Archive
6 December 2022
Vulnerabilities first published on this day (UTC), newest first.
32 results · Clear filters · Feed
-
High 8.7
WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Arbitrary File Deletion
Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 at WordPress.
-
High 7.2
Proofpoint Enterprise Protection perl eval() arbitrary command execution
The admin user interface in Proofpoint Enterprise Protection (PPS/PoD) contains a command injection vulnerability that enables an admin to execute commands beyond their allowed scope. This affects all versions 8.19.0 and below.
-
High 8.8
dalorRadius full account take over
daloRADIUS is an open source RADIUS web management application. daloRadius 1.3 and prior are vulnerable to a combination cross site scripting (XSS) and cross site request forgery (CSRF) vulnerability which leads to account takeover in the mng-del.php file bec…
-
High 7.8
IBM Spectrum Scale command execution
IBM Spectrum Scale 5.1.0.1 through 5.1.4.1 could allow a local attacker to execute arbitrary commands in the container. IBM X-Force ID: 239437.
-
High 8.6
Arbitrary file access in KodExplorer
Kodexplorer is a chinese language web based file manager and browser based code editor. Versions prior to 4.50 did not prevent unauthenticated users from requesting arbitrary files from the host OS file system. As a result any files available to the host proc…
-
High 8.6
Arbitrary file access in the Galaxy data analysis platform
Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gunicorn, which can be used to read any file accessible to the operating system user under which Galaxy is running. This v…
-
High 7.7
An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.…
-
High 8.7
Insufficient validation of plugin files
Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface. This issue affects: Secomea GateManager versions prior to 10.0.
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…
-
High 7.5
Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed
Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and…
-
High 8.8
RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 …
-
High 8.8
AyaCMS v3.1.2 has an Arbitrary File Upload vulnerability.
-
High 7.5
Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permi…
-
High 8.8
Thinkphp has a code logic error
Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell.
-
High 7.8
An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a use…
-
High 7.1
Out of bounds write in grappler in Tensorflow
TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memor…
-
High 7.8
In windows manager service, there is a missing permission check. This could lead to set up windows manager service with…
-
High 7.8
In UscAIEngine service, there is a missing permission check. This could lead to set up UscAIEngine service with no addi…
-
High 7.7
In sensor driver, there is a possible buffer overflow due to a missing bounds check. This could lead to local denial of…
-
High 7.8
In power management service, there is a missing permission check. This could lead to set up power management service wi…