Archive
19 December 2022
Vulnerabilities first published on this day (UTC), newest first.
19 results · Clear filters · Feed
-
High 8.6
Rockwell Automation GuardLogix and ControlLogix controllers Vulnerable to Denial-Of-Service Attack
An unauthorized user could use a specially crafted sequence of Ethernet/IP messages, combined with heavy traffic loading to cause a denial-of-service condition in Rockwell Automation Logix controllers resulting in a major non-recoverable fault. If the target …
-
High 7.5
Wholesale Market for WooCommerce < 1.0.7 - Unauthenticated Arbitrary File Download
The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.
-
High 7.5CVE-2022-4061 Public exploit
JobBoardWP < 1.2.2 - Unauthenticated Arbitrary File Upload
The JobBoardWP WordPress plugin before 1.2.2 does not properly validate file names and types in its file upload functionalities, allowing unauthenticated users to upload arbitrary files such as PHP.
-
High 7.5
Apache Traffic Server: Improperly handled requests can cause crashes in specific plugins
Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under certain conditions. This issue affects Apache Traffic Server: from 8.0.0 through 9.1.3.
-
High 7.8
A memory corruption vulnerability exists in the VHD File Format parsing CXSPARSE record functionality of PowerISO Power…
-
High 7.6
Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
-
High 8.3
Cross-site Scripting (XSS) - Reflected in openemr/openemr
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2.
-
High 7.3
Click Studios Passwordstate API authentication bypass by assumed-immutable data
A vulnerability classified as critical was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This vulnerability affects unknown code of the component API. The manipulation leads to authentication bypass by assumed-immutable data…
-
High 7.1
When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and h…
-
High 8.6
The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) mishandles rejec…
-
High 7.5
The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) is unresponsive …
-
High 7.5
SQL Injection exits in xinhu < 2.5.0
-
High 7.2
An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows a…
-
High 7.8
DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious atta…
-
High 7.1
Parsing a maliciously crafted X_B and PRT file can force Autodesk Maya 2023 and 2022 to read beyond allocated buffer. T…
-
High 7.8
A maliciously crafted X_B file when parsed through Autodesk Maya 2023 and 2022 can be used to write beyond the allocate…
-
High 7.8
Deark v.1.6.2 was discovered to contain a stack overflow via the do_prism_read_palette() function at /modules/atari-img…
-
High 8.0
OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitra…
-
High 7.5
Knex.js has a limited SQL injection vulnerability
Knex Knex.js through 2.3.0 has a limited SQL injection vulnerability that can be exploited to ignore the WHERE clause of a SQL query.