25 November 2022

18 results · Clear filters · Feed

• Medium 4.1
  CVE-2022-38377

  An improper access control vulnerability [CWE-284] in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2…

  Fortinet FortiManager FortiAnalyzer Network devices
  Nov 25, 2022
• Medium 6.1
  CVE-2022-0698

  Microweber vulnerable to cross-site scripting (XSS)

  Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter.

  microweber/microweber Packagist
  Nov 25, 2022
• Medium 4.6
  CVE-2022-39333

  Cross-site scripting (XSS) in Nextcloud Desktop Client

  Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds…

  Nextcloud security-advisories nextcloud-desktop nextcloud-desktop Debian Ubuntu
  Nov 25, 2022
• Medium 4.6
  CVE-2022-39331

  Cross-site Scripting (XSS) in Nexcloud Desktop Client

  Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are…

  Nextcloud security-advisories nextcloud-desktop nextcloud-desktop Debian Ubuntu
  Nov 25, 2022
• Medium 4.3
  CVE-2022-39339

  Cleartext Transmission of Sensitive Information in user_oidc

  user_oidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the OIDC client credentials and tokens are sent in plain text of HTTP without TLS. Any malicious actor with access to monitor user traffic may …

  Nextcloud security-advisories
  Nov 25, 2022
• Medium 4.6
  CVE-2022-39325

  Cross-site scripting vulnerability in BaserCMS

  BaserCMS is a content management system with a japanese language focus. In affected versions there is a cross-site scripting vulnerability on the management system of baserCMS. This is a vulnerability that needs to be addressed when the management system is u…

  baserproject basercms baserproject/basercms Packagist
  Nov 25, 2022
• Medium 4.6
  CVE-2022-39332

  Cross-site scripting (XSS) in Nextcloud Desktop Client

  Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1…

  Nextcloud security-advisories nextcloud-desktop nextcloud-desktop Debian Ubuntu
  Nov 25, 2022
• Medium 6.5
  CVE-2022-45475

  Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files. T…

  Nov 25, 2022
• Medium 4.3
  CVE-2022-45210

  Jeecg-boot vulnerable to SQL Injection

  Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/deleteRecycleBin.

  org.jeecgframework.boot:jeecg-module-system Maven
  Nov 25, 2022
• Medium 4.7
  CVE-2022-45887

  An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak be…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Nov 25, 2022
• Medium 5.4
  CVE-2022-45038 Scanner template

  A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute a…

  Nov 25, 2022
• Medium 5.4
  CVE-2022-45040

  A cross-site scripting (XSS) vulnerability in /admin/pages/sections_save.php of WBCE CMS v1.5.4 allows attackers to exe…

  Nov 25, 2022
• Medium 5.4
  CVE-2022-45037 Scanner template

  A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arb…

  Nov 25, 2022
• Medium 6.1
  CVE-2022-45225

  Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/inde…

  Nov 25, 2022
• Medium 5.3
  CVE-2022-45205

  Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData.

  Nov 25, 2022
• Medium 4.3
  CVE-2022-45208

  Jeecg-boot vulnerable to SQL injection via /sys/user/putRecycleBin

  Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/putRecycleBin.

  org.jeecgframework.boot:jeecg-module-system Maven
  Nov 25, 2022
• Medium 5.4
  CVE-2022-45036

  A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute…

  Nov 25, 2022
• Medium 6.5
  CVE-2022-41712

  Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because t…

  Nov 25, 2022