4,914 results · Clear filters · Feed
-
Critical 9.9
Cross-site scripting - Reflected in Create Subaccount in neorazorx/facturascripts
Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily executed javascript code to steal user'cookie, perform HTTP request, get content of `same origin` page,…
-
Critical 9.8
MyBatis PageHelper vulnerable to time-blind SQL injection via orderBy parameter
MyBatis PageHelper v1.x.x-v3.7.0 v4.0.0-v5.0.0,v5.1.0-v5.3.0 was discovered to contain a time-blind SQL injection vulnerability via the orderBy parameter.
-
Critical 9.9
Improper path handling in kustomization files allows path traversal
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege…
-
Critical 9.8
Apache Struts Remote Java Code Execution
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a craf…
KEV Jan 21, 2022 -
Critical 9.8CVE-2022-28118 Public exploit
RCE in SiteServer CMS
SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in.
-
Critical 9.8
CSV-Safe improperly filters special characters potentially leading to CSV injection
CSV-Safe gem < 3.0.0 doesn't filter out special characters which could trigger CSV Injection.
-
Critical 9.8
Command Injection
The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath …
-
Critical 9.8
Remote Code Execution
All versions of package com.bstek.ureport:ureport2-console are vulnerable to Remote Code Execution by connecting to a malicious database server, causing arbitrary file read and deserialization of local gadgets.
-
Critical 9.8
Incorrect Permission Assignment for Critical Resource in ShopXO
ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php.
-
Critical 9.8
Apache Tomcat affected by vulnerability in TLS and SSL protocol
The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Serv…
-
Critical 9.8
Zope Object Database (ZODB) Arbitrary files reading and deletion
Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated u…
-
Critical 9.8
Zope Object Database (ZODB) vulnerable to arbitrary Python code execution in ZEO storage servers
Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol.
-
Critical 9.1
Roundup xml-rpc server improper check of property permissions
The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.
-
Critical 9.8
Plone Arbitrary Code Execution via Unsafe Handling of Pickles
Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.
-
Critical 9.1
Plone allows anonymous users to reset any users password through the web via Password Reset Tool
Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."
-
Critical 9.4
Trac reStructuredText breach of privacy and denial of service vulnerability
Trac before 0.9.6 does not disable the "raw" or "include" commands when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows remote attackers to read arbitrary files, perform cross-site scripting (XSS) …
-
Critical 9.1
PEAR::Archive_Tar Directory Traversal vulnerability
Directory traversal vulnerability in PEAR::Archive_Tar 1.2, and other versions before 1.3.2, allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a TAR archive.
-
Critical —
Object state limitation has no effect
Object state limitation is a policy you can use in your roles to limit access to content based on specific object state values. Due to a flawed earlier update, these limitations were ineffective in releases made since February 16th 2022. They would grant acce…
-
Critical —
Object state limitation has no effect
Object state limitation is a policy you can use in your roles to limit access to content based on specific object state values. Due to a flawed earlier update, these limitations were ineffective in releases made since February 16th 2022. They would grant acce…
-
Critical 9.8
Object state limitation has no effect
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled.
-
Critical 9.1
Improper Input Validation in httpx
Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.
-
Critical 9.0
Stored XSS via upload plugin functionality in zip format in neorazorx/facturascripts
Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install…
-
Critical 9.8
Keycloak vulnerable to privilege escalation on Token Exchange feature
A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a…
-
Critical 9.0
Store XSS in title parameter executing at EditUser Page & EditProducto page in neorazorx/facturascripts
Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltr…
-
Critical 9.8
Server side request forgery in gibbon
Gibbon v3.4.4 and below allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL.
-
Critical 9.8
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS …
-
Critical 9.0
Stored Cross Site Scripting vulnerability in the checked_out_to parameter in snipe/snipe-it
Stored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe/snipe-it prior to 5.4.3. The vulnerability is capable of stolen the user Cookie.
-
Critical 9.8
Command Injection vulnerability in git-interface@2.1.1 in yarkeev/git-interface
Command Injection vulnerability in git-interface@2.1.1 in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the use of a `--upload-pack` command-line argument feature of git is also supported for `git clone`, whi…
-
Critical 9.8
Git LFS can execute a binary from the current directory on Windows
On Windows, if Git LFS operates on a malicious repository with a `..exe` file as well as a file named `git.exe`, and `git.exe` is not found in `PATH`, the `..exe` program will be executed, permitting the attacker to execute arbitrary code. This does not affec…
-
Critical 9.8
ImpressPages CMS RCE
ImpressPages CMS v1.0.12 has Unspecified Remote Code Execution (fixed in v1.0.13)
-
Critical 9.8
Drupal SQL Injection vulnerability
An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names.
-
Critical 9.8
Typo3 SQL injection due to faulty prepared statements
It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injection vulnerability. This issue can only be exploited if two or more parameters are bound to the quer…
-
Critical 9.8
Smarty3 Arbitrary PHP Code Execution
The $smarty.template variable in Smarty3 allows attackers to possibly execute arbitrary PHP code via the sysplugins/smarty_internal_compile_private_special_variable.php file.
-
Critical 9.8
Typo3 Authentication Bypass
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted request.
-
Critical 9.8
Struts ParameterInterceptor vulnerability allows remote command execution
Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
-
Critical 9.1
Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it
Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.
-
Critical 9.8
SQL injection vulnerability in chart data API
Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.
-
Critical 9.8
SQL Injection in Django
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the pass…
-
Critical 9.8
SQL Injection in Django
A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection paylo…
-
Critical 9.8
Command injection in npm-dependency-versions
The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions with a JSON object in which pkgs is a key, and there are shell metacharacters in a value.