Archive
17 October 2022
Vulnerabilities first published on this day (UTC), newest first.
36 results · Clear filters · Feed
-
High 7.8CVE-2022-3569 Public exploit
Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escala…
-
High 7.5
ZGR TPS200 NG Information Exposure
ZGR TPS200 NG in its 2.00 firmware version and 1.01 hardware version, allows a remote attacker with access to the web application and knowledge of the routes (URIs) used by the application, to access sensitive information about the system.
-
High 7.3CVE-2022-3368 Public exploit
Software Updater of Avira Security for Windows vulnerable to Privilege Escalation
A vulnerability within the Software Updater functionality of Avira Security for Windows allowed an attacker with write access to the filesystem, to escalate his privileges in certain scenarios. The issue was fixed with Avira Security version 1.1.72.30556.
-
High 7.5
HIWIN Robot System Software version 3.3.21.9869 does not properly address the terminated command source. As a result, a…
-
High 7.5
DoS attack using email
An external attacker is able to send a specially crafted email (with many recipients) and trigger a potential DoS of the system
-
High 7.5
WAGO: multiple products - Loss of MAC-Address-Filtering after reboot
WAGO Series PFC100/PFC200, Series Touch Panel 600, Compact Controller CC100 and Edge Controller in multiple versions are prone to a loss of MAC-Address-Filtering after reboot. This may allow an remote attacker to circumvent the reach the network that should b…
-
High 8.4
Memory corruption in automotive multimedia due to use of out-of-range pointer offset while parsing command request pack…
-
High 8.4
Memory corruption in display due to time-of-check time-of-use of metadata reserved size in Snapdragon Auto, Snapdragon …
-
High 7.8
Memory corruption in Qualcomm IPC due to buffer copy without checking the size of input while starting communication wi…
-
High 8.8
Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an improper access …
-
High 7.2
WP Custom Cursors < 3.2 - Admin+ SQLi
The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privileged users such as admin
-
High 7.5
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
-
High 7.2
Unrestricted Upload of File with Dangerous Type in boxbilling/boxbilling
Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1.
-
High 7.5
A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions …
-
High 8.8
Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an input validation…
-
High 7.3
Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an …
-
High 7.2
Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi
The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin
-
High 7.2
Search Logger <= 0.9 - Admin+ SQLi
The Search Logger WordPress plugin through 0.9 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users
-
High 7.3
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, 15.2 to 15.2.4 a…
-
High 7.5
A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions startin…
-
High 7.3
An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.…
-
High 8.0
IPTIME NAS1DUAL CSRF Vulnerability
This vulnerability occurs in user accounts creation and deleteion related pages of IPTIME NAS products. The vulnerability could be exploited by a lack of validation when a POST request is made to this page. An attacker can use this vulnerability to or delete …
-
High 7.5
Secuever reverseWall-MDS Remote Code Execution Vulnerability
Remote code execution vulnerability due to insufficient user privilege verification in reverseWall-MDS. Remote attackers can exploit the vulnerability such as stealing account, through remote code execution.
-
High 8.8
WISA Smart Wing CMS Remote Command Execution Vulnerability
This vulnerability could allow a remote attacker to execute remote commands with improper validation of parameters of certain API constructors. Remote attackers could use this vulnerability to execute malicious commands such as directory traversal.
-
High 8.4
Memory corruption in BTHOST due to double free while music playback and calls over bluetooth headset in Snapdragon Mobi…
-
High 8.4
Memory corruption in multimedia due to use after free during callback registration failure in Snapdragon Mobile
-
High 7.8
Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and then using the …
-
High 7.2
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinvento…
-
High 8.8
Netgear R6220 v1.1.0.114_1.0.1 suffers from Incorrect Access Control, resulting in a command injection vulnerability.
-
High 8.8
Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users wit…
-
High 7.2
Open Source SACCO Management System v1.0 is vulnerable to SQL Injection via /sacco_shield/manage_payment.php.
-
High 8.8
anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens.
-
High 7.5
Phoenix before 1.6.14 mishandles check_origin wildcarding
socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.
-
High 7.2
Online Tours & Travels Management System v1.0 is vulnerable to Arbitrary code execution via ip/tour/admin/operations/up…
-
High 8.8
A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header. Th…
-
High 7.5
A flaw was found in the RHDM, where sensitive HTML form fields like Password has auto-complete enabled which may lead t…