Archive
December 2022
Vulnerabilities first published in this month (UTC), newest first.
2,371 results · Feed
-
Critical 9.2
LiuOS vulnerable to Authorization Bypass through User-Controlled Key
LiuOS is a small Python project meant to imitate the functions of a regular operating system. Version 0.1.0 and prior of LiuOS allow an attacker to set the GITHUB_ACTIONS environment variable to anything other than null or true and skip authentication checks.…
-
Medium 4.2
Race condition during concurrent TLS mounts in efs-utils
efs-utils is a set of Utilities for Amazon Elastic File System (EFS). A potential race condition issue exists within the Amazon EFS mount helper in efs-utils versions v1.34.3 and below. When using TLS to mount file systems, the mount helper allocates a local …
-
High 7.2
Elrond go Processing: fallback search of SCRs when not found in the main cache
Elrond-GO is a go implementation for the Elrond Network protocol. Versions prior to 1.3.50 are subject to a processing issue where nodes are affected when trying to process a cross-shard relayed transaction with a smart contract deploy transaction data. The p…
-
Medium 6.4
authentik allows existing authenticated users to create arbitrary accounts
authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can create an arbitrary number of accounts through the default flows. This would circumvent any policy …
-
Critical 9.4
authentik vulnerable to Improper Authentication via invitation URL token reuse
authentik is an open-source Identity Provider focused on flexibility and versatility. Versions prior to 2022.11.4 and 2022.10.4 are vulnerable to Improper Authentication. Token reuse in invitation URLs leads to access control bypass via the use of a different…
-
High 7.5
Huawei Aslan Children's Watch has an improper input validation vulnerability. Successful exploitation may cause the wat…
-
High 8.1
Incorrect Use of Privileged APIs in usememos/memos
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.
-
High 7.3
Incorrect Use of Privileged APIs in usememos/memos
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.6
Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.6
Insufficient Granularity of Access Control in usememos/memos
Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.2
Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.6
Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.2
Insufficient Granularity of Access Control in usememos/memos
Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.3
Improper Access Control in usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.3
Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key vulnerability in usememos usememos/memos.This issue affects usememos/memos before 0.9.1.
-
Critical 9.1
Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
-
Critical 9.8
Improper Restriction of Excessive Authentication Attempts in usememos/memos
Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1.
-
Medium 6.3
Improper Access Control in usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.1
Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.2
Improper Access Control in usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.2
Improper Authorization in usememos/memos
Improper Authorization in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.6
Improper Access Control in usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
-
Medium 4.2
Improper Privilege Management in usememos/memos
Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.6
Improper Verification of Source of a Communication Channel in usememos/memos
Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.6
Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
-
High 7.5
BUG-000152121 - Directory traversal vulnerability in ArcGIS Server.
There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker traverse the file system to access files outside of the intended directory on ArcGIS Server. This cou…
-
Medium 6.5
There is a denial of service vulnerability in the Wi-Fi module of the HUAWEI WS7100-20 Smart WiFi Router.Successful exp…
-
Medium 5.5
Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker …
-
High 7.8
Huawei Aslan Children's Watch has a path traversal vulnerability. Successful exploitation may allow attackers to access…
-
Medium 6.5
There is an insufficient authentication vulnerability in some Huawei band products. Successful exploit could allow the …
-
High 7.2CVE-2022-23544 Scanner template
Server-Side Request Forgery in Metersphere leads to Cross-Site Scripting
MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.0 are subject to a Server-Side Request Forgery that leads to Cross-Site Scripting. A Serv…
-
High 7.0
Improper Restriction of XML External Entity Reference in Dragonfly
Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (XXE) attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dragonfly only parses …
-
High 8.2CVE-2022-41966 Public exploit
XStream Denial of Service via stack overflow
XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack…
-
Low 2.5
cloudsync LocalFilesystemConnector.java getItem path traversal
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in cloudsync. Affected by this vulnerability is the function getItem of the file src/main/java/cloudsync/connector/LocalFilesystemConnector.java. The manipulation leads to pat…
-
Low 3.5
OpenMRS Admin UI Module Account Setup AccountPageController.java sendErrorMessage cross site scripting
A vulnerability classified as problematic has been found in OpenMRS Admin UI Module up to 1.4.x. Affected is the function sendErrorMessage of the file omod/src/main/java/org/openmrs/module/adminui/page/controller/systemadmin/accounts/AccountPageController.jav…
-
Low 3.5
OpenMRS Admin UI Module Manage Privilege Page privilege.gsp cross site scripting
A vulnerability was found in OpenMRS Admin UI Module up to 1.4.x. It has been rated as problematic. This issue affects some unknown processing of the file omod/src/main/webapp/pages/metadata/privileges/privilege.gsp of the component Manage Privilege Page. The…
-
Low 3.5
OpenMRS Admin UI Module location.gsp cross site scripting
A vulnerability was found in OpenMRS Admin UI Module up to 1.5.x. It has been declared as problematic. This vulnerability affects unknown code of the file omod/src/main/webapp/pages/metadata/locations/location.gsp. The manipulation leads to cross site scripti…
-
Low 3.5
OpenMRS Appointment Scheduling Module AppointmentTypeValidator.java validateFieldName cross site scripting
A vulnerability was found in OpenMRS Appointment Scheduling Module up to 1.12.x. It has been classified as problematic. This affects the function validateFieldName of the file api/src/main/java/org/openmrs/module/appointmentscheduling/validator/AppointmentTyp…
-
Medium 4.5
Widoco WidocoUtils.java unZipIt path traversal
A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/widoco/WidocoUtils.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. …
-
Low 3.7
nsupdate.info CSRF Cookie base.py cookie httponly flag
A vulnerability classified as problematic has been found in nsupdate.info. This affects an unknown part of the file src/nsupdate/settings/base.py of the component CSRF Cookie Handler. The manipulation of the argument CSRF_COOKIE_HTTPONLY leads to cookie witho…