Archive
9 November 2022
Vulnerabilities first published on this day (UTC), newest first.
61 results · Clear filters · Feed
-
Medium 5.4
WordPress Simple Video Embedder plugin <= 2.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in James Lao's Simple Video Embedder plugin <= 2.2 on WordPress.
-
Medium 4.3
A leftover debug code vulnerability exists in the console infct functionality of InHand Networks InRouter302 V3.5.45. A…
-
Medium 6.5
A leftover debug code vulnerability exists in the httpd port 4444 upload.cgi functionality of InHand Networks InRouter3…
-
Medium 4.9
A leftover debug code vulnerability exists in the console nvram functionality of InHand Networks InRouter302 V3.5.45. A…
-
Medium 6.5
A leftover debug code vulnerability exists in the console support functionality of InHand Networks InRouter302 V3.5.45.…
-
Medium 6.5
A leftover debug code vulnerability exists in the console verify functionality of InHand Networks InRouter302 V3.5.45. …
-
Medium 6.7
Cortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR Engine
A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system allows a local attacker with shell access to the engine to execute programs with elevated privileges.
-
Medium 6.5
Hardcoded credentials in Kaden PICOFLUX AiR
In the Kaden PICOFLUX AiR water meter an adversary can read the values through wireless M-Bus mode 5 with a hardcoded shared key while being adjacent to the device.
-
Medium 5.4
WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to rule type migration.
-
Medium 4.0
Improper authorization vulnerability in StorageManagerService prior to SMR Nov-2022 Release 1 allows local attacker to …
-
Medium 6.2
Improper Authorization in Samsung Billing prior to version 5.0.56.0 allows attacker to get sensitive information.
-
Medium 6.7
Grafana subject to Exposure of Sensitive Information resulting in User enumeration via forget password
Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JSON response contains…
-
Medium 4.3
Improper access control vulnerability in clearAllGlobalProxy in MiscPolicy prior to SMR Nov-2022 Release 1 allows local…
-
Medium 6.4
Grafana contains Improper Input Validation
Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins…
-
Medium 5.3
Improper input validation vulnerability for processing SIB12 PDU in Exynos modems prior to SMR Sep-2022 Release allows …
-
Medium 5.9
Improper access control vulnerability in BootCompletedReceiver_CMCC in DeviceManagement prior to SMR Nov-2022 Release 1…
-
Medium 4.0
Improper access control vulnerability in GalaxyWatch4Plugin prior to versions 2.2.11.22101351 and 2.2.12.22101351 allow…
-
Medium 5.9
Improper access control vulnerability in IpcRxServiceModeBigDataInfo in RIL prior to SMR Nov-2022 Release 1 allows loca…
-
Medium 4.3
Improper access control vulnerability in IImsService prior to SMR Nov-2022 Release 1 allows local attacker to access to…
-
Medium 4.3
Heap overflow vulnerability in parse_pce function in libsavsaudio.so in Editor Lite prior to version 4.0.41.3 allows at…
-
Medium 5.9
Improper authorization vulnerability in?CallBGProvider prior to SMR Nov-2022 Release 1 allows local attacker to grant p…
-
Medium 6.5
Windows Hyper-V Denial of Service Vulnerability
Windows Hyper-V Denial of Service Vulnerability
-
Medium 6.1
VMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting (XSS) vulnerability. Due to improp…
-
Medium 4.8
Lack of sand-boxing of OpenAPI documents in GitLab CE/EE affecting all versions from 12.6 prior to 15.3.5, 15.4 prior t…
-
Medium 4.3
Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 106.0.5249.119 allowed a remote attack…
-
Medium 4.7
An open redirect vulnerability in GitLab EE/CE affecting all versions from 9.3 prior to 15.3.5, 15.4 prior to 15.4.4, a…
-
Medium 5.3
An uncontrolled resource consumption issue when parsing URLs in GitLab CE/EE affecting all versions prior to 15.3.5, 15…
-
Medium 4.3
An improper authorization issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4,…
-
Medium 5.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 15.3.5, all versions star…
-
Medium 5.3
Bypass of healthcheck endpoint allow list affecting all versions from 12.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 1…
-
Medium 4.3
Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 1…
-
Medium 4.3
An information disclosure issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4,…
-
Medium 5.3
The launcher module has an Intent redirection vulnerability. Successful exploitation of this vulnerability may cause la…
-
Medium 4.3
There is a vulnerability in permission verification during the Bluetooth pairing process. Successful exploitation of th…
-
Medium 5.9
There is a race condition vulnerability in SD upgrade mode. Successful exploitation of this vulnerability may affect da…
-
Medium 6.6
Lin CMS vulnerable to Improper Authentication
An authentication bypass in Lin-CMS v0.2.1 allows attackers to escalate privileges to Super Administrator.
-
Medium 5.3
The HiView module has a vulnerability of not filtering third-party apps out when the HiView module traverses to invoke …
-
Medium 5.9
Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability
Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability
-
Medium 5.4CVE-2022-41049 Exploited
Windows Mark of the Web Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
KEV Nov 14, 2022 -
Medium 5.5
Microsoft Word Information Disclosure Vulnerability
Microsoft Word Information Disclosure Vulnerability