Archive
October 2022
Vulnerabilities first published in this month (UTC), newest first.
1,865 results · Feed
-
Medium 6.7
Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command
It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint' subcommand. Using this command with an unreachable endpoint caused the WARP Client to disconnect and allowed bypassing administrative restr…
-
Medium 6.7
Lock WARP switch bypass on WARP mobile client using iOS quick action
Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by WARP iOS client, this feature could be bypassed by using the "Disable WARP" qui…
-
Medium 6.7
Lock WARP switch bypass by removing VPN profile on iOS mobile client
It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch feature being enabled on…
-
Medium 6.7
Lock WARP switch feature bypass on WARP mobile client for iOS
It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch on the WARP iOS mobile client by enabling both "Disable for cellular networks" and "Disable f…
-
Medium 6.7
Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command
Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint.
-
Medium 5.4
OctoRPKI crash when maximum iterations number is reached
Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika M…
-
Critical 10.0
Honeywell Experion PKS and ACE Controllers Unrestricted Upload of File with Dangerous Type
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.
-
Critical 9.1
Honeywell Experion PKS and ACE Controllers Injection
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.
-
High 7.5
Honeywell Experion PKS and ACE Controllers Relative Path Traversal
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to relative path traversal, which may allow an attacker access to unauthorized files and directories.
-
Critical 10.0
CEVAS
All versions of CEVAS prior to 1.01.46 do not sufficiently validate user-controllable input and could allow a user to bypass authentication and retrieve data with specially crafted SQL queries.
-
High 8.1
Unrestricted file upload in Eaton Foreseer EPMS
A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduction of energy consumption and avoid unplanned downtime caused by the failures of critical systems. …
-
High 8.6
Vulnerability in handling of uploaded QTI ZIP files
QTIWorks is a software suite for standards-based assessment delivery. Prior to version 1.0-beta15, the QTIWorks Engine allows users to upload QTI content packages as ZIP files. The ZIP handling code does not sufficiently check the paths of files contained wit…
-
Critical 9.9
DataHub missing JWT signature check
DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadat…
-
Critical 9.1CVE-2022-31678 Scanner template
VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V de…
-
Medium 6.3
Redis on Windows dbghelp.dll uncontrolled search path
A vulnerability was found in a port or fork of Redis. It has been declared as critical. This vulnerability affects unknown code in the library C:/Program Files/Redis/dbghelp.dll. The manipulation leads to uncontrolled search path. The attack can be initiated …
-
Critical 9.4
Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot
Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however,…
-
Medium 6.3
seccome Ehoney set sql injection
A vulnerability was found in seccome Ehoney and classified as critical. Affected by this issue is some unknown functionality of the file /api/v1/bait/set. The manipulation of the argument Payload leads to sql injection. The attack may be launched remotely. VD…
-
Medium 6.3
seccome Ehoney signup access control
A vulnerability was found in seccome Ehoney. It has been rated as critical. This issue affects some unknown processing of the file /api/public/signup. The manipulation leads to improper access controls. The identifier VDB-212417 was assigned to this vulnerabi…
-
Medium 6.3
seccome Ehoney falco sql injection
A vulnerability, which was classified as critical, was found in seccome Ehoney. Affected is an unknown function of the file /api/v1/attack/falco. The manipulation of the argument Payload leads to sql injection. It is possible to launch the attack remotely. Th…
-
Medium 6.3
seccome Ehoney attack sql injection
A vulnerability, which was classified as critical, has been found in seccome Ehoney. This issue affects some unknown processing of the file /api/v1/attack. The manipulation of the argument AttackIP leads to sql injection. The attack may be initiated remotely.…
-
Medium 5.0
SourceCodester Web-Based Student Clearance System edit-admin.php sql injection
A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. This affects an unknown part of the file Admin/edit-admin.php. The manipulation of the argument id leads to sql injection. It is possible to in…
-
High 7.5
Ansible leaks password to logs
A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading …
-
Medium 6.8
An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 9.3 before 15.2.5, all ver…
-
Medium 6.3
seccome Ehoney token sql injection
A vulnerability has been found in seccome Ehoney and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/v1/attack/token. The manipulation of the argument Payload leads to sql injection. The attack can be launch…
-
Medium 5.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.2.5, all versions star…
-
Low 2.7
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting f…
-
Critical 9.8
thlorenz browserify-shim vulnerable to prototype pollution
Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js.
-
Critical 9.8
A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unaut…
-
Critical 9.8
Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unaut…
-
Critical 9.8
Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unaut…
-
Medium 6.5CVE-2022-26884 Public exploit
Apache DolphinScheduler exposes files without authentication
Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.
-
High 7.2
Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the productId parameter at /…
-
High 7.2
Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter…
-
Medium 5.4CVE-2022-43166 Scanner template
A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) …
-
High 7.1
wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr->GetReturnCallDr…
-
High 7.2
Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter…
-
Medium 5.4CVE-2022-43167 Scanner template
A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_ale…
-
Medium 5.4CVE-2022-43164 Scanner template
A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of…
-
High 7.2
Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/manage_…
-
Unscored —
Nginx NJS v0.7.2 to v0.7.4 was discovered to contain a segmentation violation via njs_scope_valid_value at njs_scope.h.…