Archive
22 December 2022
Vulnerabilities first published on this day (UTC), newest first.
80 results · Clear filters · Feed
-
High 7.8
A link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One …
-
High 8.6CVE-2022-3805 Scanner template
Jeg Elementor Kit <= 2.5.6 - Unauthenticated Authorization Bypass
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edit…
-
High 8.6
CodeIgniter is vulnerable to improper authentication via Session Handlers
CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an at…
-
High 7.7
HCL BigFix Server Automation (SA) is affected by a security vulnerability around Notification Service
BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix operator's sensitive data in clear text. Operators who use Notification Service related content from BES Support are at risk of leaving their …
-
High 7.0
CodeIgniter is vulnerable to IP address spoofing when using proxy
CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\App::$prox…
-
High 7.6
An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL…
-
High 8.8
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated w…
-
High 8.8
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the result…
-
High 8.8
In the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the numbe…
-
High 8.8
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the result…
-
High 8.8
The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these bugs showed evi…
-
High 8.8
An iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link. Thi…
-
High 8.8
When a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should not allow the user to …
-
High 8.8
Within the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer…
-
High 7.5
The MediaError message property should be consistent to avoid leaking information about cross-origin resources; however…
-
High 7.8
Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privile…
-
High 8.8
It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write …
-
High 8.8
Mozilla developers and community members Gabriele Svelto, Sebastian Hengst, Randell Jesup, Luan Herrera, Lars T Hansen,…
-
High 8.8
Mozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety bugs present in Firefox 9…
-
High 8.8
Mozilla developers and community members Randell Jesup, Sebastian Hengst, and the Mozilla Fuzzing Team reported memory …
-
High 8.8CVE-2022-28281 Public exploit
If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent p…
-
High 8.8
Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team …
-
High 8.8
SVG's <code><use></code> element could have been used to load unexpected content that could have executed script …
-
High 8.8
If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could hav…
-
High 8.8CVE-2022-1529 EPSS 18%
An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScr…
-
High 8.8
A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or…
-
High 7.5
A data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-free vulnerabili…
-
High 8.8
Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103 and Fire…
-
High 8.8
Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1, and Firefox ESR…
-
High 8.8
Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in F…
-
High 8.8
Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level orig…
-
High 7.5
When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates th…
-
High 8.8
When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly bei…
-
High 8.8
A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further…
-
High 8.8
On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and …
-
High 7.8
When saving or opening an email attachment on macOS, Thunderbird did not set attribute com.apple.quarantine on the rece…
-
High 8.1
If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the <code>meta</code> ta…
-
High 8.8CVE-2022-2200 EPSS 24%
If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScr…
-
High 8.8
Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs …
-
High 8.8
Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs …