Archive
29 November 2022
Vulnerabilities first published on this day (UTC), newest first.
86 results · Feed
-
Unscored —
Insufficient data validation in Directory in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass f…
-
Unscored —
Insufficient policy enforcement in Autofill in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass…
-
Unscored —CVE-2022-4174 Public exploit
Type confusion in V8 in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corr…
-
Unscored —
Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 108.0.5359.71 allowed a remote attacke…
-
Medium 6.5
An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of…
-
Unscored —
Use after free in Mojo in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a ma…
-
Unscored —
Insufficient validation of untrusted input in Downloads in Google Chrome prior to 108.0.5359.71 allowed an attacker who…
-
Unscored —
Insufficient policy enforcement in Popup Blocker in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to b…
-
Unscored —
Insufficient policy enforcement in File System API in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to…
-
Unscored —
Use after free in Sign-In in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who convinced a user to eng…
-
Unscored —
Inappropriate implementation in Fenced Frames in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypa…
-
Unscored —
Inappropriate implementation in Navigation in Google Chrome on iOS prior to 108.0.5359.71 allowed a remote attacker to …
-
Unscored —
Use after free in Camera Capture in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially explo…
-
Medium 4.8
ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input Deposit Comment.
-
Medium 4.8
ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader.
-
Medium 6.1CVE-2022-36433 Public exploit
The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript …
-
High 8.8
SQL Injection in owncast/owncast
SQL Injection in GitHub repository owncast/owncast prior to 0.0.13.
-
High 7.1
Cradlepoint IBR600 Command Injection
Cradlepoint IBR600 NCOS versions 6.5.0.160bc2e and prior are vulnerable to shell escape, which enables local attackers with non-superuser credentials to gain full, unrestrictive shell access which may allow an attacker to execute arbitrary code.
-
High 7.1
Discourse allows self-XSS through malicious composer message
Discourse is an open-source messaging platform. In versions 2.8.10 and prior on the `stable` branch and versions 2.9.0.beta11 and prior on the `beta` and `tests-passed` branches, users composing malicious messages and navigating to drafts page could self-XSS.…
-
High 8.2CVE-2022-46152 Public exploit
OP-TEE Trusted OS vulnerable to Improper Validation of Array Index in the cleanup_shm_refs function
OP-TEE Trusted OS is the secure side implementation of OP-TEE project, a Trusted Execution Environment. Versions prior to 3.19.0, contain an Improper Validation of Array Index vulnerability. The function `cleanup_shm_refs()` is called by both `entry_invoke_co…
-
Medium 4.3
Discourse may allow exposure of hidden tags in the subject of notification emails
Discourse is an open-source discussion platform. Prior to version 2.8.13 of the `stable` branch and version 2.9.0.beta14 of the `beta` and `tests-passed` branches, unauthorized users may learn of the existence of hidden tags and that they have been applied to…
-
Medium 6.2
Prometheus Exporter Toolkit vulnerable to basic authentication bypass
Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. …
-
High 7.6
Airtable.js credentials exposed in browser builds
Airtable.js is the JavaScript client for Airtable. Prior to version 0.11.6, Airtable.js had a misconfigured build script in its source package. When the build script is run, it would bundle environment variables into the build target of a transpiled bundle. S…
-
Medium 4.3
Insecure permissions in Chocolatey Cmder package v1.3.20 and below grants all users in the Authenticated Users group wr…
-
Medium 5.5
GPAC v2.1-DEV-rev428-gcb8ae46c8-master was discovered to contain a memory leak via the function dimC_box_read at isomed…
-
High 7.5
AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the Search parameter. This vulnerability all…
-
High 7.8
GPAC v2.1-DEV-rev478-g696e6f868-master was discovered to contain a heap use-after-free via the Q_IsTypeOn function at /…
-
Medium 4.3
Insecure permissions in Chocolatey Azure-Pipelines-Agent package v2.211.1 and below grants all users in the Authenticat…
-
High 7.8
GPAC v2.1-DEV-rev428-gcb8ae46c8-master was discovered to contain a stack overflow via the function dimC_box_read at iso…
-
Medium 4.3
Insecure permissions in Chocolatey Python3 package v3.11.0 and below grants all users in the Authenticated Users group …
-
Medium 4.3
Insecure permissions in Chocolatey Ruby package v3.1.2.1 and below grants all users in the Authenticated Users group wr…
-
Medium 4.3
Insecure permissions in Chocolatey PHP package v8.1.12 and below grants all users in the Authenticated Users group writ…
-
High 8.8
Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS …
KEV Aug 5, 2025 -
High 7.5CVE-2022-44356 Scanner template
WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access cont…
-
Medium 6.1
SolarView Compact 7.0 is vulnerable to Cross-site Scripting (XSS) via /network_test.php.
-
Critical 9.8
Russound XSourcePlayer 777D v06.08.03 was discovered to contain a remote code execution vulnerability via the scriptRun…
-
High 8.8CVE-2022-44635 EPSS 69%
Apache Fineract allowed an authenticated user to perform remote code execution due to path traversal
Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an attacker to run remote code. This issue affects Apache Fineract version 1.8.0 and p…
-
Medium 6.1
Garage Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /garage/php_action/createBrand.php.
-
High 8.8
An access control issue in APsystems ENERGY COMMUNICATION UNIT (ECU-C) Power Control Software V4.1NA, V3.11.4, W2.1NA, …
-
Critical 9.8
SolarView Compact 4.0 and 5.0 is vulnerable to Unrestricted File Upload via a crafted php file.