Archive
November 2022
Vulnerabilities first published in this month (UTC), newest first.
100 results · Clear filters · Feed
-
High 8.8
A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920…
-
Critical 9.8CVE-2022-44136 Public exploit
Zenario CMS is vulnerable to Remote Code Execution (RCE).
Zenario CMS 9.3.57186 is vulnerable to Remote Code Excution (RCE).
-
Medium 4.3CVE-2022-41413 Public exploit
perfSONAR v4.x <= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is triggered when an attac…
-
Unscored —CVE-2022-4174 Public exploit
Type confusion in V8 in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corr…
-
Medium 6.1CVE-2022-36433 Public exploit
The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript …
-
High 8.2CVE-2022-46152 Public exploit
OP-TEE Trusted OS vulnerable to Improper Validation of Array Index in the cleanup_shm_refs function
OP-TEE Trusted OS is the secure side implementation of OP-TEE project, a Trusted Execution Environment. Versions prior to 3.19.0, contain an Improper Validation of Array Index vulnerability. The function `cleanup_shm_refs()` is called by both `entry_invoke_co…
-
High 7.2CVE-2022-3689 Public exploit
HTML Forms < 1.3.25 - Admin+ SQLi
The HTML Forms WordPress plugin before 1.3.25 does not properly properly escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users
-
Critical 9.8CVE-2022-36193 Public exploit
SQL injection in School Management System 1.0 allows remote attackers to modify or delete data, causing persistent chan…
-
High 8.8CVE-2022-45442 Public exploit
Sinatra vulnerable to Reflected File Download attack
Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition hea…
-
High 7.8CVE-2022-45934 Public exploit
An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integ…
-
High 7.5
qs vulnerable to Prototype Pollution
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can pl…
-
High 8.1CVE-2022-38813 Public exploit
PHPGurukul Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows att…
-
High 7.8CVE-2022-2650 Public exploit
Improper Restriction of Excessive Authentication Attempts in wger-project/wger
Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2.
-
High 8.0CVE-2022-42896 Public exploit
Info Leak in l2cap_core in the Linux Kernel
There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker coul…
-
Critical 9.8CVE-2020-23583 Public exploit
OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary…
-
Medium 4.3CVE-2020-23588 Public exploit
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…
-
Medium 4.3CVE-2020-23586 Public exploit
A vulnerability found in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an una…
-
Medium 6.5CVE-2020-23589 Public exploit
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…
-
Low 3.1CVE-2020-23587 Public exploit
A vulnerability found in the OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an…
-
High 8.8CVE-2020-23592 Public exploit
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…
-
Critical 9.8CVE-2020-23591 Public exploit
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an attacker …
-
Medium 6.5CVE-2020-23593 Public exploit
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP_V3.3.1-191028 allows an unauthenti…
-
Critical 9.8
Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes a…
-
Medium 6.5CVE-2020-23590 Public exploit
A vulnerability in Optilink OP-XT71000N Hardware version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…
-
High 8.8CVE-2020-23585 Public exploit
A remote attacker can conduct a cross-site request forgery (CSRF) attack on OPTILINK OP-XT71000N Hardware Version: V2.2…
-
Medium 5.4CVE-2022-35501 Public exploit
Stored Cross-site Scripting (XSS) exists in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 because of the d…
-
Medium 5.4CVE-2022-35500 Public exploit
Amasty Blog 2.10.3 is vulnerable to Cross Site Scripting (XSS) via leave comment functionality.
-
Medium 5.4CVE-2022-45472 Public exploit
CAE LearningSpace Enterprise (with Intuity License) image 267r patch 639 allows DOM XSS, related to ontouchmove and onp…
-
High 8.8CVE-2022-44789 Public exploit
A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to …
-
Critical 9.8CVE-2022-44118 Public exploit
dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution (RCE) via file_manage_control.php.
-
Critical 9.6CVE-2022-41924 Public exploit
Tailscale Windows daemon is vulnerable to RCE via CSRF
A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, which can then be used to remotely execute code. In the Tailscale Windows client, the local API was bound to a local TCP so…
-
Critical 9.1CVE-2022-41923 Public exploit
Grails Spring Security Core plugin vulnerable to privilege escalation
Grails Spring Security Core plugin is vulnerable to privilege escalation. The vulnerability allows an attacker access to one endpoint (i.e. the targeted endpoint) using the authorization requirements of a different endpoint (i.e. the donor endpoint). In some …
-
Medium 5.4CVE-2022-41446 Public exploit
An access control issue in /Admin/dashboard.php of Record Management System using CodeIgniter v1.0 allows attackers to …
-
Medium 4.8
Cross-site Scripting in Backdrop CMS
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content.
-
High 8.8
CartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through insecure uploads. This requi…
-
High 7.8CVE-2022-3910 Public exploit
Use after free in IO_uring in the Linux Kernel
Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in io_uring leads to Use-After-Free and Local Privilege Escalation. When io_msg_ring was invoked with a fixed file, it called io_fput_file() which …
-
High 8.8
There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the pho…
-
Medium 4.8CVE-2022-41445 Public exploit
A cross-site scripting (XSS) vulnerability in Record Management System using CodeIgniter 1.0 allows attackers to execut…
-
Medium 4.8CVE-2022-42097 Public exploit
Cross-site Scripting in Backdrop CMS
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .
-
Medium 4.8
Cross-site Scripting in Backdrop CMS
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.