Archive
19 December 2022
Vulnerabilities first published on this day (UTC), newest first.
104 results · Feed
-
Medium 5.4
AEM Reflected XSS Arbitrary code execution
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may…
-
Critical 9.1
A stored cross-site scripting vulnerability exists in the HdConfigActions.aspx altertextlanguages functionality of Lans…
-
Critical 9.1
A cross-site scripting (xss) sanitization vulnerability bypass exists in the SanitizeHtml functionality of Lansweeper l…
-
Critical 9.9
A directory traversal vulnerability exists in the AssetActions.aspx addDoc functionality of Lansweeper lansweeper 10.1.…
-
Critical 9.9CVE-2022-29517 EPSS 58%
A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lanswee…
-
Critical 9.1
A directory traversal vulnerability exists in the KnowledgebasePageActions.aspx ImportArticles functionality of Lanswee…
-
Critical 9.1CVE-2022-27498 EPSS 38%
A directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment functionality of Lan…
-
Medium 5.9CVE-2022-46768 EPSS 48%
File name information disclosure vulnerability in Zabbix Web Service Report Generation
Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.
-
Medium 5.5
Adobe Illustrator Out-of-Bound Read Memory leak
Adobe Illustrator versions 26.5.1 (and earlier), and 27.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Ex…
-
Medium 5.5
Adobe Illustrator Out-of-Bound Read Memory leak
Adobe Illustrator versions 26.5.1 (and earlier), and 27.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Ex…
-
Medium 5.5
Adobe Illustrator Out-of-Bound Read Memory leak
Adobe Illustrator versions 26.5.1 (and earlier), and 27.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Ex…
-
Medium 5.5
Adobe Illustrator Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe Illustrator versions 26.5.1 (and earlier), and 27.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Ex…
-
Medium 5.4
AEM Reflected XSS Arbitrary code execution
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may…
-
Medium 5.4
AEM Reflected XSS Arbitrary code execution
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may…
-
Medium 6.5
Adobe Campaign Classic Server-Side Request Forgery Arbitrary file system read
Adobe Campaign version 7.3.1 (and earlier) and 8.3.9 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbit…
-
Medium 4.3
AEM Incorrect Authorization Security feature bypass
Adobe Experience Manager version 6.5.14 (and earlier) is affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to disclose low level confidentiality inf…
-
Medium 6.5
SQL Injection via OTRS Search API
Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice This issue affects OTRS: from 7.0.1 before 7.0.40 Patch 1, from 8.0.1 before 8.0.28 Patch 1; ((OTRS)) Community Editio…
-
Medium 6.3
Furqan node-whois index.coffee prototype pollution
A vulnerability classified as critical has been found in Furqan node-whois. Affected is an unknown function of the file index.coffee. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is po…
-
Medium 5.5
multimon-ng demod_flex.c add_ch format string
A vulnerability was found in multimon-ng. It has been rated as critical. This issue affects the function add_ch of the file demod_flex.c. The manipulation of the argument ch leads to format string. Upgrading to version 1.2.0 is able to address this issue. The…
-
High 7.6
Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
-
Medium 4.3CVE-2022-4611 Public exploit
Click Studios Passwordstate hard-coded credentials
A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unknown part. The manipulation leads to hard-coded credentials. It is possible to initiate the attack re…
-
Low 2.3
Cross-site Scripting (XSS) - Stored in alagrede/znote-app
Cross-site Scripting (XSS) - Stored in GitHub repository alagrede/znote-app prior to 1.7.11.
-
Medium 4.3
Click Studios Passwordstate insufficiently protected credentials
A vulnerability has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as problematic. This vulnerability affects unknown code. The manipulation leads to insufficiently protected credentials. The attack can be …
-
High 8.3
Cross-site Scripting (XSS) - Reflected in openemr/openemr
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2.
-
Medium 5.0
Click Studios Passwordstate Browser Extension Provisioning improper authorization
A vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as critical. This issue affects some unknown processing of the component Browser Extension Provisioning. The manipulation leads to improper auth…
-
Low 1.9
Click Studios Passwordstate risky encryption
A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by this issue is some unknown functionality. The manipulation leads to risky cryptographic algorithm. Loca…
-
Medium 5.4
Team scope authorization bypass when Post/Put request with :team_name in body, allows HTTP parameter pollution
Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong to any other team.
-
High 7.3
Click Studios Passwordstate API authentication bypass by assumed-immutable data
A vulnerability classified as critical was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This vulnerability affects unknown code of the component API. The manipulation leads to authentication bypass by assumed-immutable data…
-
Low 3.5
Click Studios Passwordstate URL Field cross site scripting
A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected is an unknown function of the component URL Field Handler. The manipulation leads to cross site scripting. It i…
-
Medium 4.3
Click Studios Passwordstate API authorization
A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This issue affects some unknown processing of the file /api/browserextension/UpdatePassword/ of the component API. …
-
High 7.1
When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and h…
-
Medium 5.4
The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PauseEnc…
-
Medium 6.5
The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PairCon_…
-
High 8.6
The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) mishandles rejec…
-
High 7.5
The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) is unresponsive …
-
Medium 6.1
Open redirect vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker t…
-
Medium 5.4
The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) allows attackers…
-
Medium 6.1
Cross-site scripting vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated att…
-
High 7.5
SQL Injection exits in xinhu < 2.5.0
-
Critical 9.8
Softr v2.0 was discovered to be vulnerable to HTML injection via the Name field of the Account page.