December 2022

295 results · Clear filters · Feed

• Critical 9.8
  CVE-2022-4866

  Cross-site Scripting (XSS) - Stored in usememos/memos

  Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.

  usememos usememos/memos github.com/usememos/memos Go
  Dec 31, 2022
• Critical 9.8
  CVE-2022-48195

  mellium.im/sasl authentication failure due to insufficient nonce randomness

  An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated (instead, the nonce is empty). This causes authentication …

  mellium.im/sasl Go
  Dec 31, 2022
• Critical 9.8
  CVE-2022-44621

  Apache Kylin: Command injection by Diagnosis Controller

  Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.

  Apache Software Foundation Apache Kylin org.apache.kylin:kylin-server-base Maven
  Dec 30, 2022
• Critical 9.8
  CVE-2022-46598

  TRENDnet TEW755AP 1.13B01 was discovered to contain a command injection vulnerability via the wps_sta_enrollee_pin para…

  Dec 30, 2022
• Critical 9.8
  CVE-2022-46592

  TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the wps_sta_enrollee_pin parameter in the set_…

  Dec 30, 2022
• Critical 9.8
  CVE-2022-46580

  TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the user_edit_page parameter in the wifi_capti…

  Dec 30, 2022
• Critical 9.8
  CVE-2022-46585

  TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the REMOTE_USER parameter in the get_access (s…

  Dec 30, 2022
• Critical 9.8
  CVE-2022-46601

  TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the setbg_num parameter in the icp_setbg_img (…

  Dec 30, 2022
• Critical 9.8
  CVE-2022-46581

  TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the cameo.cameo.nslookup_target parameter in t…

  Dec 30, 2022
• Critical 9.8
  CVE-2022-46589

  TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the cameo.cameo.netstat_option parameter in th…

  Dec 30, 2022
• Critical 9.8
  CVE-2022-46600

  TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the wps_sta_enrollee_pin parameter in the acti…

  Dec 30, 2022
• Critical 9.8
  CVE-2022-46593

  TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the wps_sta_enrollee_pin parameter in the do_s…

  Dec 30, 2022
• Critical 9.8
  CVE-2022-46588

  TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the sys_service parameter in the setup_wizard_…

  Dec 30, 2022
• Critical 9.8
  CVE-2022-46582

  TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the login_name parameter in the do_graph_auth …

  Dec 30, 2022
• Critical 9.8
  CVE-2022-46586

  TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the qcawifi.wifi%d_vap%d.maclist parameter in …

  Dec 30, 2022
• Critical 9.8
  CVE-2022-46583

  TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the reboot_type parameter in the wizard_ipv6 (…

  Dec 30, 2022
• Critical 9.8
  CVE-2022-46594

  TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the update_file_name parameter in the auto_up_…

  Dec 30, 2022
• Critical 9.8
  CVE-2022-46591

  TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the reject_url parameter in the reject (sub_41…

  Dec 30, 2022
• Critical 9.8
  CVE-2022-46596

  TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the del_num parameter in the icp_delete_img (s…

  Dec 30, 2022
• Critical 9.8
  CVE-2022-46590

  TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the cameo.cameo.netstat_rsname parameter in th…

  Dec 30, 2022
• Critical 9.8
  CVE-2022-46584

  TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the qcawifi.wifi%d_vap%d.maclist parameter in …

  Dec 30, 2022
• Critical 9.8
  CVE-2022-46597

  TRENDnet TEW755AP 1.13B01 was discovered to contain a command injection vulnerability via the sys_service parameter in …

  Dec 30, 2022
• Critical 9.8
  CVE-2022-46599

  TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the setlogo_num parameter in the icp_setlogo_i…

  Dec 30, 2022
• Critical 9.8
  CVE-2022-47122

  Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlPwd_5g parameter at /goform/WifiBasicSet.

  Dec 30, 2022
• Critical 9.8
  CVE-2022-47119

  Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the ssid parameter at /goform/WifiBasicSet.

  Dec 30, 2022
• Critical 9.8
  CVE-2022-47121

  Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey parameter at /goform/WifiBasicSet.

  Dec 30, 2022
• Critical 9.8
  CVE-2022-47118

  Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey1 parameter at /goform/WifiBasicSet.

  Dec 30, 2022
• Critical 9.8
  CVE-2022-47115

  Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepauth parameter at /goform/WifiBasicSet.

  Dec 30, 2022
• Critical 9.8
  CVE-2022-47123

  Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey3 parameter at /goform/WifiBasicSet.

  Dec 30, 2022
• Critical 9.8
  CVE-2022-47128

  Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey2 parameter at /goform/WifiBasicSet.

  Dec 30, 2022
• Critical 9.8
  CVE-2022-47125

  Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn_5g parameter at /goform/WifiBasicSet.

  Dec 30, 2022
• Critical 9.8
  CVE-2022-47126

  Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet.

  Dec 30, 2022
• Critical 9.8
  CVE-2022-47117

  Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the security parameter at /goform/WifiBasicSet.

  Dec 30, 2022
• Critical 9.8
  CVE-2022-47124

  Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey4 parameter at /goform/WifiBasicSet.

  Dec 30, 2022
• Critical 9.8
  CVE-2022-47127

  Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlPwd parameter at /goform/WifiBasicSet.

  Dec 30, 2022
• Critical 9.8
  CVE-2022-47120

  Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet.

  Dec 30, 2022
• Critical 9.8
  CVE-2022-4851

  Improper Handling of Values in usememos/memos

  Improper Handling of Values in GitHub repository usememos/memos prior to 0.9.1.

  usememos usememos/memos github.com/usememos/memos Go
  Dec 29, 2022
• Critical 9.1
  CVE-2022-36437

  Hazelcast connection caching

  The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9…

  com.hazelcast:hazelcast com.hazelcast:hazelcast-enterprise com.hazelcast.jet:hazelcast-jet com.hazelcast.jet:hazelcast-jet-enterprise Maven
  Dec 29, 2022
• Critical 9.2
  CVE-2022-46179

  LiuOS vulnerable to Authorization Bypass through User-Controlled Key

  LiuOS is a small Python project meant to imitate the functions of a regular operating system. Version 0.1.0 and prior of LiuOS allow an attacker to set the GITHUB_ACTIONS environment variable to anything other than null or true and skip authentication checks.…

  LiuWoodsCode LiuOS
  Dec 28, 2022
• Critical 9.4
  CVE-2022-23555

  authentik vulnerable to Improper Authentication via invitation URL token reuse

  authentik is an open-source Identity Provider focused on flexibility and versatility. Versions prior to 2022.11.4 and 2022.10.4 are vulnerable to Improper Authentication. Token reuse in invitation URLs leads to access control bypass via the use of a different…

  goauthentik authentik
  Dec 28, 2022