Archive
October 2022
Vulnerabilities first published in this month (UTC), newest first.
1,865 results · Feed
-
High 7.3
Axiomatic Bento4 mp42aac Ap4ByteStream.cpp WritePartial heap-based overflow
A vulnerability, which was classified as critical, was found in Axiomatic Bento4. This affects the function AP4_MemoryByteStream::WritePartial of the file Ap4ByteStream.cpp of the component mp42aac. The manipulation leads to heap-based buffer overflow. It is …
-
Medium 5.0
vim autocmd quickfix.c qf_update_buffer use after free
A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component autocmd Handler. The manipulation leads to use after free. The attack may be launched remotely. Upg…
-
Low 3.5
SourceCodester Sanitization Management System SystemSettings.php cross site scripting
A vulnerability, which was classified as problematic, has been found in SourceCodester Sanitization Management System 1.0. This issue affects some unknown processing of the file /php-sms/classes/SystemSettings.php. The manipulation of the argument name/shortn…
-
Medium 5.3
Axiomatic Bento4 mp4edit CreateAtomFromStream memory leak
A vulnerability has been found in Axiomatic Bento4 and classified as problematic. This vulnerability affects the function AP4_AtomFactory::CreateAtomFromStream of the component mp4edit. The manipulation leads to memory leak. The attack can be initiated remote…
-
Low 3.5
SourceCodester Sanitization Management System Master.php cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester Sanitization Management System 1.0. Affected is an unknown function of the file /php-sms/classes/Master.php. The manipulation of the argument message leads to cross site scripti…
-
Critical 9.1
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper vali…
-
Critical 9.8
Apache Flume prior to 1.11.0 has an Improper Input Validation (JNDI Injection) in JMSSource
Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
-
Critical 9.8
D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the srcip parameter at /goform/form2IPQoSTcAd…
-
High 7.5
D-Link DIR-816 A2 1.10 B05 was discovered to contain multiple command injection vulnerabilities via the admuser and adm…
-
High 8.8CVE-2022-37202 Public exploit
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list
-
Medium 6.7
drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client …
-
Critical 9.8CVE-2022-43775 EPSS 22%
The HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to g…
-
Critical 9.8
D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setRepeaterSecu…
-
Critical 9.8
D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep54_pskpwd parameter at /goform/…
-
High 7.5
baramundi Management Agent (bMA) in baramundi Management Suite (bMS) 2021 R1 and R2 and 2022 R1 allows remote code exec…
-
Critical 9.8
The HandlerPageP_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attack…
-
Critical 9.8
D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep4_pskpwd parameter at /goform/f…
-
Medium 6.5
The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Fo…
-
High 7.5
Apache IoTDB prior to 0.13.3 allows DoS
Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. Users should upgrade to 0.13.3 which addresses this issue or use a later version of Java to …
-
Critical 9.8
D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setSecurity fun…
-
Medium —
matrix-sdk 0.6.0 logs access tokens
When sending Matrix requests using an affected version of `matrix-sdk` in an application that writes logs using `tracing-subscriber` (in a way that includes fields of tracing spans such as `tracing_subscriber`s default text output from the `fmt` module), thes…
-
Unscored —CVE-2022-27913 Public exploit
[20221002] - Core - RXSS through reflection of user input in headings
An issue was discovered in Joomla! 4.2.0 through 4.2.3. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in various components.
-
Unscored —
[20221001] - Core - Debug Mode leaks full request payloads including passwords
An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests.
-
High 7.8
Adobe Illustrator PCX File Parsing Memory Corruption Remote Code Execution Vulnerability
Adobe Illustrator versions 26.4 (and earlier) and 25.4.7 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user intera…
-
High 7.8
Adobe Illustrator CDR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Adobe Illustrator versions 26.4 (and earlier) and 25.4.7 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this…
-
High 8.2
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode …
-
High 8.2
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode …
-
High 8.2
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode …
-
High 8.2
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode …
-
High 7.1
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In…
-
High 7.1
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In…
-
High 7.1
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In…
-
High 7.1
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In…
-
High 8.2
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All…
-
High 8.2
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All…
-
High 8.2
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All…
-
High 8.2
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All…
-
Medium 4.9
A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. …
-
Medium 4.9
A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. …
-
Medium 4.9
A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. …