Archive
October 2022
Vulnerabilities first published in this month (UTC), newest first.
245 results · Clear filters · Feed
-
Critical 9.0
Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via user profile data fields.
The application was found to be vulnerable to an authenticated Stored Cross-Site Scripting (XSS) vulnerability in messaging functionality, leading to privilege escalation or a compromise of a targeted account.
-
Critical 9.8
Server-side request forgery (SSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.
The application was vulnerable to a Server-Side Request Forgery attacks, allowing the backend server to interact with unexpected endpoints, potentially including internal and local services, leading to attacks in other downstream systems.
-
Critical 9.0
Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via file upload and download functionality.
The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the upload and download functionality, which could be leveraged to escalate privileges or compromise any accounts they can coerce into observing the targeted files.
-
Critical 9.8
Session fixation in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.
The application was vulnerable to a session fixation that could be used hijack accounts.
-
Critical 9.0
Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via messaging functionality
The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the user profile data fields, which could be leveraged to escalate privileges within and compromise any account that views their user profile.
-
Critical 9.9
File Upload vulnerability in Forma LMS
There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the SCORM importer feature. The exploitation of this vulnerabilit…
-
Critical 9.9
Unrestricted Upload of File with Dangerous Type in Forma LMS
There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the plugin upload component. The exploitation of this vulnerabili…
-
Critical 9.8
Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lack proper authentication for functions that c…
-
Critical 9.8
The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper au…
-
Critical 9.8CVE-2022-41772 EPSS 25%
Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters u…
-
Critical 9.8CVE-2022-41657 EPSS 21%
Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior allow attacker provided data already serialized…
-
Critical 9.8CVE-2022-38142 EPSS 19%
Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through…
-
Critical 9.8
SOFTNEXT TECHNOLOGIES CORP. Mail SQR Expert - Command Injection
Mail SQR Expert’s specific function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this vulnerability to perform arbitrary system command and disrupt service.
-
Critical 9.8
D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary code as root via HNAP1/control/…
-
Critical 9.8CVE-2022-31692 Public exploit
Spring Security authorization rules can be bypassed via forward or include dispatcher types
Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expe…
-
Critical 9.1
A remote unprivileged attacker can interact with the configuration interface of a Flexi-Compact FLX3-CPUC1 or FLX3-CPUC…
-
Critical 9.8CVE-2022-3254 Scanner template
AWP Classifieds Plugin < 4.3 - Unauthenticated SQLi
The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading…
-
Critical 9.8
Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via …
-
Critical 9.8
thlorenz browserify-shim vulnerable to prototype pollution
Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js.
-
Critical 9.8
-
Critical 9.8
Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execute arbitra…
-
Critical 9.6
Web Stories <= 1.24.0 - Server Side Request Forgery
The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it …
-
Critical 9.1
Communication traffic involving "Ethernet Q Commands" service of Haas Controller version 100.20.000.1110 is transmitted…
-
Critical 9.8
Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Comma…
-
Critical 9.8
Authentication is currently unsupported in Haas Controller version 100.20.000.1110 when using the “Ethernet Q Commands”…
-
Critical 9.2
The HEIDENHAIN Controller TNC 640 NC software Version 340590 07 SP5, is vulnerable to improper authentication in its DN…
-
Critical 9.9
The FILES directive inside a VM template allows execution of uploaded files when the template is instantiated, resulting in a Remote Code Execution (RCE) attack.
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in OpenNebula OpenNebula core on Linux allows Remote Code Inclusion.
-
Critical 10.0
Honeywell Experion PKS and ACE Controllers Unrestricted Upload of File with Dangerous Type
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.
-
Critical 9.1
Honeywell Experion PKS and ACE Controllers Injection
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.
-
Critical 10.0
CEVAS
All versions of CEVAS prior to 1.01.46 do not sufficiently validate user-controllable input and could allow a user to bypass authentication and retrieve data with specially crafted SQL queries.
-
Critical 9.9
DataHub missing JWT signature check
DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadat…
-
Critical 9.1CVE-2022-31678 Scanner template
VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V de…
-
Critical 9.4
Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot
Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however,…
-
Critical 9.8
thlorenz browserify-shim vulnerable to prototype pollution
Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js.
-
Critical 9.8
A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unaut…
-
Critical 9.8
Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unaut…
-
Critical 9.8
Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unaut…
-
Critical 9.8
Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter.
-
Critical 9.8
Nginx NJS v0.7.2 was discovered to contain a heap-use-after-free bug caused by illegal memory copy in the function njs_…
-
Critical 9.8
SEMCMS v 1.2 is vulnerable to SQL Injection via SEMCMS_User.php.