Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-0875 | 1 Miniorange | 1 Google Authenticator | 2022-07-07 | 4.3 MEDIUM | 4.3 MEDIUM |
| The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowing attackers to make a logged in admin change them and perform Cross-Site Scripting attacks | |||||
| CVE-2021-33647 | 1 Mindspore | 1 Mindspore | 2022-07-07 | 5.0 MEDIUM | 7.5 HIGH |
| When performing the inference shape operation of the Tile operator, if the input data type is not int or int32, it will access data outside of bounds of heap allocated buffers. | |||||
| CVE-2022-2214 | 1 Library Management System Project | 1 Library Management System | 2022-07-07 | 6.5 MEDIUM | 8.8 HIGH |
| A vulnerability was found in SourceCodester Library Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /librarian/bookdetails.php. The manipulation of the argument id with the input ' AND (SELECT 9198 FROM (SELECT(SLEEP(5)))iqZA)-- PbtB leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2022-2212 | 1 Library Management System Project | 1 Library Management System | 2022-07-07 | 6.5 MEDIUM | 8.8 HIGH |
| A vulnerability was found in SourceCodester Library Management System 1.0. It has been classified as critical. Affected is an unknown function of the component /card/index.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2022-31087 | 2 Debian, Ldap-account-manager | 2 Debian Linux, Ldap Account Manager | 2022-07-07 | 7.2 HIGH | 7.8 HIGH |
| LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the tmp directory, which is accessible by /lam/tmp/, allows interpretation of .php (and .php5/.php4/.phpt/etc) files. An attacker capable of writing files under www-data privileges can write a web-shell into this directory, and gain a Code Execution on the host. This issue has been fixed in version 8.0. Users unable to upgrade should disallow executing PHP scripts in (/var/lib/ldap-account-manager/)tmp directory. | |||||
| CVE-2020-9754 | 1 Navercorp | 1 Whale | 2022-07-07 | 5.0 MEDIUM | 5.3 MEDIUM |
| NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode. | |||||
| CVE-2021-40941 | 1 Axiosys | 1 Bento4 | 2022-07-07 | 5.0 MEDIUM | 7.5 HIGH |
| In Bento4 1.6.0-638, there is an allocator is out of memory in the function AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity in Ap4Array.h:172, as demonstrated by GPAC. This can cause a denial of service (DOS). | |||||
| CVE-2022-31086 | 2 Debian, Ldap-account-manager | 2 Debian Linux, Ldap Account Manager | 2022-07-07 | 6.0 MEDIUM | 8.8 HIGH |
| LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the /config/templates/pdf/ directory is accessible for remote users. This is not a default configuration of LAM. This issue has been fixed in version 8.0. There are no known workarounds for this issue. | |||||
| CVE-2022-33202 | 1 Softcreate | 1 L2blocker | 2022-07-07 | 4.8 MEDIUM | 8.1 HIGH |
| Authentication bypass vulnerability in the setup screen of L2Blocker(on-premise) Ver4.8.5 and earlier and L2Blocker(Cloud) Ver4.8.5 and earlier allows an adjacent attacker to perform an unauthorized login and obtain the stored information or cause a malfunction of the device by using alternative paths or channels for Sensor. | |||||
| CVE-2022-31085 | 2 Debian, Ldap-account-manager | 2 Debian Linux, Ldap Account Manager | 2022-07-07 | 4.3 MEDIUM | 6.1 MEDIUM |
| LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by configuration. This issue has been fixed in version 8.0. Users unable to upgrade should install the PHP OpenSSL extension and make sure session encryption is enabled in LAM main configuration. | |||||
| CVE-2022-31016 | 1 Linuxfoundation | 1 Argo-cd | 2022-07-07 | 4.0 MEDIUM | 6.5 MEDIUM |
| Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service, resulting in a Denial of Service. The attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file. The fix for this vulnerability is available in versions 2.3.5, 2.2.10, 2.1.16, and later. There are no known workarounds. Users are recommended to upgrade. | |||||
| CVE-2022-31806 | 1 Codesys | 2 Plcwinnt, Runtime Toolkit | 2022-07-07 | 6.8 MEDIUM | 9.8 CRITICAL |
| In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or prompt to enable password protection at login in case no password is set at the controller. | |||||
| CVE-2022-31805 | 1 Codesys | 10 Development System, Edge Gateway, Gateway and 7 more | 2022-07-07 | 4.3 MEDIUM | 7.5 HIGH |
| In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected. | |||||
| CVE-2022-23896 | 1 Admidio | 1 Admidio | 2022-07-07 | 3.5 LOW | 5.4 MEDIUM |
| Admidio 4.1.2 version is affected by stored cross-site scripting (XSS). | |||||
| CVE-2022-2088 | 1 Smartics | 1 Smartics | 2022-07-07 | 6.8 MEDIUM | 4.9 MEDIUM |
| An authenticated user with admin privileges may be able to terminate any process on the system running Elcomplus SmartICS v2.3.4.0. | |||||
| CVE-2022-33116 | 1 Openeclass | 1 Openeclass | 2022-07-07 | 3.5 LOW | 6.5 MEDIUM |
| An issue in the jmpath variable in /modules/mindmap/index.php of GUnet Open eClass Platform (aka openeclass) v3.12.4 and below allows attackers to read arbitrary files via a directory traversal. | |||||
| CVE-2022-34750 | 1 Mediawiki | 1 Mediawiki | 2022-07-07 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this length is not validated, allowing much larger lexemes to be created, which introduces various denial-of-service attack vectors within the Wikibase and WikibaseLexeme extensions. This is related to Special:NewLexeme and Special:NewProperty. | |||||
| CVE-2017-20108 | 1 Easy Table Project | 1 Easy Table | 2022-07-07 | 3.5 LOW | 5.4 MEDIUM |
| A vulnerability classified as problematic has been found in Easy Table Plugin 1.6. This affects an unknown part of the file /wordpress/wp-admin/options-general.php. The manipulation with the input "><script>alert(1)</script> leads to basic cross site scripting. It is possible to initiate the attack remotely. | |||||
| CVE-2020-19897 | 1 Wuzhicms | 1 Wuzhi Cms | 2022-07-07 | 4.3 MEDIUM | 6.1 MEDIUM |
| A reflected Cross Site Scripting (XSS) in wuzhicms v4.1.0 allows remote attackers to execute arbitrary web script or HTML via the imgurl parameter. | |||||
| CVE-2022-21127 | 2 Intel, Xen | 4 Sgx Dcap, Sgx Psw, Sgx Sdk and 1 more | 2022-07-07 | 2.1 LOW | 5.5 MEDIUM |
| Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. | |||||
| CVE-2022-2221 | 1 Devolutions | 1 Remote Desktop Manager | 2022-07-07 | 4.0 MEDIUM | 6.5 MEDIUM |
| Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users to access credentials of other users. This issue affects: Devolutions Remote Desktop Manager versions prior to 2022.1.8. | |||||
| CVE-2022-2210 | 2 Fedoraproject, Vim | 2 Fedora, Vim | 2022-07-07 | 7.5 HIGH | 9.8 CRITICAL |
| Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. | |||||
| CVE-2020-21161 | 1 Ruckuswireless | 2 Zonedirector, Zonedirector Firmware | 2022-07-07 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in Ruckus Wireless ZoneDirector 9.8.3.0. | |||||
| CVE-2017-20102 | 1 Album Lock Project | 1 Album Lock | 2022-07-07 | 2.1 LOW | 5.5 MEDIUM |
| A vulnerability was found in Album Lock 4.0 and classified as critical. Affected by this issue is some unknown functionality of the file /getImage. The manipulation of the argument filePaht leads to path traversal. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2017-20101 | 1 Projectsend | 1 Projectsend | 2022-07-07 | 3.5 LOW | 5.7 MEDIUM |
| A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely. | |||||
| CVE-2022-26731 | 1 Apple | 3 Ipad Os, Iphone Os, Macos | 2022-07-06 | 4.3 MEDIUM | 4.3 MEDIUM |
| A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5. A malicious website may be able to track users in Safari private browsing mode. | |||||
| CVE-2017-20099 | 1 Analytics Stats Counter Statistics Project | 1 Analytics Stats Counter Statistics | 2022-07-06 | 7.5 HIGH | 9.8 CRITICAL |
| A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical. This issue affects some unknown processing. The manipulation leads to code injection. The attack may be initiated remotely. | |||||
| CVE-2017-20098 | 1 Weblizar | 1 Admin Custom Login | 2022-07-06 | 3.5 LOW | 4.8 MEDIUM |
| A vulnerability was found in Admin Custom Login Plugin 2.4.5.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads to basic cross site scripting (Persistent). It is possible to launch the attack remotely. | |||||
| CVE-2022-2140 | 1 Smartics | 1 Smartics | 2022-07-06 | 6.0 MEDIUM | 9.0 CRITICAL |
| Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters. | |||||
| CVE-2022-2106 | 1 Smartics | 1 Smartics | 2022-07-06 | 4.0 MEDIUM | 2.7 LOW |
| Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform path traversal attacks and specify arbitrary files. | |||||
| CVE-2022-33005 | 1 Deltaww | 1 Diaenergie | 2022-07-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in the System Settings/IOT Settings module of Delta Electronics DIAEnergie v1.08.00 allows attackers to execute arbitrary web scripts via a crafted payload injected into the Name text field. | |||||
| CVE-2017-20100 | 1 Air Transfer Project | 1 Air Transfer | 2022-07-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| A vulnerability was found in Air Transfer 1.0.14/1.2.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2021-41689 | 1 Offis | 1 Dcmtk | 2022-07-06 | 5.0 MEDIUM | 7.5 HIGH |
| DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack. | |||||
| CVE-2021-41688 | 1 Offis | 1 Dcmtk | 2022-07-06 | 5.0 MEDIUM | 7.5 HIGH |
| DCMTK through 3.6.6 does not handle memory free properly. The object in the program is free but its address is still used in other locations. Sending specific requests to the dcmqrdb program will incur a double free. An attacker can use it to launch a DoS attack. | |||||
| CVE-2021-41687 | 1 Offis | 1 Dcmtk | 2022-07-06 | 5.0 MEDIUM | 7.5 HIGH |
| DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sending specific requests to the dcmqrdb program incur the memory leak. An attacker can use it to launch a DoS attack. | |||||
| CVE-2021-41690 | 1 Offis | 1 Dcmtk | 2022-07-06 | 5.0 MEDIUM | 7.5 HIGH |
| DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are not freed properly. Sending specific requests to the dcmqrdb program can incur a memory leak. An attacker can use it to launch a DoS attack. | |||||
| CVE-2022-2218 | 1 Parse-url Project | 1 Parse-url | 2022-07-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository ionicabizau/parse-url prior to 7.0.0. | |||||
| CVE-2022-31103 | 1 Lettersanitizer Project | 1 Lettersanitizer | 2022-07-06 | 5.0 MEDIUM | 7.5 HIGH |
| lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule `@keyframes`. This package is depended on by [react-letter](https://github.com/mat-sz/react-letter), therefore everyone using react-letter is also at risk. The problem has been patched in version 1.0.2. | |||||
| CVE-2022-31101 | 1 Prestashop | 1 Blockwishlist | 2022-07-06 | 6.5 MEDIUM | 8.8 HIGH |
| prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue. | |||||
| CVE-2022-33009 | 1 Lightcms Project | 1 Lightcms | 2022-07-06 | 3.5 LOW | 4.8 MEDIUM |
| A stored cross-site scripting (XSS) vulnerability in LightCMS v1.3.11 allows attackers to execute arbitrary web scripts or HTML via uploading a crafted PDF file. | |||||
| CVE-2022-34060 | 1 Togglee | 1 Togglee | 2022-07-06 | 7.5 HIGH | 9.8 CRITICAL |
| The Togglee package in PyPI version v0.0.8 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges. | |||||
| CVE-2022-34059 | 1 Sixfab-tool Project | 1 Sixfab-tool | 2022-07-06 | 7.5 HIGH | 9.8 CRITICAL |
| The Sixfab-Tool in PyPI v0.0.2 to v0.0.3 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges. | |||||
| CVE-2022-34061 | 1 Catly Translate Project | 1 Catly Translate | 2022-07-06 | 7.5 HIGH | 9.8 CRITICAL |
| The Catly-Translate package in PyPI v0.0.3 to v0.0.5 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges. | |||||
| CVE-2022-32995 | 1 Halo | 1 Halo | 2022-07-06 | 7.5 HIGH | 9.8 CRITICAL |
| Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function. | |||||
| CVE-2022-32994 | 1 Halo | 1 Halo | 2022-07-06 | 7.5 HIGH | 9.8 CRITICAL |
| Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload. | |||||
| CVE-2022-24545 | 1 Microsoft | 5 Windows 10, Windows 11, Windows Server 2016 and 2 more | 2022-07-06 | 5.1 MEDIUM | 7.5 HIGH |
| Windows Kerberos Remote Code Execution Vulnerability. | |||||
| CVE-2022-34066 | 1 Texercise Project | 1 Texercise | 2022-07-06 | 7.5 HIGH | 9.8 CRITICAL |
| The Texercise package in PyPI v0.0.1 to v0.0.12 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges. | |||||
| CVE-2022-34065 | 1 Rondolu-yt-concate Project | 1 Rondolu-yt-concate | 2022-07-06 | 7.5 HIGH | 9.8 CRITICAL |
| The Rondolu-YT-Concate package in PyPI v0.1.0 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges. | |||||
| CVE-2022-34134 | 1 Jorani Project | 1 Jorani | 2022-07-06 | 6.8 MEDIUM | 8.8 HIGH |
| Benjamin BALET Jorani v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /application/controllers/Users.php. | |||||
| CVE-2022-34133 | 1 Jorani Project | 1 Jorani | 2022-07-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| Benjamin BALET Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Comment parameter at application/controllers/Leaves.php. | |||||