Archive
16 December 2022
Vulnerabilities first published on this day (UTC), newest first.
106 results · Clear filters · Feed
-
Medium 5.8
Arbitrary file write when scanning a specially-crafted local PyPI package
GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to w…
-
Medium 5.8
GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package
GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package. Extracting files using shutil.unpack_archive() from a potentially malicious tarb…
-
Medium 4.3
Improper access control to polling votes
BigBlueButton is an open source web conferencing system. Versions prior to 2.4.0 expose sensitive information to Unauthorized Actors. This issue affects meetings with polls, where the attacker is a meeting participant. Subscribing to the current-poll collecti…
-
Medium 5.7
BigBlueButton contains Response leaks in anonymous polls
BigBlueButton is an open source web conferencing system. This vulnerability only affects release candidates of BigBlueButton 2.4. The attacker can start a subscription for poll results before starting an anonymous poll, and use this subscription to see indivi…
-
Medium 5.5
Trellix xAgent permission bypass vulnerability
Improper preservation of permissions vulnerability in Trellix Endpoint Agent (xAgent) prior to V35.31.22 on Windows allows a local user with administrator privileges to bypass the product protection to uninstall the agent via incorrectly applied permissions i…
-
Medium 6.5
WP Shamsi <= 4.1.0 - Missing Authorization to Arbitrary Plugin Deactivation
The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init() in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactiva…
-
Medium 5.4
Apache Zeppelin: Stored XSS in note permissions
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in other users' browsers. This issue affects Apache Zeppelin before 0.8.2. Users ar…
-
Medium 6.5
Apache Zeppelin: Arbitrary file deletion vulnerability
The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.
-
Medium 4.3
BigBlueButton subject to Ineffective user bans
BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could register multiple users, and join the meeting with one of them. When that user is banned, they could still join the me…
-
Medium 5.5
y_project RuoYi GenController sql injection
A vulnerability, which was classified as critical, has been found in y_project RuoYi 4.7.5. This issue affects some unknown processing of the file com/ruoyi/generator/controller/GenController. The manipulation leads to sql injection. The name of the patch is …
-
Medium 4.3
Dromara HuTool cn.hutool.core.util.ZipUtil.java resource consumption
A vulnerability classified as problematic was found in Dromara HuTool up to 5.8.10. This vulnerability affects unknown code of the file cn.hutool.core.util.ZipUtil.java. The manipulation leads to resource consumption. The attack can be initiated remotely. The…
-
Medium 4.5
A blind site-to-site request forgery vulnerability was found in Satellite server. It is possible to trigger an external…
-
Medium 4.3
University of Central Florida Materia API Controller api.php before cross-site request forgery
A vulnerability classified as problematic has been found in University of Central Florida Materia up to 9.0.0. This affects the function before of the file fuel/app/classes/controller/api.php of the component API Controller. The manipulation leads to cross-si…
-
Medium 4.3
CVE-2022-38756 vulnerability in GW Web prior to 18.4.2
A vulnerability has been identified in Micro Focus GroupWise Web in versions prior to 18.4.2. The GW Web component makes a request to the Post Office Agent that contains sensitive information in the query parameters that could be logged by any intervening HTT…
-
Medium 5.4
Cross-Site Scripting Vulnerability in Serv-U Web Client
This vulnerability happens in the web client versions 15.3.0 to Serv-U 15.3.1. This vulnerability affects the directory creation function.
-
Medium 6.1
In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administr…
-
Medium 4.9
vRealize Operations (vROps) contains a broken access control vulnerability. VMware has evaluated the severity of this i…
-
Medium 6.7
An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Man…
-
Medium 5.3
An unauthenticated user can access Identity Manager’s management console specific page URLs. However, the system doesn’…
-
Medium 6.7
In encode of wlandata.cpp, there is a possible out of bounds write due to improper input validation. This could lead to…
-
Medium 5.5
In a query in MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lea…
-
Medium 4.4
In ProtocolImsBuilder::BuildSetConfig of protocolimsbuilder.cpp, there is a possible out of bounds read due to a missin…
-
Medium 6.7
In ProtocolCallBuilder::BuildSendUssd of protocolcallbuilder.cpp, there is a possible out of bounds write due to a miss…
-
Medium 6.7
In ServiceInterface::HandleRequest of serviceinterface.cpp, there is a possible use after free. This could lead to loca…
-
Medium 6.7
In BroadcastSmsConfigsRequestData::encode of smsdata.cpp, there is a possible out of bounds write due to a missing boun…
-
Medium 4.4
In DoSetCarrierConfig of miscservice.cpp, there is a possible out of bounds read due to an incorrect bounds check. This…
-
Medium 6.7
In ProtocolSimBuilder::BuildSimUpdatePb3gEntry of protocolsimbuilder.cpp, there is a possible out of bounds write due t…
-
Medium 6.7
In ProtocolMiscBuilder::BuildSetLinkCapaReportCriteria of protocolmiscbuilder.cpp, there is a possible out of bounds wr…
-
Medium 6.7
In FacilityLock::Parse of simdata.cpp, there is a possible out of bounds write due to a missing bounds check. This coul…
-
Medium 6.7
In CallDialReqData::encode of callreqdata.cpp, there is a possible out of bounds write due to a missing bounds check. T…
-
Medium 4.4
In Pixel firmware, there is a possible out of bounds read due to a missing bounds check. This could lead to local infor…
-
Medium 6.7
In EmbmsSessionData::encode of embmsdata.cpp, there is a possible out of bounds write due to a missing bounds check. Th…
-
Medium 6.7
In fillSetupDataCallInfo_V1_6 of ril_service_1_6.cpp, there is a possible out of bounds write due to an incorrect bound…
-
Medium 6.7
In ProtocolMiscBuilder::BuildSetSignalReportCriteria of protocolmiscbuilder.cpp, there is a possible out of bounds writ…
-
Medium 4.4
In MiscService::DoOemSetTcsFci of miscservice.cpp, there is a possible out of bounds read due to a missing bounds check…
-
Medium 6.7
In ProtocolEmbmsBuilder::BuildSetSession of protocolembmsbuilder.cpp, there is a possible out of bounds write due to a …
-
Medium 4.4
In VsimOperationDataExt::encode of vsimdata.cpp, there is a possible out of bounds read due to a missing bounds check. …
-
Medium 6.7
In CallDialReqData::encodeCallNumber of callreqdata.cpp, there is a possible out of bounds write due to an incorrect bo…
-
Medium 4.4
In ProtocolSimBuilderLegacy::BuildSimGetGbaAuth of protocolsimbuilderlegacy.cpp, there is a possible out of bounds read…
-
Medium 6.7
In HexString2Value of util.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead …