Archive
December 2022
Vulnerabilities first published in this month (UTC), newest first.
1,043 results · Clear filters · Feed
-
Medium 4.7CVE-2022-4732 EPSS 38%
Unrestricted Upload of File with Dangerous Type in microweber/microweber
Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.
-
Medium 6.7
Cross-site Scripting (XSS) - Stored in openemr/openemr
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.2.
-
Medium 5.5
AWS SDK XML Parser XpathUtils.java XpathUtils server-side request forgery
A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java of the component XML Parser. The manipulation leads to ser…
-
Medium 6.3
SourceCodester Sanitization Management System Admin Login sql injection
A vulnerability classified as critical was found in SourceCodester Sanitization Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Admin Login. The manipulation of the argument username/password leads to sql inj…
-
Medium 6.5
Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that refere…
-
Medium 6.5
Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a …
-
Medium 6.5
Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentio…
-
Medium 5.3
A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.…
-
Medium 5.4
AEM Reflected XSS Arbitrary code execution
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may…
-
Medium 5.3
Information Exposure
The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is…
-
Medium 5.3
An out of bounds read vulnerability exists in the way OpenImageIO version v2.3.19.0 processes string fields in TIFF ima…
-
Medium 5.3
An information disclosure vulnerability exists in the OpenImageIO::decode_iptc_iim() functionality of OpenImageIO Proje…
-
Medium 5.3
A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted…
-
Medium 5.9
Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenI…
-
Medium 5.9
An information disclosure vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImage…
-
Medium 5.9
A denial of service vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.…
-
Medium 5.9
Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenI…
-
Medium 5.9
A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project OpenImageIO v…
-
Medium 5.9
An information disclosure vulnerability exists in the IFFOutput channel interleaving functionality of OpenImageIO Proje…
-
Medium 6.2
IBM AIX denial of service
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 235181.
-
Medium 6.2
IBM AIX denial of service
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX pfcdd kernel extension to cause a denial of service. IBM X-Force ID: 239170.
-
Medium 6.2
IBM AIX denial of service
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX perfstat kernel extension to cause a denial of service. IBM X-Force ID: 239169.
-
Medium 6.2
IBM AIX denial of service
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial of service. IBM X-Force ID: 235183.
-
Medium 6.2
IBM AIX denial of service
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX TCP/IP kernel extension to cause a denial of service. IBM X-Force ID: 235599.
-
Medium 6.2
IBM AIX denial of service
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX NFS kernel extension to cause a denial of service. IBM X-Force ID: 238640.
-
Medium 6.2
IBM AIX denial of service
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX SMB client to cause a denial of service. IBM X-Force ID: 238639.
-
Medium 5.5
ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_user_cover_default_image_url’ parameter in versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible f…
-
Medium 5.5
ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings
The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several form fields in versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, …
-
Medium 6.5
Heap buffer overflow in pjproject when decoding STUN message
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. This issue is similar to GHSA-9pfh-r8x4-w26w. Possible buffer overread when parsing a cert…
-
Medium 6.8
Tauri vulnerable to path traversal
Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Sc…
-
Medium 6.1
Open Redirect in ikus060/rdiffweb
Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5.
-
Medium 6.6
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in ikus060/rdiffweb
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository ikus060/rdiffweb prior to 2.5.5.
-
Medium 5.7
Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
-
Medium 5.7
Business Logic Errors in ikus060/rdiffweb
Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.
-
Medium 4.3
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in usememos/memos
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0.
-
Medium 6.3
Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5.
-
Medium 6.5
nbnbk commit 879858451d53261d10f77d4709aee2d01c72c301 was discovered to contain an arbitrary file read vulnerability vi…
-
Medium 6.1
Typora through 1.3.8 allows XSS if a document containing an SVG element with an attacker-controlled onload attribute is…
-
Medium 5.3
An improper access validation vulnerability exists in airMAX AC <8.7.11, airFiber 60/LR <2.6.2, airFiber 60 XG/HD <v1.0…
-
Medium 5.4
F-Secure SAFE Browser 19.1 before 19.2 for Android allows an IDN homograph attack.