Archive
19 December 2022
Vulnerabilities first published on this day (UTC), newest first.
66 results · Clear filters · Feed
-
Medium 4.3
AEM Incorrect Authorization Security feature bypass
Adobe Experience Manager version 6.5.14 (and earlier) is affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to disclose low level confidentiality inf…
-
Medium 6.5
SQL Injection via OTRS Search API
Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice This issue affects OTRS: from 7.0.1 before 7.0.40 Patch 1, from 8.0.1 before 8.0.28 Patch 1; ((OTRS)) Community Editio…
-
Medium 6.3
Furqan node-whois index.coffee prototype pollution
A vulnerability classified as critical has been found in Furqan node-whois. Affected is an unknown function of the file index.coffee. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is po…
-
Medium 5.5
multimon-ng demod_flex.c add_ch format string
A vulnerability was found in multimon-ng. It has been rated as critical. This issue affects the function add_ch of the file demod_flex.c. The manipulation of the argument ch leads to format string. Upgrading to version 1.2.0 is able to address this issue. The…
-
Medium 4.3CVE-2022-4611 Public exploit
Click Studios Passwordstate hard-coded credentials
A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unknown part. The manipulation leads to hard-coded credentials. It is possible to initiate the attack re…
-
Medium 4.3
Click Studios Passwordstate insufficiently protected credentials
A vulnerability has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as problematic. This vulnerability affects unknown code. The manipulation leads to insufficiently protected credentials. The attack can be …
-
Medium 5.0
Click Studios Passwordstate Browser Extension Provisioning improper authorization
A vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as critical. This issue affects some unknown processing of the component Browser Extension Provisioning. The manipulation leads to improper auth…
-
Medium 5.4
Team scope authorization bypass when Post/Put request with :team_name in body, allows HTTP parameter pollution
Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong to any other team.
-
Medium 4.3
Click Studios Passwordstate API authorization
A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This issue affects some unknown processing of the file /api/browserextension/UpdatePassword/ of the component API. …
-
Medium 5.4
The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PauseEnc…
-
Medium 6.5
The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PairCon_…
-
Medium 6.1
Open redirect vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker t…
-
Medium 5.4
The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) allows attackers…
-
Medium 6.1
Cross-site scripting vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated att…
-
Medium 4.8
Employee Performance Evaluation System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerabi…
-
Medium 6.1
Cross-site scripting vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated att…
-
Medium 6.8
OS command injection vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative…
-
Medium 6.8
Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative…
-
Medium 5.3
GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the ne…
-
Medium 6.4
An unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted Execution Environment (OP-T…
-
Medium 6.5
Apiman has potential permissions bypass
Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. The root cause of the issue is the Apiman project's accidental acceptance of a large contribution that was not fully compatible with the security…
-
Medium 6.2
After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() func…
-
Medium 6.3
pacman-canvas db-handler.php addHighscore sql injection
A vulnerability classified as critical has been found in pacman-canvas up to 1.0.5. Affected is the function addHighscore of the file data/db-handler.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to vers…
-
Medium 6.3
oils-js Web.js redirect
A vulnerability was found in oils-js. It has been declared as critical. This vulnerability affects unknown code of the file core/Web.js. The manipulation leads to open redirect. The attack can be initiated remotely. The name of the patch is fad8fbae824a7d367d…
-
Medium 5.0
phpRedisAdmin login.inc.php authHttpDigest wrong operator in string comparison
A vulnerability was found in phpRedisAdmin up to 1.16.1. It has been classified as problematic. This affects the function authHttpDigest of the file includes/login.inc.php. The manipulation of the argument response leads to use of wrong operator in string com…
-
Medium 5.5
laravel-jqgrid EloquentRepositoryAbstract.php getRows sql injection
A vulnerability classified as critical was found in laravel-jqgrid. Affected by this vulnerability is the function getRows of the file src/Mgallegos/LaravelJqgrid/Repositories/EloquentRepositoryAbstract.php. The manipulation leads to sql injection. The name o…