Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-16302 | 3 Artifex, Canonical, Debian | 3 Ghostscript, Ubuntu Linux, Debian Linux | 2022-06-29 | 4.3 MEDIUM | 5.5 MEDIUM |
| A buffer overflow vulnerability in jetp3852_print_page() in devices/gdev3852.c of Artifex Software GhostScript v9.50 allows a remote attacker to escalate privileges via a crafted PDF file. This is fixed in v9.51. | |||||
| CVE-2022-34193 | 1 Jenkins | 1 Package Version | 2022-06-29 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins Package Version Plugin 1.0.1 and earlier does not escape the name of Package version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | |||||
| CVE-2022-34192 | 1 Jenkins | 1 Ontrack | 2022-06-29 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins ontrack Jenkins Plugin 4.0.0 and earlier does not escape the name of Ontrack: Multi Parameter choice, Ontrack: Parameter choice, and Ontrack: SingleParameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | |||||
| CVE-2022-34191 | 1 Jenkins | 1 Ns-nd Integration Performance Publisher | 2022-06-29 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | |||||
| CVE-2022-34190 | 1 Jenkins | 1 Maven Metadata | 2022-06-29 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.1 and earlier does not escape the name and description of List maven artifact versions parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | |||||
| CVE-2022-34177 | 1 Jenkins | 1 Pipeline\ | 2022-06-29 | 5.0 MEDIUM | 7.5 HIGH |
| Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content. | |||||
| CVE-2022-33127 | 2 Diffy Project, Microsoft | 2 Diffy, Windows | 2022-06-29 | 7.5 HIGH | 9.8 CRITICAL |
| The function that calls the diff tool in Diffy 3.4.1 does not properly handle double quotes in a filename when run in a windows environment. This allows attackers to execute arbitrary commands via a crafted string. | |||||
| CVE-2021-40956 | 1 Laiketui | 1 Laiketui | 2022-06-29 | 5.0 MEDIUM | 7.5 HIGH |
| LaiKetui v3.5.0 has SQL injection in the background through the menu management function, and sensitive data can be obtained. | |||||
| CVE-2022-31787 | 1 Ideaco | 1 Ideatms | 2022-06-29 | 7.5 HIGH | 9.8 CRITICAL |
| IdeaTMS 2022 is vulnerable to SQL Injection via the PATH_INFO | |||||
| CVE-2021-26636 | 2 Linux, Maxb | 2 Linux Kernel, Maxboard | 2022-06-29 | 6.8 MEDIUM | 9.6 CRITICAL |
| Stored XSS and SQL injection vulnerability in MaxBoard could lead to occur Remote Code Execution, which could lead to information exposure and privilege escalation. | |||||
| CVE-2017-20087 | 1 Thealpinepress | 1 Alpine-photo-tile-for-instagram | 2022-06-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| A vulnerability, which was classified as problematic, has been found in Alpine PhotoTile for Instagram Plugin 1.2.7.7. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely. | |||||
| CVE-2017-20086 | 1 Automattic | 1 Vaultpress | 2022-06-29 | 6.0 MEDIUM | 7.5 HIGH |
| A vulnerability, which was classified as critical, was found in VaultPress Plugin 1.8.4. This affects an unknown part. The manipulation leads to code injection. It is possible to initiate the attack remotely. | |||||
| CVE-2022-21180 | 1 Intel | 814 Celeron 5305u, Celeron 5305u Firmware, Celeron G3900 and 811 more | 2022-06-29 | 4.9 MEDIUM | 5.5 MEDIUM |
| Improper input validation for some Intel(R) Processors may allow an authenticated user to potentially cause a denial of service via local access. | |||||
| CVE-2022-23823 | 1 Amd | 284 A10-9600p, A10-9600p Firmware, A10-9630p and 281 more | 2022-06-29 | 4.0 MEDIUM | 6.5 MEDIUM |
| A potential vulnerability in some AMD processors using frequency scaling may allow an authenticated attacker to execute a timing attack to potentially enable information disclosure. | |||||
| CVE-2022-27868 | 1 Autodesk | 1 Autocad | 2022-06-29 | 6.8 MEDIUM | 7.8 HIGH |
| A maliciously crafted CAT file in Autodesk AutoCAD 2023 can be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution. | |||||
| CVE-2022-27867 | 1 Autodesk | 1 Autocad | 2022-06-29 | 6.8 MEDIUM | 7.8 HIGH |
| A maliciously crafted JT file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution. | |||||
| CVE-2022-27869 | 1 Autodesk | 1 Autocad | 2022-06-29 | 6.8 MEDIUM | 7.8 HIGH |
| A maliciously crafted TIFF file in Autodesk AutoCAD 2023 can be forced to read and write beyond allocated boundaries when parsing the TIFF file. This vulnerability can be exploited to execute arbitrary code. | |||||
| CVE-2022-27870 | 1 Autodesk | 1 Autocad | 2022-06-29 | 6.8 MEDIUM | 7.8 HIGH |
| A maliciously crafted TGA file in Autodesk AutoCAD 2023 may be used to write beyond the allocated buffer while parsing TGA file. This vulnerability may be exploited to execute arbitrary code. | |||||
| CVE-2022-27872 | 1 Autodesk | 1 Navisworks | 2022-06-29 | 6.8 MEDIUM | 7.8 HIGH |
| A maliciously crafted PDF file may be used to dereference a pointer for read or write operation while parsing PDF files in Autodesk Navisworks 2022. The vulnerability exists because the application fails to handle a crafted PDF file, which causes an unhandled exception. An attacker can leverage this vulnerability to cause a crash or read sensitive data or execute arbitrary code. | |||||
| CVE-2022-27871 | 1 Autodesk | 14 3ds Max, Advance Steel, Autocad and 11 more | 2022-06-29 | 6.8 MEDIUM | 7.8 HIGH |
| Autodesk AutoCAD product suite, Revit, Design Review and Navisworks releases using PDFTron prior to 9.1.17 version may be used to write beyond the allocated buffer while parsing PDF files. This vulnerability may be exploited to execute arbitrary code. | |||||
| CVE-2017-20084 | 1 Jung-group | 2 Smart Visu Server, Smart Visu Server Firmware | 2022-06-29 | 4.6 MEDIUM | 7.8 HIGH |
| A vulnerability has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832 and classified as critical. Affected by this vulnerability is an unknown functionality of the component KNX Group Address. The manipulation leads to backdoor. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component. | |||||
| CVE-2022-34176 | 1 Jenkins | 1 Junit | 2022-06-29 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission. | |||||
| CVE-2021-26637 | 1 Shinasys | 6 Sihas Acm-300, Sihas Acm-300 Firmware, Sihas Gcm-300 and 3 more | 2022-06-29 | 7.5 HIGH | 9.8 CRITICAL |
| There is no account authentication and permission check logic in the firmware and existing apps of SiHAS's SGW-300, ACM-300, GCM-300, so unauthorized users can remotely control the device. | |||||
| CVE-2017-20083 | 1 Jung-group | 2 Smart Visu Server, Smart Visu Server Firmware | 2022-06-29 | 7.2 HIGH | 7.8 HIGH |
| A vulnerability, which was classified as critical, was found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832. Affected is an unknown function of the component SSH Server. The manipulation leads to backdoor. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component. | |||||
| CVE-2017-20082 | 1 Jung-group | 2 Smart Visu Server, Smart Visu Server Firmware | 2022-06-29 | 4.9 MEDIUM | 5.5 MEDIUM |
| A vulnerability, which was classified as problematic, has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832. This issue affects some unknown processing. The manipulation leads to backdoor. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component. | |||||
| CVE-2022-32549 | 1 Apache | 2 Sling Api, Sling Commons Log | 2022-06-29 | 5.0 MEDIUM | 5.3 MEDIUM |
| Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files. | |||||
| CVE-2022-2112 | 1 Inventree | 1 Inventree | 2022-06-29 | 6.8 MEDIUM | 8.8 HIGH |
| Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2. | |||||
| CVE-2021-40955 | 1 Laiketui | 1 Laiketui | 2022-06-29 | 6.5 MEDIUM | 7.2 HIGH |
| SQL injection exists in LaiKetui v3.5.0 the background administrator list. | |||||
| CVE-2022-23079 | 1 Getmotoradmin | 1 Motor Admin | 2022-06-29 | 6.8 MEDIUM | 8.8 HIGH |
| In motor-admin versions 0.0.1 through 0.2.56 are vulnerable to host header injection in the password reset functionality where malicious actor can send fake password reset email to arbitrary victim. | |||||
| CVE-2021-40954 | 1 Laiketui | 1 Laiketui | 2022-06-29 | 7.5 HIGH | 9.8 CRITICAL |
| Laiketui 3.5.0 is affected by an arbitrary file upload vulnerability that can allow an attacker to execute arbitrary code. | |||||
| CVE-2017-20085 | 1 Bytesforall | 1 Atahualpa | 2022-06-29 | 3.5 LOW | 5.4 MEDIUM |
| A vulnerability has been found in Atahualpa Theme and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to basic cross site scripting. The attack can be launched remotely. | |||||
| CVE-2022-34183 | 1 Jenkins | 1 Agent Server Parameter | 2022-06-29 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins Agent Server Parameter Plugin 1.1 and earlier does not escape the name and description of Agent Server parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | |||||
| CVE-2022-34182 | 1 Jenkins | 1 Nested View | 2022-06-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| Jenkins Nested View Plugin 1.20 through 1.25 (both inclusive) does not escape search parameters, resulting in a reflected cross-site scripting (XSS) vulnerability. | |||||
| CVE-2022-34181 | 1 Jenkins | 1 Xunit | 2022-06-29 | 6.4 MEDIUM | 9.1 CRITICAL |
| Jenkins xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory if it doesn't exist, and parsing files inside it as test results, allowing attackers able to control agent processes to create an arbitrary directory on the Jenkins controller or to obtain test results from existing files in an attacker-specified directory. | |||||
| CVE-2021-29055 | 1 School File Management System Project | 1 School File Management System | 2022-06-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in sourcecodester School File Management System 1.0 via the Firtstname parameter to the Update Account form in student_profile.php. | |||||
| CVE-2022-34180 | 1 Jenkins | 1 Embeddable Build Status | 2022-06-29 | 5.0 MEDIUM | 7.5 HIGH |
| Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unprotected" status badge access, allowing attackers without any permissions to obtain the build status badge icon for any attacker-specified job and/or build. | |||||
| CVE-2022-34179 | 1 Jenkins | 1 Embeddable Build Status | 2022-06-29 | 5.0 MEDIUM | 7.5 HIGH |
| Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a `style` query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to specify paths to other SVG images on the Jenkins controller file system. | |||||
| CVE-2021-46824 | 1 School File Management System Project | 1 School File Management System | 2022-06-29 | 3.5 LOW | 5.4 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in sourcecodester School File Management System 1.0 via the Lastname parameter to the Update Account form in student_profile.php. | |||||
| CVE-2022-34178 | 1 Jenkins | 1 Embeddable Build Status | 2022-06-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible values, resulting in a reflected cross-site scripting (XSS) vulnerability. | |||||
| CVE-2022-20651 | 1 Cisco | 1 Adaptive Security Device Manager | 2022-06-29 | 2.1 LOW | 5.5 MEDIUM |
| A vulnerability in the logging component of Cisco Adaptive Security Device Manager (ASDM) could allow an authenticated, local attacker to view sensitive information in clear text on an affected system. Cisco ADSM must be deployed in a shared workstation environment for this issue to be exploited. This vulnerability is due to the storage of unencrypted credentials in certain logs. An attacker could exploit this vulnerability by accessing the logs on an affected system. A successful exploit could allow the attacker to view the credentials of other users of the shared device. | |||||
| CVE-2022-34175 | 1 Jenkins | 1 Jenkins | 2022-06-29 | 5.0 MEDIUM | 7.5 HIGH |
| Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments containing sensitive information, bypassing any permission checks in the corresponding view. | |||||
| CVE-2022-34174 | 1 Jenkins | 1 Jenkins | 2022-06-29 | 5.0 MEDIUM | 7.5 HIGH |
| In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm. | |||||
| CVE-2022-23078 | 1 Habitica | 1 Habitica | 2022-06-29 | 5.8 MEDIUM | 6.1 MEDIUM |
| In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page. | |||||
| CVE-2021-41432 | 1 Flatpress | 1 Flatpress | 2022-06-29 | 3.5 LOW | 5.4 MEDIUM |
| A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaScript commands through blog content. | |||||
| CVE-2022-34013 | 1 Zhyd | 1 Oneblog | 2022-06-29 | 4.0 MEDIUM | 4.3 MEDIUM |
| OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Logo parameter under the Link module. | |||||
| CVE-2022-34012 | 1 Zhyd | 1 Oneblog | 2022-06-29 | 4.0 MEDIUM | 6.5 MEDIUM |
| Insecure permissions in OneBlog v2.3.4 allows low-level administrators to reset the passwords of high-level administrators who hold greater privileges. | |||||
| CVE-2022-34011 | 1 Zhyd | 1 Oneblog | 2022-06-29 | 4.0 MEDIUM | 4.3 MEDIUM |
| OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the parameter entryUrls. | |||||
| CVE-2022-23077 | 1 Habitica | 1 Habitica | 2022-06-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page. | |||||
| CVE-2022-33114 | 1 Jflyfox | 1 Jfinal Cms | 2022-06-29 | 6.5 MEDIUM | 7.2 HIGH |
| Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinal_cms/system/dict/list. | |||||
| CVE-2022-33113 | 1 Jflyfox | 1 Jfinal Cms | 2022-06-29 | 3.5 LOW | 5.4 MEDIUM |
| Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module. | |||||