Archive
25 November 2022
Vulnerabilities first published on this day (UTC), newest first.
20 results · Clear filters · Feed
-
High 7.3
Heap-based Buffer Overflow in vim/vim
Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.
-
High 7.5
An issue was discovered in Wind River VxWorks 6.9 and 7, that allows a specifically crafted packet sent by a Radius ser…
-
High 7.5
In F-Secure Endpoint Protection for Windows and macOS before channel with Capricorn database 2022-11-22_07, the aerdl.d…
-
High 8.1CVE-2022-38813 Public exploit
PHPGurukul Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows att…
-
High 7.5
In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive …
-
High 7.0
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c has a race condition t…
-
High 7.2
An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arb…
-
High 8.8
The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command injection. This allows an authen…
-
High 7.2
Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
High 7.2
Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
High 7.2
Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
High 7.5
Web Based Quiz System v1.0 transmits user passwords in plaintext during the authentication process, allowing attackers …
-
High 8.8
Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actio…
-
High 7.2
eyoom builder Remote Code Execution Vulnerability
Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program. A remote attacker could exploit the vulnerability to execute or inject malicious code.
-
High 8.1
ERP solution Remote Code Execution Vulnerability
A specific file on the sERP server if Kyungrinara(ERP solution) has a fixed password with the SYSTEM authority. This vulnerability could allow attackers to leak or steal sensitive information or execute malicious commands.
-
High 7.8
OndiskPlayer Remote Code Execution Vulnerability
Remote code execution vulnerability due to insufficient verification of URLs, etc. in OndiskPlayerAgent. A remote attacker could exploit the vulnerability to cause remote code execution by causing an arbitrary user to download and execute malicious code.
-
High 8.2
Browsershot 3.57.2 - Server Side XSS to LFR via URL
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.
-
High 7.3
Deserialization Vulnerability by yaml config input in super-xray
super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been ad…
-
High 8.2
Browsershot 3.57.3 - Server Side XSS to LFR via HTML
Browsershot version 3.57.3 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the JS content imported from an external source passed to the Browsershot::html method does not co…
-
High 8.2
Browsershot 3.57.2 - Server Side XSS to LFR via HTML
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the HTML content passed to the Browsershot::html method does not contain URL's that use the file:/…