Archive
21 November 2022
Vulnerabilities first published on this day (UTC), newest first.
38 results · Clear filters · Feed
-
High 8.4
A potential security vulnerability has been identified in certain HP Workstation BIOS (UEFI firmware) which may allow a…
-
High 8.4
A potential vulnerability has been identified in the system BIOS for certain HP PC products which may allow escalation …
-
High 7.8
A potential security vulnerability has been identified in the HP Jumpstart software, which might allow escalation of pr…
-
High 7.5
Affected builds of Trend Micro Apex One and Apex One as a Service contain a monitor engine component that is complied w…
-
High 7.8
A security agent directory traversal vulnerability in Trend Micro Apex One and Apex One as a Service could allow a loca…
-
High 7.8
An improper handling of exceptional conditions vulnerability in Trend Micro Apex One and Apex One as a Service could al…
-
High 7.0
A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a loc…
-
High 7.8
A memory corruption vulnerability in the Unauthorized Change Prevention service of Trend Micro Apex One and Apex One as…
-
High 7.8
An out-of-bounds access vulnerability in the Unauthorized Change Prevention service of Trend Micro Apex One and Apex On…
-
High 7.2
IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execu…
-
High 8.8
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A …
-
High 8.8
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. By…
-
High 8.8CVE-2022-37332 Public exploit
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A …
-
High 8.8
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. By…
-
High 8.8
Betheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection
The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfn_buil…
-
High 8.1
Miele: Vulnerability in cloud service used by appWash
An API Endpoint used by Miele's "AppWash" MobileApp in all versions was vulnerable to an authorization bypass. A low privileged, remote attacker would have been able to gain read and partial write access to other users data by modifying a small part of a HTTP…
-
High 8.8
My wpdb < 2.5 - Arbitrary SQL Query via CSRF
The My wpdb WordPress plugin before 2.5 is missing CSRF check when running SQL queries, which could allow attacker to make a logged in admin run arbitrary SQL query via a CSRF attack
-
High 7.5
Login Block IPs <= 1.0.0 - IP Spoofing Bypass
The function check_is_login_page() uses headers for the IP check, which can be easily spoofed.
-
High 7.1
Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi
A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.
-
High 8.8CVE-2022-4096 Public exploit
Server-Side Request Forgery (SSRF) in appsmithorg/appsmith
Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2.
-
High 8.1
SQL Injection in dolibarr/dolibarr
SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputati…
-
High 8.8
Blind SQL Injection via GridFieldSortableHeader
Silverstripe silverstripe/framework through 4.11 allows SQL Injection.
-
High 8.8
Input Validation Vulnerability in Hitachi Energy’s MicroSCADA Pro/X SYS600 Products
An input validation vulnerability exists in the Monitor Pro interface of MicroSCADA Pro and MicroSCADA X SYS600. An authenticated user can launch an administrator level remote code execution irrespective of the authenticated user's role.
-
High 8.1
Booster for WooCommerce - Checkout Files Deletion via CSRF
The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not have CSRF check in place when deleting files uploaded at the checkout, al…
-
High 7.5
DeepL Pro API Translation < 1.7.5 - API Key Disclosure
The DeepL Pro API translation plugin WordPress plugin before 1.7.5 discloses sensitive information (including the DeepL API key) in files that are publicly accessible to an external, unauthenticated visitor.
-
High 7.2
Event Monster < 1.2.1 - Admin+ SQLi
The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by high privilege users
-
High 8.8
WPQA < 5.9 - Follow/Unfollow via CSRF
The WPQA Builder WordPress plugin before 5.9 does not have CSRF check when following and unfollowing users, which could allow attackers to make logged in users perform such actions via CSRF attacks
-
High 7.8
When LG SmartShare is installed, local privilege escalation is possible through DLL Hijacking attack. The LG ID is LVE-…
-
High 7.5
Apache Hama allows XSS and information disclosure
missing input validation in Apache Hama may cause information disclosure through path traversal and XSS. Since Apache Hama is EOL, we do not expect these issues to be fixed.
-
High 7.5
Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function via set_device_name.
-
High 7.5
Tenda AC15 V15.03.05.18 is avulnerable to Buffer Overflow via function formSetPPTPServer.
-
High 7.5
Tenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function fromSetRouteStatic..
-
High 7.8CVE-2022-44830 Public exploit
Sourcecodester Event Registration App v1.0 was discovered to contain multiple CSV injection vulnerabilities via the Fir…
-
High 7.5
An issue was discovered in Appalti & Contratti 9.12.2. The target web applications allow Local File Inclusion in any pa…
-
High 7.5
Tenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function formSetVirtualSer.
-
High 7.5
Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function formSetMacFilterCfg.
-
High 7.5
Tenda AC15 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetIpMacBind.
-
High 8.8
An issue was discovered in Appalti & Contratti 9.12.2. The target web applications LFS and DL229 expose a set of servic…