Archive
2 November 2022
Vulnerabilities first published on this day (UTC), newest first.
22 results · Clear filters · Feed
-
High 7.5
An Improper Input Validation vulnerability exists in Trihedral VTScada version 12.0.38 and prior. A specifically malfor…
-
High —
ckb type_id script resume may randomly fail
### Impact https://github.com/nervosnetwork/ckb/blob/v0.101.2/script/src/verify.rs#L871-L879 TypeIdSystemScript resume handle is not correct when max_cycles is not enough, `ScriptError::ExceededMaximumCycles` will be raised directly ranther than suspend as ex…
-
High 8.3
Gecko Standalone Bootloader vulnerability may allow bypassing application secure boot in some Series 2 devices
Out-of-Bounds error in GBL parser in Silicon Labs Gecko Bootloader version 4.0.1 and earlier allows attacker to overwrite flash Sign key and OTA decryption key via malicious bootloader upgrade.
-
High 7.1
Pentaho Business Analytics Server - Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user supplied path to access resources that are out of bounds.
Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user-supplied path to access resources that are out of bounds. The software uses external input t…
-
High 7.7
Pentaho Business Analytics Server - With the Data Lineage feature enabled, the system transmits database passwords in clear text
Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and 8.3.0.25 with the Data Lineage feature enabled transmits database passwords in clear text. The transmission of sensitive data in clear text allows unauthorized actors wit…
-
High 7.8
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpr…
-
High 8.0
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiADC management interface …
-
High 7.6
Possible Server-Side Request Forgery (SSRF) in webhooks
Discourse is a platform for community discussion. A malicious admin could use this vulnerability to perform port enumeration on the local host or other hosts on the internal network, as well as against hosts on the Internet. Latest `stable`, `beta`, and `test…
-
High 8.0
An improper neutralization of input during web page generation vulnerability [CWE-79] exists in FortiManager and FortiA…
-
High 8.9
Discourse user account takeover via email and invite link
Discourse is a platform for community discussion. Users who receive an invitation link that is not scoped to a single email address can enter any non-admin user's email and gain access to their account when accepting the invitation. All users should upgrade t…
-
High 7.5
Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp
Muhammara is a node module with c/cpp bindings to modify PDF with js for node or electron (based/replacement on/of galkhana/hummusjs). The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied w…
-
High 8.8CVE-2022-38374 Public exploit
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiADC 7.0.0 - 7.0…
-
High 8.0
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiDeceptor management inter…
-
High 7.3
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.…
-
High 7.2
Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/e…
-
High 7.8
A improper authentication vulnerability in Fortinet FortiSIEM before 6.5.0 allows a local attacker with CLI access to p…
-
High 7.1
Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bou…
-
High 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id paramet…
-
High 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id paramet…
-
High 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id paramet…
-
High 8.8
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id paramet…
-
High 8.1
stb_image.h 2.27 has a heap-based buffer over in stbi__jpeg_load, leading to Information Disclosure or Denial of Servic…