Archive
December 2022
Vulnerabilities first published in this month (UTC), newest first.
810 results · Clear filters · Feed
-
High 7.5
Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. After bypassing the …
-
High 7.2
Menu Item Visibility Control <= 0.5 - Admin+ Arbitrary PHP Code Execution
The Menu Item Visibility Control WordPress plugin through 0.5 doesn't sanitize and validate the "Visibility logic" option for WordPress menu items, which could allow highly privileged users to execute arbitrary PHP code even in a hardened environment.
-
High 7.5
Contest Gallery < 19.1.5.1 - Unauthenticated SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the user_id POST parameter before concatenating it to an SQL query in ajax-functions-backend.php. This may allow malicious users with at l…
-
High 7.5
Contest Gallery < 19.1.5 - Unauthenticated SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-login.php. This may allow mal…
-
High 7.2
Plugin Logic < 1.0.8 - Admin+ SQLi
The Plugin Logic WordPress plugin before 1.0.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
-
High 8.8
Togglz console missing cross-site request forgery (CSRF) protection
The console in Togglz before 2.9.4 allows CSRF.
-
High 7.8
CODESYS V3 prone to Inadequate Password Hashing
In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain ful…
-
High 7.5
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed …
-
High 8.1
jackson-databind vulnerable to unsafe deserialization
A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.Ca…
-
High 7.4
Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure v…
-
High 8.1
fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows physically proximate attackers to dump the firmware, fl…
-
High 7.5
fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to cause a Denial of Service (device …
-
High 7.5
glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service
The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.
-
High 7.5
fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows an Unauthenticated Remote attacker to send a malicious …
-
High 7.5
golang.org/x/text/language Out-of-bounds Read vulnerability
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
-
High 7.5
Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred_mech_typ…
-
High 7.8
Realtek Audio Drivers for Windows, as used on the Lenovo ThinkPad X1 Carbon 20A7, 20A8, 20BS, and 20BT before 6.0.8882.…
-
High 8.1
An issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other products. The SMB server allows an…
-
High 7.3
SourceCodester School Dormitory Management System Admin Login sql injection
A vulnerability classified as critical was found in SourceCodester School Dormitory Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Admin Login. The manipulation leads to sql injection. The attack can be laun…
-
High 7.3
SourceCodester Blood Bank Management System login.php sql injection
A vulnerability was found in SourceCodester Blood Bank Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file login.php. The manipulation of the argument username/password leads to sql injection. The attac…
-
High 8.1
Improper Removal of Sensitive Information Before Storage or Transfer in usememos/memos
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.8
Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user…
-
High 7.5
Slixmpp lacks SSL Certificate hostname validation in XMLStream
Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.
-
High 7.2
Planet eStream before 6.72.10.07 allows a remote attacker (who is a publisher or admin) to obtain access to all records…
-
High 8.8CVE-2022-40005 EPSS 35%
Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by th…
-
High 7.5
An issue was discovered in Simmeth Lieferantenmanager before 5.6. Due to errors in session management, an attacker can …
-
High 7.5
An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can download arbitrary files from the web…
-
High 8.6
A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection…
-
High 7.5CVE-2022-42953 Public exploit
Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct …
-
High 8.8
PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to …
-
High 7.8CVE-2022-37706 Public exploit
enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and t…
-
High 7.1CVE-2022-46175 Public exploit
Prototype Pollution in JSON5 via Parse Method
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `…
-
High 7.5
is_js vulnerable to Regular Expression Denial of Service
is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a m…
-
High 7.5
A denial of service vulnerability exists in the DDS native tile reading functionality of OpenImageIO Project OpenImageI…
-
High 7.5
A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file di…
-
High 8.1
A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0. A specially-…
-
High 7.5
A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2…
-
High 7.5
Junos OS and Junos OS Evolved: A BGP session will flap upon receipt of a specific, optional transitive attribute in version 22.3R1
An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a Denial of Service (DoS). If a BGP update message is received over an …
-
High 8.1
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageI…
-
High 8.1
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageI…