Weekly Vulnerabilities Reports > July 25 to 31, 2022
Overview
196 new vulnerabilities reported during this period, including 24 critical vulnerabilities and 86 high severity vulnerabilities. This weekly summary report vulnerabilities in 199 products from 68 vendors including Google, Jenkins, Fedoraproject, Debian, and Wavlink. Vulnerabilities are notably categorized as "Use After Free", "Missing Authorization", "Cross-site Scripting", "Cross-Site Request Forgery (CSRF)", and "Missing Authentication for Critical Function".
- 173 reported vulnerabilities are remotely exploitables.
- 1 reported vulnerabilities have public exploit available.
- 37 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
- 133 reported vulnerabilities are exploitable by an anonymous user.
- Google has the most reported vulnerabilities, with 64 reported vulnerabilities.
- Fedoraproject has the most reported critical vulnerabilities, with 5 reported vulnerabilities.
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
EXPLOITABLE
EXPLOITABLE
AVAILABLE
ANONYMOUSLY
WEB APPLICATION
Vulnerability Details
The following table list reported vulnerabilities for the period covered by this report:
24 Critical Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2022-07-28 | CVE-2021-41556 | Squirrel Lang Fedoraproject | Out-of-bounds Read vulnerability in multiple products sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. | 10.0 |
2022-07-28 | CVE-2022-2564 | Mongoosejs | Unspecified vulnerability in Mongoosejs Mongoose Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6. | 9.8 |
2022-07-28 | CVE-2022-30315 | Honeywell | Insufficient Verification of Data Authenticity vulnerability in Honeywell Safety Manager Firmware Honeywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient Verification of Data Authenticity. | 9.8 |
2022-07-28 | CVE-2021-22640 | Ovarro | Improper Restriction of Excessive Authentication Attempts vulnerability in Ovarro products An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks. | 9.8 |
2022-07-28 | CVE-2022-27612 | Synology | Classic Buffer Overflow vulnerability in Synology Audio Station Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio Station before 6.5.4-3367 allows remote attackers to execute arbitrary commands via unspecified vectors. | 9.8 |
2022-07-28 | CVE-2022-31627 | PHP | Out-of-bounds Write vulnerability in PHP In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption. | 9.8 |
2022-07-27 | CVE-2022-2310 | Skyhighsecurity | Authentication Bypass by Spoofing vulnerability in Skyhighsecurity Secure web Gateway 10.0.0/11.0.0 An authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2.23, 8.x prior to 8.2.28, and controlled release 11.x prior to 11.2.1 allows a remote attacker to bypass authentication into the administration User Interface. | 9.8 |
2022-07-26 | CVE-2022-30270 | Motorola | Improper Authentication vulnerability in Motorola Ace1000 Firmware The Motorola ACE1000 RTU through 2022-05-02 has default credentials. | 9.8 |
2022-07-26 | CVE-2022-30271 | Motorola | Use of Hard-coded Credentials vulnerability in Motorola Ace1000 Firmware The Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_service) only generate a new key if no private-key file exists. | 9.8 |
2022-07-26 | CVE-2022-29953 | Bakerhughes | Use of Hard-coded Credentials vulnerability in Bakerhughes products The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded credentials. | 9.8 |
2022-07-26 | CVE-2022-30273 | Motorolasolutions | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Motorolasolutions Mdlc 4.80.0024/4.82.004/4.83.001 The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. | 9.8 |
2022-07-25 | CVE-2022-34907 | Filewave | Use of Hard-coded Credentials vulnerability in Filewave 14.7.0 An authentication bypass vulnerability exists in FileWave before 14.6.3 and 14.7.x before 14.7.2. | 9.8 |
2022-07-25 | CVE-2022-35649 | Moodle Fedoraproject | Improper Input Validation vulnerability in multiple products The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. | 9.8 |
2022-07-25 | CVE-2020-7677 | Thenify Project Debian Fedoraproject | This affects the package thenify before 3.3.1. | 9.8 |
2022-07-25 | CVE-2022-36450 | Obsidian | Improper Input Validation vulnerability in Obsidian Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL. | 9.8 |
2022-07-25 | CVE-2022-36446 | Webmin | Improper Encoding or Escaping of Output vulnerability in Webmin software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. | 9.8 |
2022-07-25 | CVE-2017-20145 | Tecrail | Path Traversal vulnerability in Tecrail Responsive Filemanager A vulnerability was found in Tecrail Responsive Filemanger up to 9.10.x and classified as critical. | 9.8 |
2022-07-27 | CVE-2022-1853 | Use After Free vulnerability in Google Chrome Use after free in Indexed DB in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. | 9.6 | |
2022-07-29 | CVE-2022-1277 | Inavitas | SQL Injection vulnerability in Inavitas Solar LOG Inavitas Solar Log product has an unauthenticated SQL Injection vulnerability. | 9.4 |
2022-07-28 | CVE-2022-2010 | Google Fedoraproject | Out-of-bounds Read vulnerability in multiple products Out of bounds read in compositing in Google Chrome prior to 102.0.5005.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. | 9.3 |
2022-07-26 | CVE-2022-36129 | Hashicorp | Missing Authentication for Critical Function vulnerability in Hashicorp Vault HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. | 9.1 |
2022-07-26 | CVE-2022-29951 | Jtekt | Missing Authentication for Critical Function vulnerability in Jtekt products JTEKT TOYOPUC PLCs through 2022-04-29 mishandle authentication. | 9.1 |
2022-07-26 | CVE-2022-29952 | Bakerhughes | Missing Authentication for Critical Function vulnerability in Bakerhughes products Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. | 9.1 |
2022-07-25 | CVE-2022-0670 | Linuxfoundation Redhat Fedoraproject | A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. | 9.1 |
86 High Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2022-07-29 | CVE-2022-34527 | Dlink | OS Command Injection vulnerability in Dlink Dsl-3782 Firmware 1.01/1.03 D-Link DSL-3782 v1.03 and below was discovered to contain a command injection vulnerability via the function byte_4C0160. | 8.8 |
2022-07-29 | CVE-2022-2577 | Garage Management System Project | SQL Injection vulnerability in Garage Management System Project Garage Management System 1.0 A vulnerability classified as critical was found in SourceCodester Garage Management System 1.0. | 8.8 |
2022-07-28 | CVE-2022-2163 | Google Fedoraproject | Use After Free vulnerability in multiple products Use after free in Cast UI and Toolbar in Google Chrome prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via UI interaction. | 8.8 |
2022-07-28 | CVE-2022-2294 | Google Fedoraproject Webkitgtk Wpewebkit Apple Webrtc Project | Out-of-bounds Write vulnerability in multiple products Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2022-07-28 | CVE-2022-2295 | Google Fedoraproject | Type Confusion vulnerability in multiple products Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2022-07-28 | CVE-2022-2296 | Google Fedoraproject | Use After Free vulnerability in multiple products Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 103.0.5060.114 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via direct UI interactions. | 8.8 |
2022-07-28 | CVE-2022-2477 | Use After Free vulnerability in Google Chrome Use after free in Guest View in Google Chrome prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. | 8.8 | |
2022-07-28 | CVE-2022-2478 | Use After Free vulnerability in Google Chrome Use after free in PDF in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 | |
2022-07-28 | CVE-2022-2480 | Use After Free vulnerability in Google Chrome Use after free in Service Worker API in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 | |
2022-07-28 | CVE-2022-2481 | Use After Free vulnerability in Google Chrome Use after free in Views in Google Chrome prior to 103.0.5060.134 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via UI interaction. | 8.8 | |
2022-07-28 | CVE-2022-1919 | Use After Free vulnerability in Google Chrome Use after free in Codecs in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 | |
2022-07-28 | CVE-2022-2007 | Google Fedoraproject | Use After Free vulnerability in multiple products Use after free in WebGPU in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2022-07-28 | CVE-2022-2008 | Google Fedoraproject | Double Free vulnerability in multiple products Double free in WebGL in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2022-07-28 | CVE-2022-2011 | Google Fedoraproject | Use After Free vulnerability in multiple products Use after free in ANGLE in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2022-07-28 | CVE-2022-2156 | Google Fedoraproject | Use After Free vulnerability in multiple products Use after free in Core in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2022-07-28 | CVE-2022-2157 | Google Fedoraproject | Use After Free vulnerability in multiple products Use after free in Interest groups in Google Chrome prior to 103.0.5060.53 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2022-07-28 | CVE-2022-2158 | Google Fedoraproject | Use After Free vulnerability in multiple products Type confusion in V8 in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2022-07-28 | CVE-2022-2161 | Google Fedoraproject | Use After Free vulnerability in multiple products Use after free in WebApp Provider in Google Chrome prior to 103.0.5060.53 allowed a remote attacker who convinced the user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions. | 8.8 |
2022-07-28 | CVE-2022-2162 | Google Fedoraproject | Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 103.0.5060.53 allowed a remote attacker to bypass file system access via a crafted HTML page. | 8.8 |
2022-07-28 | CVE-2022-2415 | Out-of-bounds Write vulnerability in Google Chrome Heap buffer overflow in WebGL in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 | |
2022-07-28 | CVE-2022-36997 | Veritas | Server-Side Request Forgery (SSRF) vulnerability in Veritas products An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). | 8.8 |
2022-07-27 | CVE-2022-1854 | Use After Free vulnerability in Google Chrome Use after free in ANGLE in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 | |
2022-07-27 | CVE-2022-1855 | Use After Free vulnerability in Google Chrome Use after free in Messaging in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 | |
2022-07-27 | CVE-2022-1856 | Use After Free vulnerability in Google Chrome Use after free in User Education in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension or specific user interaction. | 8.8 | |
2022-07-27 | CVE-2022-1857 | Unspecified vulnerability in Google Chrome Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. | 8.8 | |
2022-07-27 | CVE-2022-1859 | Use After Free vulnerability in Google Chrome Use after free in Performance Manager in Google Chrome prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page. | 8.8 | |
2022-07-27 | CVE-2022-1860 | Use After Free vulnerability in Google Chrome Use after free in UI Foundations in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific user interactions. | 8.8 | |
2022-07-27 | CVE-2022-1861 | Use After Free vulnerability in Google Chrome Use after free in Sharing in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to enage in specific user interactions to potentially exploit heap corruption via specific user interaction. | 8.8 | |
2022-07-27 | CVE-2022-1863 | Use After Free vulnerability in Google Chrome Use after free in Tab Groups in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction. | 8.8 | |
2022-07-27 | CVE-2022-1864 | Use After Free vulnerability in Google Chrome Use after free in WebApp Installs in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction. | 8.8 | |
2022-07-27 | CVE-2022-1865 | Use After Free vulnerability in Google Chrome Use after free in Bookmarks in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction. | 8.8 | |
2022-07-27 | CVE-2022-1866 | Use After Free vulnerability in Google Chrome Use after free in Tablet Mode in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific user interactions. | 8.8 | |
2022-07-27 | CVE-2022-1870 | Use After Free vulnerability in Google Chrome Use after free in App Service in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. | 8.8 | |
2022-07-27 | CVE-2022-1874 | Unspecified vulnerability in Google Chrome Insufficient policy enforcement in Safe Browsing in Google Chrome on Mac prior to 102.0.5005.61 allowed a remote attacker to bypass downloads protection policy via a crafted HTML page. | 8.8 | |
2022-07-27 | CVE-2022-1876 | Out-of-bounds Write vulnerability in Google Chrome Heap buffer overflow in DevTools in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. | 8.8 | |
2022-07-27 | CVE-2022-36882 | Jenkins | Cross-Site Request Forgery (CSRF) vulnerability in Jenkins GIT A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit. | 8.8 |
2022-07-27 | CVE-2022-36889 | Jenkins | Path Traversal vulnerability in Jenkins Deployer Framework Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service. | 8.8 |
2022-07-27 | CVE-2022-36920 | Jenkins | Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Coverity A cross-site request forgery (CSRF) vulnerability in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | 8.8 |
2022-07-26 | CVE-2022-1496 | Use After Free vulnerability in Google Chrome Use after free in File Manager in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct user interaction. | 8.8 | |
2022-07-26 | CVE-2022-1633 | Use After Free vulnerability in Google Chrome Use after free in Sharesheet in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interactions. | 8.8 | |
2022-07-26 | CVE-2022-1634 | Use After Free vulnerability in Google Chrome Use after free in Browser UI in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who had convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific user interactions. | 8.8 | |
2022-07-26 | CVE-2022-1635 | Use After Free vulnerability in Google Chrome Use after free in Permission Prompts in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interactions. | 8.8 | |
2022-07-26 | CVE-2022-1636 | Use After Free vulnerability in Google Chrome Use after free in Performance APIs in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 | |
2022-07-26 | CVE-2022-1639 | Use After Free vulnerability in Google Chrome Use after free in ANGLE in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 | |
2022-07-26 | CVE-2022-1640 | Use After Free vulnerability in Google Chrome Use after free in Sharing in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. | 8.8 | |
2022-07-26 | CVE-2022-1641 | Use After Free vulnerability in Google Chrome Use after free in Web UI Diagnostics in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interaction. | 8.8 | |
2022-07-26 | CVE-2022-33745 | XEN Debian Fedoraproject | insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. | 8.8 |
2022-07-25 | CVE-2021-40336 | Hitachienergy | Injection vulnerability in Hitachienergy Modular Switchgear Monitoring Firmware A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. | 8.8 |
2022-07-25 | CVE-2022-26307 | Libreoffice Debian | LibreOffice supports the storage of passwords for web connections in the user’s configuration database. | 8.8 |
2022-07-25 | CVE-2022-1314 | Type Confusion vulnerability in Google Chrome Type confusion in V8 in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 | |
2022-07-27 | CVE-2022-36899 | Jenkins | Unspecified vulnerability in Jenkins Compuware Ispw Operations Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control agent processes to retrieve Java system properties. | 8.2 |
2022-07-27 | CVE-2022-36900 | Jenkins | Unspecified vulnerability in Jenkins Compuware Zadviser API 1.0.3 Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control agent processes to retrieve Java system properties. | 8.2 |
2022-07-28 | CVE-2022-30319 | Honeywell | Authentication Bypass by Spoofing vulnerability in Honeywell Saia PG5 Controls Suite Saia Burgess Controls (SBC) PCD through 2022-05-06 allows Authentication bypass. | 8.1 |
2022-07-27 | CVE-2022-36881 | Jenkins | Improper Certificate Validation vulnerability in Jenkins GIT Client Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks. | 8.1 |
2022-07-27 | CVE-2022-36921 | Jenkins | Missing Authorization vulnerability in Jenkins Coverity A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | 8.1 |
2022-07-28 | CVE-2022-30287 | Horde Debian | Unsafe Reflection vulnerability in multiple products Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. | 8.0 |
2022-07-27 | CVE-2022-36916 | Jenkins | Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Google Cloud Backup 0.6 A cross-site request forgery (CSRF) vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to request a manual backup. | 8.0 |
2022-07-25 | CVE-2022-34571 | Wavlink | Forced Browsing vulnerability in Wavlink Wifi-Repeater Firmware Rpta277W.M4300.01.Gd.2017Sep19 An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the system key information and execute arbitrary commands via accessing the page syslog.shtml. | 8.0 |
2022-07-28 | CVE-2021-39088 | IBM | Unspecified vulnerability in IBM Qradar Security Information and Event Manager IBM QRadar SIEM 7.3, 7.4, and 7.5 is vulnerable to local privilege escalation if this could be combined with other unknown vulnerabilities then privilege escalation could be performed. | 7.8 |
2022-07-27 | CVE-2022-35672 | Adobe | Out-of-bounds Read vulnerability in Adobe products Adobe Acrobat Reader version 22.001.20085 (and earlier), 20.005.30314 (and earlier) and 17.012.30205 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. | 7.8 |
2022-07-26 | CVE-2022-29957 | Emerson | Missing Authentication for Critical Function vulnerability in Emerson Deltav Distributed Control System The Emerson DeltaV Distributed Control System (DCS) through 2022-04-29 mishandles authentication. | 7.8 |
2022-07-25 | CVE-2022-2522 | VIM | Heap-based Buffer Overflow vulnerability in VIM Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061. | 7.8 |
2022-07-28 | CVE-2022-34568 | Libsdl | Use After Free vulnerability in Libsdl Simple Directmedia Layer SDL v1.2 was discovered to contain a use-after-free via the XFree function at /src/video/x11/SDL_x11yuv.c. | 7.5 |
2022-07-28 | CVE-2016-0796 | MB Miniaudioplayer Project | Externally Controlled Reference to a Resource in Another Sphere vulnerability in Mb.Miniaudioplayer Project Mb.Miniaudioplayer WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vulnerabilities because it fails to properly verify user-supplied input. | 7.5 |
2022-07-28 | CVE-2022-30313 | Honeywell | Missing Authentication for Critical Function vulnerability in Honeywell Safety Manager Firmware Honeywell Experion PKS Safety Manager through 2022-05-06 has Missing Authentication for a Critical Function. | 7.5 |
2022-07-27 | CVE-2022-35911 | Patlite | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Patlite Nhl-Fb2 Firmware and Nhp-Fb2 Firmware On Patlite NH-FB series devices through 1.46, remote attackers can cause a denial of service by omitting the query string. | 7.5 |
2022-07-27 | CVE-2022-36946 | Linux Debian Netapp | nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len. | 7.5 |
2022-07-27 | CVE-2022-36883 | Jenkins | Missing Authorization vulnerability in Jenkins GIT A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit. | 7.5 |
2022-07-26 | CVE-2022-30276 | Motorola | Missing Authentication for Critical Function vulnerability in Motorola products The Motorola MOSCAD and ACE line of RTUs through 2022-05-02 omit an authentication requirement. | 7.5 |
2022-07-26 | CVE-2022-30275 | Motorolasolutions | Cleartext Storage of Sensitive Information vulnerability in Motorolasolutions Mdlc 4.80.0024/4.82.004/4.83.001 The Motorola MOSCAD Toolbox software through 2022-05-02 relies on a cleartext password. | 7.5 |
2022-07-26 | CVE-2022-31205 | Omron | Cleartext Storage of Sensitive Information vulnerability in Omron products In Omron CS series, CJ series, and CP series PLCs through 2022-05-18, the password for access to the Web UI is stored in memory area D1449...D1452 and can be read out using the Omron FINS protocol without any further authentication. | 7.5 |
2022-07-25 | CVE-2022-34749 | Mistune Project Fedoraproject | In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. | 7.5 |
2022-07-25 | CVE-2022-34570 | Wavlink | Forced Browsing vulnerability in Wavlink Wl-Wn579X3 Firmware M79X3.V5030.191012 WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via accessing the messages.txt page. | 7.5 |
2022-07-25 | CVE-2022-34966 | Openteknik | Cross-site Scripting vulnerability in Openteknik Open Source Social Network 6.3 OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an HTML injection vulnerability via the location parameter at http://ip_address/:port/ossn/home. | 7.5 |
2022-07-25 | CVE-2022-24992 | QR Code Generator Project | Path Traversal vulnerability in QR Code Generator Project QR Code Generator A vulnerability in the component process.php of QR Code Generator v5.2.7 allows attackers to perform directory traversal. | 7.5 |
2022-07-25 | CVE-2022-35650 | Moodle Fedoraproject | Improper Input Validation vulnerability in multiple products The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. | 7.5 |
2022-07-25 | CVE-2022-26305 | Libreoffice | Improper Certificate Validation vulnerability in Libreoffice 7.2.0/7.3.0/7.3.1 An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificate. | 7.5 |
2022-07-25 | CVE-2022-26306 | Libreoffice Debian | Use of Insufficiently Random Values vulnerability in multiple products LibreOffice supports the storage of passwords for web connections in the user’s configuration database. | 7.5 |
2022-07-27 | CVE-2022-2313 | Mcafee | Uncontrolled Search Path Element vulnerability in Mcafee Agent A DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL into the folder from where the Smart installer is being executed. | 7.3 |
2022-07-27 | CVE-2022-33970 | Oxilab | Unspecified vulnerability in Oxilab Shortcode Addons Authenticated WordPress Options Change vulnerability in Biplob018 Shortcode Addons plugin <= 3.1.2 at WordPress. | 7.2 |
2022-07-26 | CVE-2022-30272 | Motorola | Insufficient Verification of Data Authenticity vulnerability in Motorola Ace1000 Firmware The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity. | 7.2 |
2022-07-25 | CVE-2022-36375 | Oxilab | Unspecified vulnerability in Oxilab Responsive Tabs Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress. | 7.2 |
2022-07-25 | CVE-2022-33969 | Oxilab | Unspecified vulnerability in Oxilab Flipbox Authenticated WordPress Options Change vulnerability in Biplob Adhikari's Flipbox plugin <= 2.6.0 at WordPress. | 7.2 |
2022-07-25 | CVE-2022-34965 | Openteknik | Unrestricted Upload of File with Dangerous Type vulnerability in Openteknik Open Source Social Network 6.3 OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component /ossn/administrator/com_installer. | 7.2 |
2022-07-26 | CVE-2022-1651 | Linux | Memory Leak vulnerability in Linux Kernel A memory leak flaw was found in the Linux kernel in acrn_dev_ioctl in the drivers/virt/acrn/hsm.c function in how the ACRN Device Model emulates virtual NICs in VM. | 7.1 |
2022-07-26 | CVE-2022-1671 | Linux Netapp | NULL Pointer Dereference vulnerability in multiple products A NULL pointer dereference flaw was found in rxrpc_preparse_s in net/rxrpc/server_key.c in the Linux kernel. | 7.1 |
86 Medium Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2022-07-29 | CVE-2022-34526 | Libtiff Fedoraproject Netapp Debian | Out-of-bounds Write vulnerability in multiple products A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. | 6.5 |
2022-07-28 | CVE-2022-2553 | Clusterlabs Debian Fedoraproject | Improper Authentication vulnerability in multiple products The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. | 6.5 |
2022-07-28 | CVE-2022-2160 | Google Fedoraproject | Race Condition vulnerability in multiple products Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 103.0.5060.53 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from a user's local files via a crafted HTML page. | 6.5 |
2022-07-28 | CVE-2022-36996 | Veritas | Unspecified vulnerability in Veritas products An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). | 6.5 |
2022-07-27 | CVE-2021-46830 | Helpsystems | Path Traversal vulnerability in Helpsystems Goanywhere Managed File Transfer A path traversal vulnerability exists within GoAnywhere MFT before 6.8.3 that utilize self-registration for the GoAnywhere Web Client. | 6.5 |
2022-07-27 | CVE-2022-1858 | Out-of-bounds Read vulnerability in Google Chrome Out of bounds read in DevTools in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to perform an out of bounds memory read via specific user interaction. | 6.5 | |
2022-07-27 | CVE-2022-1862 | Unspecified vulnerability in Google Chrome Inappropriate implementation in Extensions in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass profile restrictions via a crafted HTML page. | 6.5 | |
2022-07-27 | CVE-2022-1867 | Unspecified vulnerability in Google Chrome Insufficient validation of untrusted input in Data Transfer in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to bypass same origin policy via a crafted clipboard content. | 6.5 | |
2022-07-27 | CVE-2022-1868 | Unspecified vulnerability in Google Chrome Inappropriate implementation in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted HTML page. | 6.5 | |
2022-07-27 | CVE-2022-1869 | Type Confusion vulnerability in Google Chrome Type Confusion in V8 in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 6.5 | |
2022-07-27 | CVE-2022-1873 | Exposure of Resource to Wrong Sphere vulnerability in Google Chrome Insufficient policy enforcement in COOP in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to leak cross-origin data via a crafted HTML page. | 6.5 | |
2022-07-27 | CVE-2022-36888 | Jenkins | Missing Authorization vulnerability in Jenkins Hashicorp Vault A missing permission check in Jenkins HashiCorp Vault Plugin 354.vdb_858fd6b_f48 and earlier allows attackers with Overall/Read permission to obtain credentials stored in Vault with attacker-specified path and keys. | 6.5 |
2022-07-27 | CVE-2022-36894 | Jenkins | Unspecified vulnerability in Jenkins Clif Performance Testing An arbitrary file write vulnerability in Jenkins CLIF Performance Testing Plugin 64.vc0d66de1dfb_f and earlier allows attackers with Overall/Read permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content. | 6.5 |
2022-07-27 | CVE-2022-36896 | Jenkins | Missing Authorization vulnerability in Jenkins Compuware Source Code Download for Endevor, Pds, and Ispw 2.0.12 A missing permission check in Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins. | 6.5 |
2022-07-27 | CVE-2022-36901 | Jenkins | Insufficiently Protected Credentials vulnerability in Jenkins Http Request Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. | 6.5 |
2022-07-27 | CVE-2022-36906 | Jenkins | Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Openshift Deployer A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password. | 6.5 |
2022-07-27 | CVE-2022-36907 | Jenkins | Missing Authorization vulnerability in Jenkins Openshift Deployer A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password. | 6.5 |
2022-07-27 | CVE-2022-36908 | Jenkins | Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Openshift Deployer A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to check for the existence of an attacker-specified file path on the Jenkins controller file system and to upload a SSH key file from the Jenkins controller file system to an attacker-specified URL. | 6.5 |
2022-07-27 | CVE-2022-36909 | Jenkins | Missing Authorization vulnerability in Jenkins Openshift Deployer A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system and to upload a SSH key file from the Jenkins controller file system to an attacker-specified URL. | 6.5 |
2022-07-27 | CVE-2022-36911 | Jenkins | Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Openstack Heat 1.5 A cross-site request forgery (CSRF) vulnerability in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers to connect to an attacker-specified URL. | 6.5 |
2022-07-27 | CVE-2022-24406 | Open Xchange | Use of Insufficiently Random Values vulnerability in Open-Xchange OX APP Suite 7.10.5/7.10.6 OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls. | 6.5 |
2022-07-26 | CVE-2022-1482 | Out-of-bounds Write vulnerability in Google Chrome Inappropriate implementation in WebGL in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 6.5 | |
2022-07-26 | CVE-2022-1497 | Origin Validation Error vulnerability in Google Chrome Inappropriate implementation in Input in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to spoof the contents of cross-origin websites via a crafted HTML page. | 6.5 | |
2022-07-26 | CVE-2022-1500 | Improper Input Validation vulnerability in Google Chrome Insufficient data validation in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass content security policy via a crafted HTML page. | 6.5 | |
2022-07-26 | CVE-2022-1501 | Exposure of Resource to Wrong Sphere vulnerability in Google Chrome Inappropriate implementation in iframe in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page. | 6.5 | |
2022-07-25 | CVE-2022-35288 | IBM | Unspecified vulnerability in IBM Security Verify Information Queue 10.0.2 IBM Security Verify Information Queue 10.0.2 could allow a user to obtain sensitive information that could be used in further attacks against the system. | 6.5 |
2022-07-25 | CVE-2022-1551 | Smartypantsplugins | Forced Browsing vulnerability in Smartypantsplugins SP Project & Document Manager The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files. | 6.5 |
2022-07-28 | CVE-2022-2164 | Google Fedoraproject | Inappropriate implementation in Extensions API in Google Chrome prior to 103.0.5060.53 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted HTML page. | 6.3 |
2022-07-26 | CVE-2022-1499 | Incorrect Authorization vulnerability in Google Chrome Inappropriate implementation in WebAuthentication in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass same origin policy via a crafted HTML page. | 6.3 | |
2022-07-25 | CVE-2022-34573 | Wavlink | Forced Browsing vulnerability in Wavlink Wifi-Repeater Firmware Rpta277W.M4300.01.Gd.2017Sep19 An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to arbitrarily configure device settings via accessing the page mb_wifibasic.shtml. | 6.3 |
2022-07-28 | CVE-2016-3709 | Xmlsoft | Cross-site Scripting vulnerability in Xmlsoft Libxml2 Possible cross-site scripting vulnerability in libxml after commit 960f0e2. | 6.1 |
2022-07-27 | CVE-2022-36922 | Jenkins | Cross-site Scripting vulnerability in Jenkins Lucene-Search 370.V62A5F618Cd3A Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page, resulting in a reflected cross-site scripting (XSS) vulnerability. | 6.1 |
2022-07-25 | CVE-2022-35651 | Moodle Redhat Fedoraproject | Cross-site Scripting vulnerability in multiple products A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. | 6.1 |
2022-07-25 | CVE-2022-35652 | Moodle Fedoraproject | Open Redirect vulnerability in multiple products An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. | 6.1 |
2022-07-25 | CVE-2022-35653 | Moodle Fedoraproject Redhat | Cross-site Scripting vulnerability in multiple products A reflected XSS issue was identified in the LTI module of Moodle. | 6.1 |
2022-07-25 | CVE-2022-34572 | Wavlink | Forced Browsing vulnerability in Wavlink Wifi-Repeater Firmware Rpta277W.M4300.01.Gd.2017Sep19 An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the telnet password via accessing the page tftp.txt. | 5.7 |
2022-07-25 | CVE-2022-34574 | Wavlink | Forced Browsing vulnerability in Wavlink Wifi-Repeater Firmware Rpta277W.M4300.01.Gd.2017Sep19 An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing Tftpd32.ini. | 5.7 |
2022-07-28 | CVE-2022-34009 | Fossil SCM | Cross-site Scripting vulnerability in Fossil-Scm Fossil 2.18 Fossil 2.18 on Windows allows attackers to cause a denial of service (daemon crash) via an XSS payload in a ticket. | 5.5 |
2022-07-27 | CVE-2022-34529 | Wasm3 Project | Out-of-bounds Read vulnerability in Wasm3 Project Wasm3 0.5.0 WASM3 v0.5.0 was discovered to contain a segmentation fault via the component Compile_Memory_CopyFill. | 5.5 |
2022-07-27 | CVE-2022-36879 | Linux Debian Netapp | An issue was discovered in the Linux kernel through 5.18.14. | 5.5 |
2022-07-27 | CVE-2022-34612 | Rizin | Integer Overflow or Wraparound vulnerability in Rizin Rizin v0.4.0 and below was discovered to contain an integer overflow via the function get_long_object(). | 5.5 |
2022-07-26 | CVE-2022-29960 | Emerson | Use of Hard-coded Credentials vulnerability in Emerson Openbsi 5.9 Emerson OpenBSI through 2022-04-29 uses weak cryptography. | 5.5 |
2022-07-26 | CVE-2022-29964 | Emerson | Use of Hard-coded Credentials vulnerability in Emerson products The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. | 5.5 |
2022-07-26 | CVE-2022-29965 | Emerson | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Emerson products The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. | 5.5 |
2022-07-26 | CVE-2021-33437 | Cesanta | Memory Leak vulnerability in Cesanta MJS An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). | 5.5 |
2022-07-29 | CVE-2022-35629 | Rapid7 | Authentication Bypass by Spoofing vulnerability in Rapid7 Velociraptor Due to a bug in the handling of the communication between the client and server, it was possible for one client, already registered with their own client ID, to send messages to the server claiming to come from another client ID. | 5.4 |
2022-07-29 | CVE-2022-2579 | Garage Management System Project | Cross-site Scripting vulnerability in Garage Management System Project Garage Management System 1.0 A vulnerability, which was classified as problematic, was found in SourceCodester Garage Management System 1.0. | 5.4 |
2022-07-28 | CVE-2022-29360 | Rainloop | Cross-site Scripting vulnerability in Rainloop Webmail The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message. | 5.4 |
2022-07-28 | CVE-2022-34140 | Feehi | Cross-site Scripting vulnerability in Feehi CMS 2.1.1 A stored cross-site scripting (XSS) vulnerability in /index.php?r=site%2Fsignup of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username field. | 5.4 |
2022-07-27 | CVE-2022-36902 | Jenkins | Cross-site Scripting vulnerability in Jenkins Dynamic Extended Choice Parameter 1.0.0/1.0.1 Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | 5.4 |
2022-07-27 | CVE-2022-36905 | Jenkins | Cross-site Scripting vulnerability in Jenkins Maven Metadata 2.2 Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact versions parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | 5.4 |
2022-07-27 | CVE-2022-36910 | Jenkins | Missing Authorization vulnerability in Jenkins Lucene-Search 370.V62A5F618Cd3A Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to reindex the database and to obtain information about jobs otherwise inaccessible to them. | 5.4 |
2022-07-27 | CVE-2022-36884 | Jenkins | Missing Authentication for Critical Function vulnerability in Jenkins GIT The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository. | 5.3 |
2022-07-27 | CVE-2022-36885 | Jenkins | Information Exposure Through Discrepancy vulnerability in Jenkins Github Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature. | 5.3 |
2022-07-25 | CVE-2022-0594 | Shareaholic | Incorrect Authorization vulnerability in Shareaholic The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action, available to unauthenticated (in v < 9.7.5) and author+ (in v9.7.5) users, allowing them to call it and retrieve various information such as the list of active plugins, various version like PHP, cURL, WP etc. | 5.3 |
2022-07-28 | CVE-2022-35882 | Gsplugins | Cross-site Scripting vulnerability in Gsplugins GS Testimonial Slider Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress. | 4.8 |
2022-07-25 | CVE-2022-2239 | Emarketdesign | Unspecified vulnerability in Emarketdesign Request a Quote The Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | 4.8 |
2022-07-28 | CVE-2022-30314 | Honeywell | Use of Hard-coded Credentials vulnerability in Honeywell Safety Manager Firmware Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded Credentials. | 4.6 |
2022-07-28 | CVE-2022-30320 | Honeywell | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Honeywell Saia PG5 Controls Suite Saia Burgess Controls (SBC) PCD through 2022-05-06 uses a Broken or Risky Cryptographic Algorithm. | 4.3 |
2022-07-28 | CVE-2022-2479 | Improper Input Validation vulnerability in Google Chrome Insufficient validation of untrusted input in File in Google Chrome on Android prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious app to obtain potentially sensitive information from internal file directories via a crafted HTML page. | 4.3 | |
2022-07-28 | CVE-2022-2165 | Google Fedoraproject | Insufficient data validation in URL formatting in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. | 4.3 |
2022-07-27 | CVE-2022-1871 | Unspecified vulnerability in Google Chrome Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass file system policy via a crafted HTML page. | 4.3 | |
2022-07-27 | CVE-2022-1872 | Unspecified vulnerability in Google Chrome Insufficient policy enforcement in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass downloads policy via a crafted HTML page. | 4.3 | |
2022-07-27 | CVE-2022-1875 | Exposure of Resource to Wrong Sphere vulnerability in Google Chrome Inappropriate implementation in PDF in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to leak cross-origin data via a crafted HTML page. | 4.3 | |
2022-07-27 | CVE-2022-36886 | Jenkins | Cross-Site Request Forgery (CSRF) vulnerability in Jenkins External Monitor JOB Type A cross-site request forgery (CSRF) vulnerability in Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier allows attackers to create runs of an external job. | 4.3 |
2022-07-27 | CVE-2022-36887 | Jenkins | Cross-Site Request Forgery (CSRF) vulnerability in Jenkins JOB Configuration History A cross-site request forgery (CSRF) vulnerability in Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier allows attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations. | 4.3 |
2022-07-27 | CVE-2022-36890 | Jenkins | Path Traversal vulnerability in Jenkins Deployer Framework Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, allowing attackers with Item/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. | 4.3 |
2022-07-27 | CVE-2022-36891 | Jenkins | Missing Authorization vulnerability in Jenkins Deployer Framework A missing permission check in Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier allows attackers with Item/Read permission but without Deploy Now/Deploy permission to read deployment logs. | 4.3 |
2022-07-27 | CVE-2022-36892 | Jenkins | Missing Authorization vulnerability in Jenkins Rhnpush-Plugin Jenkins rhnpush-plugin Plugin 0.5.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. | 4.3 |
2022-07-27 | CVE-2022-36893 | Jenkins | Missing Authorization vulnerability in Jenkins Rpmsign-Plugin Jenkins rpmsign-plugin Plugin 0.5.0 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. | 4.3 |
2022-07-27 | CVE-2022-36895 | Jenkins | Missing Authorization vulnerability in Jenkins Compuware Topaz Utilities A missing permission check in Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins. | 4.3 |
2022-07-27 | CVE-2022-36897 | Jenkins | Missing Authorization vulnerability in Jenkins Compuware Xpediter Code Coverage A missing permission check in Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins. | 4.3 |
2022-07-27 | CVE-2022-36898 | Jenkins | Missing Authorization vulnerability in Jenkins Compuware Ispw Operations A missing permission check in Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins. | 4.3 |
2022-07-27 | CVE-2022-36903 | Jenkins | Missing Authorization vulnerability in Jenkins Repository Connector A missing permission check in Jenkins Repository Connector Plugin 2.2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | 4.3 |
2022-07-27 | CVE-2022-36904 | Jenkins | Missing Authorization vulnerability in Jenkins Repository Connector Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. | 4.3 |
2022-07-27 | CVE-2022-36912 | Jenkins | Missing Authorization vulnerability in Jenkins Openstack Heat 1.5 A missing permission check in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. | 4.3 |
2022-07-27 | CVE-2022-36913 | Jenkins | Missing Authorization vulnerability in Jenkins Openstack Heat 1.5 Jenkins Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. | 4.3 |
2022-07-27 | CVE-2022-36914 | Jenkins | Missing Authorization vulnerability in Jenkins Files Found Trigger Jenkins Files Found Trigger Plugin 1.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. | 4.3 |
2022-07-27 | CVE-2022-36915 | Jenkins | Missing Authorization vulnerability in Jenkins Android Signing 2.2.5 Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. | 4.3 |
2022-07-27 | CVE-2022-36917 | Jenkins | Missing Authorization vulnerability in Jenkins Google Cloud Backup 0.6 A missing permission check in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers with Overall/Read permission to request a manual backup. | 4.3 |
2022-07-27 | CVE-2022-36918 | Jenkins | Missing Authorization vulnerability in Jenkins Buckminster 1.1.1 Jenkins Buckminster Plugin 1.1.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. | 4.3 |
2022-07-27 | CVE-2022-36919 | Jenkins | Missing Authorization vulnerability in Jenkins Coverity A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | 4.3 |
2022-07-27 | CVE-2022-36880 | Webmin | Cross-site Scripting vulnerability in Webmin Usermin The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message. | 4.3 |
2022-07-26 | CVE-2022-1495 | Authentication Bypass by Spoofing vulnerability in Google Chrome Incorrect security UI in Downloads in Google Chrome on Android prior to 101.0.4951.41 allowed a remote attacker to spoof the APK downloads dialog via a crafted HTML page. | 4.3 | |
2022-07-26 | CVE-2022-1498 | Exposure of Resource to Wrong Sphere vulnerability in Google Chrome Inappropriate implementation in HTML Parser in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page. | 4.3 | |
2022-07-26 | CVE-2022-1637 | Exposure of Resource to Wrong Sphere vulnerability in Google Chrome Inappropriate implementation in Web Contents in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to leak cross-origin data via a crafted HTML page. | 4.3 |
0 Low Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|