based Buffer Overflow vulnerability. A local authenticated malicious user may potentially e…
-
Medium 4.1
Dell Client BIOS contains a Buffer Overflow vulnerability. A local authenticated malicious user may potentially exploit…
-
High 8.2
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exp…
-
High 8.2
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exp…
-
High 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exp…
-
High 7.5
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exp…
-
Medium 5.6
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileg…
-
Medium 5.6
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileg…
-
High 8.1
Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. A remote unauthenticated attacker ca…
-
High 8.1
PAN-OS: Authentication Bypass in Web Interface
An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific knowledge of the target firewall or Panorama appliance to impersonate an existing PAN-OS administrator and perform privileg…
-
Medium —
The graphql-upload library included in Apollo Server 2 is vulnerable to CSRF mutations
### Impact The [graphql-upload](https://www.npmjs.com/package/graphql-upload) npm package can execute GraphQL operations contained in `content-type: multipart/form-data` POST requests. Because they are POST requests, they can contain GraphQL mutations. Becaus…
-
Critical 9.8
dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data (issue 1 of 2).
-
Critical 9.8
dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data (issue 2 of 2).
-
Critical 9.8
WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute forc…
-
High 7.7
Deserialization of untrusted data in MelisCms
MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. Attackers can deserialize arbitrary data on affected versions of `melisplatform/melis-cms`, and ultimately leads to the ex…
-
High 7.7
Deserialization of untrusted data in MelisFront
MelisFront is the engine that displays website hosted on Melis Platform. It deals with showing pages, plugins, URL rewritting, search optimization and SEO, etc. Attackers can deserialize arbitrary data on affected versions of `melisplatform/melis-front`, and …
-
High 7.4CVE-2022-39299 Public exploit
Signature bypass via multiple root elements in Passport-SAML
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession…
-
Low 3.5
RDP client: Read of uninitialized memory with parallel port redirection
FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server imple…
-
Medium 5.9
FreeRDP may read and display out of bounds data
FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized data, decode it as audio/video and display the result. FreeRDP based server implementations are not a…
-
Medium 4.3
Multiple Denial of Service Vulnerability
Multiple Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aerdl.dll unpacker handler function crashes. This can lead to a possible scanning engine crash.
-
Medium 6.3
SourceCodester Human Resource Management System Image File employeeview.php unrestricted upload
A vulnerability has been found in SourceCodester Human Resource Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /employeeview.php of the component Image File Handler. The manipulation le…
-
Medium 6.3
SourceCodester Human Resource Management System getstatecity.php sql injection
A vulnerability classified as critical has been found in SourceCodester Human Resource Management System. This affects an unknown part of the file getstatecity.php. The manipulation of the argument ci leads to sql injection. It is possible to initiate the att…
-
Medium 6.3
SourceCodester Human Resource Management System city.php sql injection
A vulnerability was found in SourceCodester Human Resource Management System. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file city.php. The manipulation of the argument searccity leads to sql injection.…
-
Medium 4.3CVE-2022-3464 Public exploit
puppyCMS settings.php cross site scripting
A vulnerability classified as problematic has been found in puppyCMS up to 5.1. This affects an unknown part of the file /admin/settings.php. The manipulation of the argument site_name leads to cross site scripting. It is possible to initiate the attack remot…
-
Medium 4.3
Memory handling vulnerability in ProtocolBuffers Java core and lite
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields …
-
Medium 5.5
Jiusi OA hntdCustomDesktopActionContent sql injection
A vulnerability classified as critical was found in Jiusi OA. Affected by this vulnerability is an unknown functionality of the file /jsoa/hntdCustomDesktopActionContent. The manipulation of the argument inforid leads to sql injection. The exploit has been di…
-
High 7.3
Mediabridge Medialink index.asp improper authentication
A vulnerability classified as critical was found in Mediabridge Medialink. This vulnerability affects unknown code of the file /index.asp. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed …
-
Medium 6.3
SourceCodester Human Resource Management System city.php sql injection
A vulnerability was found in SourceCodester Human Resource Management System. It has been rated as critical. Affected by this issue is some unknown functionality of the file city.php. The manipulation of the argument cityedit leads to sql injection. The attac…
-
Medium 6.3
SourceCodester Human Resource Management System getstatecity.php sql injection
A vulnerability was found in SourceCodester Human Resource Management System. It has been classified as critical. Affected is an unknown function of the file getstatecity.php. The manipulation of the argument sc leads to sql injection. It is possible to launc…
-
Medium 5.3
In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, s…
-
High 7.7
Avaya Aura Communication Manager Privilege Escalation Vulnerabilities
Privilege escalation related vulnerabilities were discovered in Avaya Aura Communication Manager that may allow local administrative users to escalate their privileges. This issue affects Communication Manager versions 8.0.0.0 through 8.1.3.3 and 10.1.0.0.