Archive
December 2022
Vulnerabilities first published in this month (UTC), newest first.
2,371 results · Feed
-
High 7.5CVE-2022-42953 Public exploit
Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct …
-
High 8.8
PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to …
-
High 7.8CVE-2022-37706 Public exploit
enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and t…
-
Medium 4.1
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in dns-stats hedgehog. It has been rated as problematic. Affe…
-
Medium 5.5
Modern Tribe Panel Builder Plugin SearchFilter.php add_post_content_filtered_to_search_sql sql injection
A vulnerability classified as critical has been found in Modern Tribe Panel Builder Plugin. Affected is the function add_post_content_filtered_to_search_sql of the file ModularContent/SearchFilter.php. The manipulation leads to sql injection. It is possible t…
-
Low 3.5
Graphite Web Cookie cross site scripting
A vulnerability has been found in Graphite Web and classified as problematic. This vulnerability affects unknown code of the component Cookie Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been d…
-
Low 3.5
Graphite Web Absolute Time Range cross site scripting
A vulnerability was found in Graphite Web. It has been classified as problematic. Affected is an unknown function of the component Absolute Time Range Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The e…
-
Low 3.5
Graphite Web Template Name cross site scripting
A vulnerability was found in Graphite Web and classified as problematic. This issue affects some unknown processing of the component Template Name Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has b…
-
Medium 4.7CVE-2022-4732 EPSS 38%
Unrestricted Upload of File with Dangerous Type in microweber/microweber
Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.
-
Low 3.5
OpenMRS Appointment Scheduling Module Notes AppointmentRequest.java getNotes cross site scripting
A vulnerability, which was classified as problematic, was found in OpenMRS Appointment Scheduling Module up to 1.16.x. This affects the function getNotes of the file api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java of the com…
-
Medium 6.7
Cross-site Scripting (XSS) - Stored in openemr/openemr
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.2.
-
Medium 5.5
AWS SDK XML Parser XpathUtils.java XpathUtils server-side request forgery
A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java of the component XML Parser. The manipulation leads to ser…
-
Medium 6.3
SourceCodester Sanitization Management System Admin Login sql injection
A vulnerability classified as critical was found in SourceCodester Sanitization Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Admin Login. The manipulation of the argument username/password leads to sql inj…
-
High 7.1CVE-2022-46175 Public exploit
Prototype Pollution in JSON5 via Parse Method
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `…
-
Medium 6.5
Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that refere…
-
Critical 9.8CVE-2022-47949 EPSS 23%
The Nintendo NetworkBuffer class, as used in Animal Crossing: New Horizons before 2.0.6 and other products, allows remo…
-
Medium 6.5
Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a …
-
Medium 6.5
Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentio…
-
High 7.5
is_js vulnerable to Regular Expression Denial of Service
is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a m…
-
Critical 9.8
A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. A sp…
-
Medium 5.3
A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.…
-
Medium 5.4
AEM Reflected XSS Arbitrary code execution
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may…
-
Medium 5.3
Information Exposure
The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is…
-
Critical 9.8
A heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in OpenImageIO master-bran…
-
Critical 9.8
An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of OpenImageIO Proj…
-
High 7.5
A denial of service vulnerability exists in the DDS native tile reading functionality of OpenImageIO Project OpenImageI…
-
Critical 9.6CVE-2022-41654 EPSS 19%
ghost vulnerable to unauthorized newsletter modification via improper access controls
An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability.
-
Medium 5.3
An out of bounds read vulnerability exists in the way OpenImageIO version v2.3.19.0 processes string fields in TIFF ima…
-
High 7.5
A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file di…
-
Medium 5.3
An information disclosure vulnerability exists in the OpenImageIO::decode_iptc_iim() functionality of OpenImageIO Proje…
-
Critical 9.8
A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project OpenImageIO v2.4…
-
High 8.1
A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0. A specially-…
-
Medium 5.3
A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted…
-
High 7.5
A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2…
-
Critical 9.8
A heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of OpenImageIO 2.3.19.0. A…
-
High 7.5
Junos OS and Junos OS Evolved: A BGP session will flap upon receipt of a specific, optional transitive attribute in version 22.3R1
An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a Denial of Service (DoS). If a BGP update message is received over an …
-
High 8.1
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageI…
-
Medium 5.9
Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenI…
-
Medium 5.9
An information disclosure vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImage…
-
Medium 5.9
A denial of service vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.…