Archive
December 2022
Vulnerabilities first published in this month (UTC), newest first.
2,371 results · Feed
-
Critical 9.8
Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II b…
-
Critical 9.8
Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and …
-
Critical 9.1
Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory d…
-
Medium 4.6
Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and i…
-
Unscored —
Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate chec…
-
Medium 5.3
An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. HTMLUser…
-
Medium 5.3
An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. When cha…
-
Medium 5.3
OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirec…
-
Medium 6.1
OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name.
-
Medium 6.1
OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /…
-
Medium 6.1
OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages.
-
Medium 6.1
OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IM…
-
Medium 5.3
OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to…
-
Medium 5.3
OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA…
-
Critical 9.8
Insecure default value for CORS configuration
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.
-
High 7.4
Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure v…
-
High 8.1
fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows physically proximate attackers to dump the firmware, fl…
-
Medium 5.3
fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to change the time, date, and month v…
-
High 7.5
fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to cause a Denial of Service (device …
-
High 7.5
glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service
The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.
-
High 7.5
fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows an Unauthenticated Remote attacker to send a malicious …
-
Medium 6.5
In Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by aut…
-
High 7.5
golang.org/x/text/language Out-of-bounds Read vulnerability
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
-
Critical 9.8
In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to …
-
Critical 9.8CVE-2021-45466 EPSS 55%
In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=…
-
Medium 6.1CVE-2021-30134 Scanner template
php-mod/curl allows Cross-site Scripting
php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php.
-
Medium 5.3
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A title blocked by …
-
Medium 5.4
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. There is Blind Stor…
-
Medium 5.3
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API public…
-
High 7.5
Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred_mech_typ…
-
Medium 5.5
An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, O…
-
Medium 6.5
In certain Citrix products, information disclosure can be achieved by an authenticated VPN user when there is a configu…
-
Critical 9.8
The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x b…
-
Medium 6.5
Sierra Wireless MGOS before 3.15.2 and 4.x before 4.3 allows attackers to read log files via a Direct Request (aka Forc…
-
Medium 5.3CVE-2019-19030 Public exploit
Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030)
Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists.
-
High 7.8
Realtek Audio Drivers for Windows, as used on the Lenovo ThinkPad X1 Carbon 20A7, 20A8, 20BS, and 20BT before 6.0.8882.…
-
Medium 5.3
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid us…
-
High 8.1
An issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other products. The SMB server allows an…
-
Medium 5.3
Hashicorp Nomad Information Exposure Through Environmental Variables
HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template rendering, aka GHSA-6hv3-7c34-4hx8. This applies to nomad/client/allocrunner/taskrunner/template.
-
Medium 4.3
styler_praat_scripts Slash file_segmenter.praat denial of service
A vulnerability was found in styler_praat_scripts. It has been classified as problematic. Affected is an unknown function of the file file_segmenter.praat of the component Slash Handler. The manipulation leads to denial of service. It is possible to launch th…