Archive
November 2022
Vulnerabilities first published in this month (UTC), newest first.
2,049 results · Feed
-
Critical 9.8
Jeecg-boot vulnerable to SQL injection via updateNullByEmptyString
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString.
-
Critical 9.8
Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just return…
-
Medium 6.5
Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files. T…
-
Medium 4.3
Jeecg-boot vulnerable to SQL Injection
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/deleteRecycleBin.
-
Unscored —
Human Resource Management System v1.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability. This vuln…
-
Medium 4.7
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak be…
-
Critical 9.1
Moodle blind Server-Side Request Forgery (SSRF) vulnerability in LTI provider library
A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind …
-
Unscored —
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, relate…
-
Medium 5.4CVE-2022-45038 Scanner template
A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute a…
-
Critical 9.8
Jeecg-boot vulnerable to SQL Injection
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/duplicate/check.
-
Medium 5.4
A cross-site scripting (XSS) vulnerability in /admin/pages/sections_save.php of WBCE CMS v1.5.4 allows attackers to exe…
-
High 7.0
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c has a race condition t…
-
Medium 5.4CVE-2022-45037 Scanner template
A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arb…
-
Medium 6.1
Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/inde…
-
Medium 5.3
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData.
-
Medium 4.3
Jeecg-boot vulnerable to SQL injection via /sys/user/putRecycleBin
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/putRecycleBin.
-
High 7.2
An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arb…
-
Unscored —
An issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus/xillyusb.c has a race condition and us…
-
Medium 5.4
A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute…
-
Unscored —
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dv…
-
High 8.8
The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command injection. This allows an authen…
-
High 7.2
Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
High 7.2
Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
High 7.2
Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …
-
Critical 9.8
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pass paramet…
-
Critical 9.8
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the port paramet…
-
High 7.5
Web Based Quiz System v1.0 transmits user passwords in plaintext during the authentication process, allowing attackers …
-
High 8.8
Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actio…
-
High 7.2
eyoom builder Remote Code Execution Vulnerability
Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program. A remote attacker could exploit the vulnerability to execute or inject malicious code.
-
Low 3.3
Nextcloud Talk Android broadcast incorrect permission handling
Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protected by broadcastPermission allowing malicious apps to monitor communication. It is recommended that the Nextcloud Talk An…
-
High 8.1
ERP solution Remote Code Execution Vulnerability
A specific file on the sERP server if Kyungrinara(ERP solution) has a fixed password with the SYSTEM authority. This vulnerability could allow attackers to leak or steal sensitive information or execute malicious commands.
-
High 7.8
OndiskPlayer Remote Code Execution Vulnerability
Remote code execution vulnerability due to insufficient verification of URLs, etc. in OndiskPlayerAgent. A remote attacker could exploit the vulnerability to cause remote code execution by causing an arbitrary user to download and execute malicious code.
-
Critical 9.8
Badaso vulnerable to Remote Code Execution (RCE)
Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.
-
High 8.2
Browsershot 3.57.2 - Server Side XSS to LFR via URL
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.
-
Medium 6.5
Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because t…
-
High 7.3
Deserialization Vulnerability by yaml config input in super-xray
super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been ad…
-
Low 3.3
Temporary File Information Disclosure Vulnerability
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ's use of `File.createTempFile(..)` results in temporary files being created with the permi…
-
Critical 9.0
Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS). When a low privileged user such as an au…
-
Critical 9.0
PyroCMS vulnerable to stored Cross Site Scripting
PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation.
-
High 8.2
Browsershot 3.57.3 - Server Side XSS to LFR via HTML
Browsershot version 3.57.3 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the JS content imported from an external source passed to the Browsershot::html method does not co…