Archive
7 December 2022
Vulnerabilities first published on this day (UTC), newest first.
35 results · Clear filters · Feed
-
Medium 5.7
containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak
containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the us…
-
Medium 6.8
Removal of TrustCor root certificate
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process o…
-
Medium 5.3
A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Adaptive Telephone Adapter firmwa…
-
Medium 5.3
Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter…
-
Medium 5.3
Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter…
-
Medium 5.3
A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware…
-
Medium 5.3
Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) functionality of Cisco ATA 190 Series Analog Telep…
-
Medium 5.3
Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) functionality of Cisco ATA 190 Series Analog Telep…
-
Medium 5.4
IBM Business Process Manager cross-site scripting
IBM Business Process Manager 21.0.1 through 21.0.3.1, 20.0.0.1 through 20.0.0.2 19.0.0.1 through 19.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functi…
-
Medium 5.3
Directory traversal on Windows in github.com/labstack/echo/v4
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
-
Medium 5.3
Apache ManifoldCF: LDAP Injection Vulnerability - ActiveDirectory Authorities
Improper neutralization of special elements used in an LDAP query ('LDAP Injection') vulnerability in ActiveDirectory and Sharepoint ActiveDirectory authority connectors of Apache ManifoldCF allows an attacker to manipulate the LDAP search queries (DoS, addit…
-
Medium 6.5
Use of hard-coded credentials vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to a…
-
Medium 6.8
Hidden functionality vulnerability in multiple Buffalo network devices allows a network-adjacent attacker with an admin…
-
Medium 6.3
maku-boot Scheduled Task AbstractScheduleJob.java doExecute injection
A vulnerability, which was classified as critical, was found in maku-boot up to 2.2.0. This affects the function doExecute of the file AbstractScheduleJob.java of the component Scheduled Task Handler. The manipulation leads to injection. It is possible to ini…
-
Medium 4.4
Rapid7 Nexpose Update Validation Issue
Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the functionality of Rapid7 Nexpose. The attacker would need s…
-
Medium 5.4
Cross-site Scripting in Jenkins Spring Config Plugin
Jenkins Spring Config Plugin 2.0.0 and earlier does not escape build display names shown on the Spring Config view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to change build display names.
-
Medium 4.3
Jenkins Gitea Plugin vulnerable to Cleartext Transmission of Sensitive Information
In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log.
-
Medium 6.5
Jenkins Sonar Gerrit Plugin vulnerable to Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers (previously configured by Jenkins administrators) using attacker-specified credentials ID…
-
Medium 6.1
Jenkins Google Login Plugin Open Redirect vulnerability
Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing to Jenkins.
-
Medium 5.4
Stored XSS vulnerability in Jenkins Checkmarx Plugin
Jenkins Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTML reports, resulting in a stored cross-site scripting (XSS) vulnerability.
-
Medium 5.4
Jenkins Custom Build Properties Plugin vulnerable to Cross-site Scripting
Jenkins Custom Build Properties Plugin 2.79.vc095ccc85094 and earlier does not escape property values and build display names on the Custom Build Properties and Build Summary pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by…
-
Medium 6.5
Improper validation of syntactic correctness of input vulnerability exist in Movable Type series. Having a user to acce…
-
Medium 6.1CVE-2022-45917 Scanner template
ILIAS before 7.16 has an Open Redirect.
-
Medium 5.4CVE-2022-45217 Public exploit
A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary…
-
Medium 6.1
Cross-site scripting vulnerability in Movable Type Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable T…
-
Medium 5.4
ILIAS before 7.16 allows XSS.
-
Medium 4.8
Online Leave Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the …
-
Medium 5.4
An issue was discovered in ZZCMS 2022. There is a cross-site scripting (XSS) vulnerability in admin/ad_list.php.
-
Medium 6.1
Rapid Software LLC Rapid SCADA 5.8.4 is vulnerable to Cross Site Scripting (XSS).
-
Medium 5.5
tdpServer of TP-Link RE300 V1 improperly processes its input, which may allow an attacker to cause a denial-of-service …
-
Medium 4.8
baserCMS vulnerable to stored Cross-site Scripting
Stored cross-site scripting vulnerability in Permission Settings of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script.
-
Medium 6.2
Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text exp…
-
Medium 5.5
Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text exp…
-
Medium 4.8
baserCMS vulnerable to stored Cross-site Scripting
Stored cross-site scripting vulnerability in User group management of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script.
-
Medium 6.1
Typora versions prior to 1.4.4 fails to properly neutralize JavaScript code, which may result in executing JavaScript c…