Search
Total
46623 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-3917 | 1 Apple | 4 Ipados, Iphone Os, Tvos and 1 more | 2022-07-12 | 2.1 LOW | 5.5 MEDIUM |
| This issue was addressed with a new entitlement. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2. An application may be able to use an SSH client provided by private frameworks. | |||||
| CVE-2021-37524 | 1 Fusionpbx | 1 Fusionpbx | 2022-07-12 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.26 allows remote unauthenticated users to inject arbitrary web script or HTML via an unsanitized "path" parameter in resources/login.php. | |||||
| CVE-2020-26147 | 4 Arista, Debian, Linux and 1 more | 14 C-65, C-65 Firmware, C-75 and 11 more | 2022-07-12 | 3.2 LOW | 5.4 MEDIUM |
| An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used. | |||||
| CVE-2014-0068 | 1 Redhat | 2 Openshift, Openshift-origin-node-util | 2022-07-12 | 2.1 LOW | 5.5 MEDIUM |
| It was reported that watchman in openshift node-utils creates /var/run/watchman.pid and /var/log/watchman.ouput with world writable permission. | |||||
| CVE-2022-23725 | 1 Pingidentity | 1 Pingid Integration For Windows Login | 2022-07-12 | 2.1 LOW | 5.5 MEDIUM |
| PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances. | |||||
| CVE-2022-2301 | 1 Chafa Project | 1 Chafa | 2022-07-12 | 4.3 MEDIUM | 5.5 MEDIUM |
| Buffer Over-read in GitHub repository hpjansson/chafa prior to 1.10.3. | |||||
| CVE-2021-25066 | 1 Ninjaforms | 1 Ninja Forms | 2022-07-12 | 3.5 LOW | 4.8 MEDIUM |
| The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | |||||
| CVE-2022-2290 | 1 Trilium Project | 1 Trilium | 2022-07-12 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta. | |||||
| CVE-2018-19021 | 1 Emerson | 1 Deltav | 2022-07-12 | 3.3 LOW | 6.5 MEDIUM |
| A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior, which may allow an attacker to cause a denial of service. | |||||
| CVE-2022-29513 | 1 Cybozu | 1 Garoon | 2022-07-12 | 3.5 LOW | 4.8 MEDIUM |
| Cross-site scripting vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary script. | |||||
| CVE-2022-29931 | 1 Raytion | 1 Custom Security Manager | 2022-07-12 | 4.3 MEDIUM | 6.1 MEDIUM |
| The administration interface of the Raytion Custom Security Manager (Raytion CSM) in Version 7.2.0 allows reflected Cross-site Scripting (XSS). | |||||
| CVE-2022-31755 | 1 Huawei | 3 Emui, Harmonyos, Magic Ui | 2022-07-12 | 2.1 LOW | 5.5 MEDIUM |
| The communication module has a vulnerability of improper permission preservation. Successful exploitation of this vulnerability may affect system availability. | |||||
| CVE-2022-31751 | 1 Huawei | 3 Emui, Harmonyos, Magic Ui | 2022-07-12 | 4.9 MEDIUM | 5.5 MEDIUM |
| The kernel emcom module has multi-thread contention. Successful exploitation of this vulnerability may affect system availability. | |||||
| CVE-2022-1328 | 2 Debian, Mutt | 2 Debian Linux, Mutt | 2022-07-12 | 5.0 MEDIUM | 5.3 MEDIUM |
| Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read past end of input line | |||||
| CVE-2022-25373 | 1 Zohocorp | 1 Manageengine Supportcenter Plus | 2022-07-12 | 3.5 LOW | 5.4 MEDIUM |
| Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history. | |||||
| CVE-2019-9669 | 1 Wordfence | 1 Wordfence | 2022-07-12 | 4.3 MEDIUM | 6.1 MEDIUM |
| ** DISPUTED ** The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerability in the context of the Wordfence WordPress plugin as the firewall rules are not maintained as part of the Wordfence software but rather it is a set of rules hosted on vendor servers and pushed to the plugin with no versioning associated. Bypassing a WAF rule doesn't make a WordPress site vulnerable (speaking in terms of software vulnerabilities). | |||||
| CVE-2022-2300 | 1 Microweber | 1 Microweber | 2022-07-12 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19. | |||||
| CVE-2022-26135 | 1 Atlassian | 3 Jira Data Center, Jira Server, Jira Service Management | 2022-07-12 | 4.0 MEDIUM | 6.5 MEDIUM |
| A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4. | |||||
| CVE-2022-1593 | 1 Site Offline Or Coming Soon Project | 1 Site Offline Or Coming Soon | 2022-07-12 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them. As a result, attackers could make a logged in admin change them and put Cross-Site Scripting payloads in them via a CSRF attack | |||||
| CVE-2014-3650 | 1 Redhat | 1 Jboss Aerogear | 2022-07-11 | 3.5 LOW | 5.4 MEDIUM |
| Multiple persistent cross-site scripting (XSS) flaws were found in the way Aerogear handled certain user-supplied content. A remote attacker could use these flaws to compromise the application with specially crafted input. | |||||
| CVE-2022-34894 | 1 Jetbrains | 1 Hub | 2022-07-11 | 5.0 MEDIUM | 5.3 MEDIUM |
| In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services | |||||
| CVE-2022-23719 | 1 Pingidentity | 1 Pingid Integration For Windows Login | 2022-07-11 | 6.9 MEDIUM | 6.4 MEDIUM |
| PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the ability to execute code on the target machine maybe able to exploit and spoof the local Java service using multiple attack vectors. A successful attack can lead to code executed as SYSTEM by the PingID Windows Login application, or even a denial of service for offline security key authentication. | |||||
| CVE-2022-23717 | 1 Pingidentity | 1 Pingid Integration For Windows Login | 2022-07-11 | 4.9 MEDIUM | 5.5 MEDIUM |
| PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security keys as part of authentication. | |||||
| CVE-2022-27627 | 1 Cybozu | 1 Garoon | 2022-07-11 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting vulnerability in Organization's Information of Cybozu Garoon 4.10.2 to 5.5.1 allows a remote attacker to execute an arbitrary script on the logged-in user's web browser. | |||||
| CVE-2022-23728 | 1 Google | 1 Android | 2022-07-11 | 6.6 MEDIUM | 6.1 MEDIUM |
| Attacker can reset the device with AT Command in the process of rebooting the device. The LG ID is LVE-SMP-210011. | |||||
| CVE-2022-34007 | 1 Eqs | 1 Integrity Line | 2022-07-11 | 4.3 MEDIUM | 6.1 MEDIUM |
| EQS Integrity Line through 2022-07-01 allows a stored XSS via a crafted whistleblower entry. | |||||
| CVE-2022-2213 | 1 Library Management System Project | 1 Library Management System | 2022-07-11 | 3.5 LOW | 5.4 MEDIUM |
| A vulnerability was found in SourceCodester Library Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/edit_admin_details.php?id=admin. The manipulation of the argument Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2022-31077 | 1 Linuxfoundation | 1 Kubeedge | 2022-07-11 | 3.5 LOW | 5.7 MEDIUM |
| KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In affected versions a malicious message response from KubeEdge can crash the CSI Driver controller server by triggering a nil-pointer dereference panic. As a consequence, the CSI Driver controller will be in denial of service. This bug has been fixed in Kubeedge 1.11.0, 1.10.1, and 1.9.3. Users should update to these versions to resolve the issue. At the time of writing, no workaround exists. | |||||
| CVE-2022-31099 | 1 Pomsky-lang | 1 Pomsky | 2022-07-11 | 4.0 MEDIUM | 6.5 MEDIUM |
| rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately. This is a security concern for you, if your service parses untrusted rulex expressions (expressions provided by an untrusted user), and your service becomes unavailable when the process running rulex aborts due to a stack overflow. The crash is fixed in version **0.4.3**. Affected users are advised to update to this version. There are no known workarounds for this issue. | |||||
| CVE-2022-0779 | 1 User-meta | 1 User Meta User Profile Builder And User Management | 2022-07-11 | 4.0 MEDIUM | 6.5 MEDIUM |
| The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path traversal payloads | |||||
| CVE-2022-31100 | 1 Pomsky-lang | 1 Pomsky | 2022-07-11 | 4.0 MEDIUM | 6.5 MEDIUM |
| rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, rulex may crash, possibly enabling a Denial of Service attack. This happens when the expression contains a multi-byte UTF-8 code point in a string literal or after a backslash, because rulex tries to slice into the code point and panics as a result. This is a security concern for you, if your service parses untrusted rulex expressions (expressions provided by an untrusted user), and your service becomes unavailable when the thread running rulex panics. The crashes are fixed in version **0.4.3**. Affected users are advised to update to this version. The only known workaround for this issue is to assume that regular expression parsing will panic and to add logic to catch panics. | |||||
| CVE-2022-30289 | 1 Citeum | 1 Opencti | 2022-07-11 | 3.5 LOW | 5.4 MEDIUM |
| A stored Cross-site Scripting (XSS) vulnerability was identified in the Data Import functionality of OpenCTI through 5.2.4. An attacker can abuse the vulnerability to upload a malicious file that will then be executed by a victim when they open the file location. | |||||
| CVE-2022-31090 | 1 Guzzlephp | 1 Guzzle | 2022-07-11 | 4.0 MEDIUM | 6.5 MEDIUM |
| Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are sensitive information. In affected versions when using our Curl handler, it is possible to use the `CURLOPT_HTTPAUTH` option to specify an `Authorization` header. On making a request which responds with a redirect to a URI with a different origin (change in host, scheme or port), if we choose to follow it, we should remove the `CURLOPT_HTTPAUTH` option before continuing, stopping curl from appending the `Authorization` header to the new request. Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host would trigger removal of the curl-added Authorization header, however this earlier fix did not cover change in scheme or change in port. If you do not require or expect redirects to be followed, one should simply disable redirects all together. Alternatively, one can specify to use the Guzzle steam handler backend, rather than curl. | |||||
| CVE-2022-29168 | 1 Wire | 1 Wire-webapp | 2022-07-11 | 4.3 MEDIUM | 6.1 MEDIUM |
| Wire is a secure messaging application. Wire is vulnerable to arbitrary HTML and Javascript execution via insufficient escaping when rendering `@mentions` in the wire-webapp. If a user receives and views a malicious message, arbitrary code is injected and executed in the context of the victim allowing the attacker to fully control the user account. Wire-desktop clients that are connected to a vulnerable wire-webapp version are also vulnerable to this attack. The issue has been fixed in wire-webapp 2022-05-04-production.0 and is already deployed on all Wire managed services. On-premise instances of wire-webapp need to be updated to docker tag 2022-05-04-production.0-v0.29.7-0-a6f2ded or wire-server 2022-05-04 (chart/4.11.0) or later. No known workarounds exist. | |||||
| CVE-2022-1955 | 1 Opft | 1 Session | 2022-07-11 | 2.1 LOW | 4.6 MEDIUM |
| Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possible due to lack of adequate security controls to prevent dynamic code manipulation. | |||||
| CVE-2020-23886 | 1 Xnview | 1 Xnview Mp | 2022-07-10 | 4.3 MEDIUM | 5.5 MEDIUM |
| XnView MP v0.96.4 was discovered to contain a heap overflow which allows attackers to cause a denial of service (DoS) via a crafted pict file. Related to a User Mode Write AV starting at ntdll!RtlpLowFragHeapFree. | |||||
| CVE-2020-23058 | 1 File Explorer Project | 1 File Explorer | 2022-07-10 | 2.1 LOW | 4.6 MEDIUM |
| An issue in the authentication mechanism in Nong Ge File Explorer v1.4 unauthenticated allows to access sensitive data. | |||||
| CVE-2020-23036 | 1 Medianavi | 1 Smacom | 2022-07-10 | 4.3 MEDIUM | 5.9 MEDIUM |
| MEDIA NAVI Inc SMACom v1.2 was discovered to contain an insecure session validation vulnerability in the session handling of the `password` authentication parameter of the wifi photo transfer module. This vulnerability allows attackers with network access privileges or on public wifi networks to read the authentication credentials and follow-up requests containing the user password via a man in the middle attack. | |||||
| CVE-2020-19003 | 1 Liftoffsoftware | 1 Gate One | 2022-07-10 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances used by hosts not on the origins list. | |||||
| CVE-2020-21602 | 1 Libde265 | 1 Libde265 | 2022-07-10 | 4.3 MEDIUM | 6.5 MEDIUM |
| libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_bipred_16_fallback function, which can be exploited via a crafted a file. | |||||
| CVE-2020-21600 | 1 Libde265 | 1 Libde265 | 2022-07-10 | 4.3 MEDIUM | 6.5 MEDIUM |
| libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_pred_avg_16_fallback function, which can be exploited via a crafted a file. | |||||
| CVE-2020-21535 | 2 Debian, Xfig Project | 2 Debian Linux, Fig2dev | 2022-07-10 | 4.3 MEDIUM | 5.5 MEDIUM |
| fig2dev 3.2.7b contains a segmentation fault in the gencgm_start function in gencgm.c. | |||||
| CVE-2020-21050 | 1 Libsixel Project | 1 Libsixel | 2022-07-10 | 4.3 MEDIUM | 6.5 MEDIUM |
| Libsixel prior to v1.8.3 contains a stack buffer overflow in the function gif_process_raster at fromgif.c. | |||||
| CVE-2020-18778 | 1 Libav | 1 Libav | 2022-07-10 | 4.3 MEDIUM | 6.5 MEDIUM |
| In Libav 12.3, there is a heap-based buffer over-read in vc1_decode_p_mb_intfi in vc1_block.c that allows an attacker to cause denial-of-service via a crafted file. | |||||
| CVE-2020-18775 | 1 Libav | 1 Libav | 2022-07-10 | 4.3 MEDIUM | 6.5 MEDIUM |
| In Libav 12.3, there is a heap-based buffer over-read in vc1_decode_b_mb_intfi in vc1_block.c that allows an attacker to cause denial-of-service via a crafted file. | |||||
| CVE-2020-18898 | 1 Exiv2 | 1 Exiv2 | 2022-07-10 | 4.3 MEDIUM | 6.5 MEDIUM |
| A stack exhaustion issue in the printIFDStructure function of Exiv2 0.27 allows remote attackers to cause a denial of service (DOS) via a crafted file. | |||||
| CVE-2020-21676 | 2 Debian, Fig2dev Project | 2 Debian Linux, Fig2dev | 2022-07-10 | 4.3 MEDIUM | 5.5 MEDIUM |
| A stack-based buffer overflow in the genpstrx_text() component in genpstricks.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into pstricks format. | |||||
| CVE-2020-21675 | 2 Debian, Fig2dev Project | 2 Debian Linux, Fig2dev | 2022-07-10 | 4.3 MEDIUM | 5.5 MEDIUM |
| A stack-based buffer overflow in the genptk_text component in genptk.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into ptk format. | |||||
| CVE-2020-19464 | 1 Flowpaper | 1 Pdf2json | 2022-07-10 | 4.3 MEDIUM | 5.5 MEDIUM |
| An issue has been found in function XRef::fetch in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a stack overflow . | |||||
| CVE-2020-19463 | 1 Flowpaper | 1 Pdf2json | 2022-07-10 | 4.3 MEDIUM | 5.5 MEDIUM |
| An issue has been found in function vfprintf in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a stack overflow. | |||||