Archive
November 2022
Vulnerabilities first published in this month (UTC), newest first.
112 results · Clear filters · Feed
-
Low 3.7
Exponential ReDoS in snowflake-connector-python leads to denial of service
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the undocumented get_file_transfer_type method
-
Low 3.0
WordPress All in One SEO Pro plugin <= 4.2.5.1 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin <= 4.2.5.1 on WordPress.
-
Low 3.3
In AlwaysOnHotwordDetector of AlwaysOnHotwordDetector.java, there is a possible way to access the microphone from the b…
-
Low 2.2
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber…
-
Low 2.2
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…
-
Low 2.2
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Prote…
-
Low 3.5
A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and below.…
-
Low 3.0
Host Header Injection in Splunk Enterprise
In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, Splunk Enterprise fails to properly validate and escape the Host header, which could let a remote authenticated user conduct various attacks against the system, including cross-site scripting and c…
-
Low 3.8
A vulnerability in the Localdisk Management feature of Cisco Identity Services Engine (ISE) could allow an authenticate…
-
Low 3.8
Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A…
-
Low 2.7
WordPress Quiz And Survey Master plugin <= 7.3.6 - Multiple Insecure direct object references (IDOR) vulnerabilities
Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin <= 7.3.6 on WordPress.
-
Low 3.7
Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authenti…
-
Low 2.6
Fedora CoreOS supports setting a GRUB bootloader password using a Butane config. When this feature is enabled, GRUB req…
-
Low 2.6
Improper input validation on emails links in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to inject custom fields values in `mailto` li…
-
Low 3.5
Stored Cross-Site Scripting (XSS) in user information in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Authenticated users may store malicious code in their account i…
-
Low 3.5
Blind Server-Side Request Forgery (SSRF) in RSS feeds and planning
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or an external calendar in planning is subje…
-
Low 2.7
In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive
-
Low 2.2
In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings
-
Low 3.3
IBM Robotic Process Automation for Cloud Pak information disclosure
IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner e-mail address to users with access to the container platform. IBM X-Force ID: 238214.
-
Low 3.5
Tribal Systems Zenario CMS Error Log Module admin_organizer.js cross site scripting
A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS. Affected by this issue is some unknown functionality of the file admin_organizer.js of the component Error Log Module. The manipulation leads to cross site scr…
-
Low 2.2
An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiClient for Mac versions 7…
-
Low 3.7
An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiOS SSL-VPN versions 7.2.0…
-
Low 3.1CVE-2022-39379 EPSS 45%
Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary …
-
Low 3.5
Webmin index.cgi cross site scripting
A vulnerability, which was classified as problematic, was found in Webmin 2.001. Affected is an unknown function of the file xterm/index.cgi. The manipulation leads to basic cross site scripting. It is possible to launch the attack remotely. Upgrading to vers…
-
Low 2.4
phpipam Import Preview import-load-data.php cross site scripting
A vulnerability has been found in phpipam and classified as problematic. Affected by this vulnerability is an unknown functionality of the file app/admin/import-export/import-load-data.php of the component Import Preview Handler. The manipulation leads to cro…
-
Low 3.9
A key management error vulnerability [CWE-320] affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and bel…
-
Low 2.4
This issue was addressed with improved data protection. This issue is fixed in iOS 16, macOS Ventura 13. A user with ph…
-
Low 3.3
This issue was addressed with improved entitlements. This issue is fixed in iOS 16, watchOS 9. An app may be able to re…
-
Low 2.4
A logic issue was addressed with improved state management. This issue is fixed in iOS 16, macOS Ventura 13, watchOS 9.…
-
Low 2.4
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, iOS 16, iOS 15.7 a…
-
Low 3.3
The issue was addressed with additional restrictions on the observability of app states. This issue is fixed in macOS B…
-
Low 3.5
eolinker apinto-dashboard cross site scripting
A vulnerability was found in eolinker apinto-dashboard and classified as problematic. This issue affects some unknown processing of the file /api/discoveries/. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit h…