Archive
7 November 2022
Vulnerabilities first published on this day (UTC), newest first.
16 results · Clear filters · Feed
-
Critical 9.8CVE-2022-3481 Scanner template
WooCommerce Dropshipping < 4.4 - Unauthenticated SQLi
The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection
-
Critical 9.8
FluentForm < 4.3.13 - CSV Injection
The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection
-
Critical 9.8
The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.…
-
Critical 9.8
The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party…
-
Critical 9.8
The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third part…
-
Critical 9.8
An issue was discovered in Object First Ootbi BETA build 1.0.7.712. The authorization service has a flow that allows ge…
-
Critical 9.8
btcd mishandles witness size checking
btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking.
-
Critical 9.8
The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third part…
-
Critical 9.8
The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third par…
-
Critical 9.8
The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third…
-
Critical 9.8
The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third…
-
Critical 9.8
Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing
Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pa…
-
Critical 9.1
Apache Ivy allows creating/overwriting any file on the system
With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the targ…
-
Critical 9.8
The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third part…
-
Critical 9.8
The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third par…
-
Critical 9.8
The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third pa…