Weekly Vulnerabilities Reports > August 8 to 14, 2022

Shield is an authentication and authorization framework for CodeIgniter 4.

Use after free in Omnibox in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Use after free in Safe Browsing in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Use after free in Managed devices API in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enable a specific Enterprise policy to potentially exploit heap corruption via a crafted HTML page.

Use after free in Tab Strip in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.

Use after free in Overview Mode in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.

Use after free in Nearby Share in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.

Use after free in Input in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enage in specific user interactions to potentially exploit heap corruption via specific UI interactions.

Use after free in Sign-In Flow in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Use after free in Extensions API in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific UI interactions.

Use after free in WebUI in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.

Use after free in Extensions in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific UI interactions.

Use after free in Offline in Google Chrome on Android prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.

Heap buffer overflow in PDF in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted PDF file.

In Wi-Fi, there is a permissions bypass.

In Bluetooth, there is a possible out of bounds write due to an integer overflow.

In Bluetooth, there is a possible out of bounds write due to an integer overflow.

A potential arbitrary code execution and a denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71.

A potential arbitrary code execution and a denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71.

A vulnerability was found in SourceCodester Gym Management System.

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes that lead to remote code execution.

In l2cble_process_sig_cmd of l2c_ble.cc, there is a possible out of bounds write due to a missing bounds check.

In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy.

VMware vRealize Operations contains an information disclosure vulnerability.

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: web_pskValue, wl_Method, wlan_ssid, EncrypType, rwan_ip, rwan_mask, rwan_gateway, ppp_username, ppp_passwd and ppp_setver, which leads to command injection in page /wizard_router_mesh.shtml.

Dell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI.

The ftlserver component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, and TIBCO FTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a privilege escalation on the affected ftlserver.

The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.

A vulnerability classified as critical has been found in SourceCodester Gym Management System.

A vulnerability was found in SourceCodester Gym Management System.

A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.

A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71.

A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71.

Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service.

Missing Authorization in GitHub repository openemr/openemr prior to 7.0.0.1.

XML external entity injection(XXE) is a vulnerability that allows an attacker to interfere with an application's processing of XML data.

SAP BusinessObjects Business Intelligence Platform (Open Document) - versions 420, 430, allows an unauthenticated attacker to retrieve sensitive information plain text over the network.

An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to delete arbitrary files from an affected system.

A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.

In Bluetooth, there is a possible way to bypass compiler exploit mitigations due to a configuration error.

In RestrictionsManager, there is a possible way to send a broadcast that should be restricted to system apps due to a permissions bypass.

In PermissionController, there is a possible way to grant some permissions without user consent due to misleading or insufficient UI.

In Keyguard, there is a missing permission check.

In Core, there is a possible way to start an activity from the background due to a missing permission check.

In AppWidget, there is a possible way to start an activity from the background due to a missing permission check.

In Connectivity, there is a possible bypass the restriction of starting activity from background due to a logic error in the code.

In Settings, there is a possible way to bypass factory reset protections due to a logic error in the code.

In Settings, there is a possible way to bypass factory reset protections due to a logic error in the code.

In DreamServices, there is a possible way to launch arbitrary protected activities due to a confused deputy.

In Media, there is a possible code execution due to a use after free.

In Wifi, there is a possible way to enable Wifi without permissions due to a missing permission check.

In the Framework, there is a possible way to enable a work profile without user consent due to a tapjacking/overlay attack.

A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71.

In several functions of mali_gralloc_reference.cpp, there is a possible arbitrary code execution due to a missing bounds check.

In WindowManager, there is a possible bypass of the restrictions for starting activities from the background due to an incorrect UID/permission check.

In Settings, there is a possible way to connect to an open network bypassing DISALLOW_CONFIG_WIFI restriction due to a logic error in the code.

In Messaging, there is a possible way to attach files to a message without proper access checks due to improper input validation.

Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel

In AllocateInternalBuffers of g3aa_buffer_allocator.cc, there is a possible out of bounds write due to an integer overflow.

Adobe Illustrator versions 26.3.1 (and earlier) and 25.4.6 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.

Adobe Illustrator versions 26.3.1 (and earlier) and 25.4.6 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user.

Adobe FrameMaker versions 2019 Update 8 (and earlier) and 2020 Update 4 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user.

In Task.java, there is a possible escalation of privilege due to a confused deputy.

In updateState of LocationServicesWifiScanningPreferenceController.java, there is a possible admin restriction bypass due to a missing permission check.

In WifiScanningPreferenceController and BluetoothScanningPreferenceController, there is a possible admin restriction bypass due to a missing permission check.

In onDefaultNetworkChanged of Vpn.java, there is a possible way to disable VPN due to a logic error in the code.

In shouldAllowFgsWhileInUsePermissionLocked of ActiveServices.java, there is a possible way to start foreground service from background due to improper input validation.

In setChecked of SecureNfcPreferenceController.java, there is a missing permission check.

A Stack-based Buffer Overflow Vulnerability in Autodesk 3ds Max 2022, 2021, and 2020 may lead to code execution through the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer when parsing ActionScript Byte Code files.

Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.

A vulnerability in the regex module used by the signature database load module of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an authenticated, local attacker to crash ClamAV at database load time, and possibly gain code execution.

All versions of package mc-kill-port are vulnerable to Arbitrary Command Execution via the kill function, due to missing sanitization of the port argument.

The ftlserver component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, TIBCO eFTL - Enterprise Edition, and TIBCO eFTL - Enterprise Edition contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to obtain user credentials to the affected system.

In Settings, there is a possible way to bypass factory reset protections due to a sandbox escape.

OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization.

In hostapd, there is a possible insecure configuration due to an insecure default value.

A stack overflow vulnerability exists in /goform/wifiSSIDget in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of service (DoS) via the index parameter.

A stack overflow vulnerability exists in /goform/WifiMacFilterGet in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of service (DoS) via the index parameter.

A stack overflow vulnerability exists in /goform/wifiSSIDset in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of service (DoS) via the index parameter.

A stack overflow vulnerability exists in /goform/WifiMacFilterSet in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of service (DoS) via the index parameter.

An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0.

Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling directories via apoc.log.stream.

In Bluetooth, there is a possible out of bounds write due to a missing bounds check.

In Media, there is a possible out of bounds read due to a heap buffer overflow.

Product: AndroidVersions: Android kernelAndroid ID: A-215730643References: N/A

In LteRrcNrProAsnDecode of LteRrcNr_Codec.c, there is a possible out of bounds read due to a missing bounds check.

Product: AndroidVersions: Android kernelAndroid ID: A-212625740References: N/A

In SAEMM_RetrievEPLMNList of SAEMM_ContextManagement.c, there is a possible out of bounds read due to a missing bounds check.

Product: AndroidVersions: Android kernelAndroid ID: A-205714161References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-184676385References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-210916981References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-204782372References: N/A

The Gumstix Overo SBC on the VSKS board through 2022-08-09, as used on the Orlan-10 and other platforms, allows unrestricted remapping of the NOR flash memory containing the bitstream for the FPGA.

TEE_Malloc in Samsung mTower through 0.3.0 allows a trusted application to achieve Excessive Memory Allocation via a large len value, as demonstrated by a Numaker-PFM-M2351 TEE kernel crash.

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs.

The diag-router module has a vulnerability in intercepting excessive long and short instructions.

The Settings application has a vulnerability of bypassing the out-of-box experience (OOBE).

The Settings application has an argument injection vulnerability.

Permission control vulnerability in the network module.

The chinadrm module has an out-of-bounds read vulnerability.

The recovery module has a vulnerability of bypassing the verification of an update package before use.

The th_read() function doesn’t free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory leak.

The th_read() function doesn’t free a variable t->th_buf.gnu_longname after allocating memory, which may cause a memory leak.

The My HUAWEI app has a defect in the design.

The video framework has the memory overwriting vulnerability caused by addition overflow.

Vulnerability of writing data to an arbitrary address in the HW_KEYMASTER module.

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the aerdl.dll component used in certain WithSecure products unpacker function crashes which leads to scanning engine crash.

Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.

Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.

Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.

Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.

VMware vRealize Operations contains an authentication bypass vulnerability.

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

Under certain conditions SAP Authenticator for Android allows an attacker to access information which would otherwise be restricted.

A vulnerability in the handling of RSA keys on devices running Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve an RSA private key.

Dell Wyse Management Suite 3.6.1 and below contains Information Disclosure in Devices error pages.

IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a stack trace.

A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions), CP-8021 MASTER MODULE (All versions), CP-8022 MASTER MODULE WITH GPRS (All versions).

A vulnerability has been identified in Simcenter STAR-CCM+ (All versions only if the Power-on-Demand public license server is used).

A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V13.0.0.10), Teamcenter V13.1 (All versions < V13.1.0.10), Teamcenter V13.2 (All versions < V13.2.0.9), Teamcenter V13.3 (All versions < V13.3.0.5), Teamcenter V14.0 (All versions < V14.0.0.2).

Affected devices do not properly handle the renegotiation of SSL/TLS parameters.

It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU.

It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.

It is possible to crash (panic) an application by providing a corrupted data to be read.

wolfSSL before 5.4.0 allows remote attackers to cause a denial of service via DTLS because a check for return-routability can be skipped.

The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php.

The WSM Downloader WordPress plugin through 1.4.0 allows only specific popular websites to download images/files from, this can be bypassed due to the lack of good "link" parameter validation

Zammad 5.2.0 suffers from Incorrect Access Control.

In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests for a known account to cause Denial Of Service by many generated emails which would also spam the victim.

A vulnerability was found in SourceCodester Simple E-Learning System.

A vulnerability was found in SourceCodester Simple E-Learning System.

A vulnerability was found in SourceCodester Simple E-Learning System.

A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71.

A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71.

A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71.

A local disclosure of sensitive information and a local unauthorized data modification vulnerability were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71.

In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Configuration > Targets > Target Name" targets.cgi screen.

VMware vRealize Operations contains a privilege escalation vulnerability.

In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Hidden system command web page.

IBM Workload Scheduler 9.4 and 9.5 could allow a local user to overwrite key system files which would cause the system to crash.

In stealReceiveChannel of EventThread.cpp, there is a possible way to interfere with process communication due to a race condition.

In Bluetooth, there is a possible out of bounds write due to an incorrect bounds check.

In Bluetooth, there is a possible out of bounds write due to a missing bounds check.

Prior Dell BIOS versions contain an Improper Authentication vulnerability.

In Camera Provider HAL, there is a possible memory corruption due to a use after free.

In KeyChain, there is a possible spoof keychain chooser activity request due to improper input validation.

A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71.

A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71.

Dm-verity is used for extending root-of-trust to root filesystems.

In bdi_put and bdi_unregister of backing-dev.c, there is a possible memory corruption due to a use after free.

In ioctl_dpm_clk_update of lwis_ioctl.c, there is a possible out of bounds write due to an integer overflow.

In construct_transaction of lwis_ioctl.c, there is a possible out of bounds write due to an integer overflow.

In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input validation.

In exynos5_i2c_irq of (TBD), there is a possible out of bounds write due to a use after free.

In trusty_log_seq_start of trusty-log.c, there is a possible use after free due to improper locking.

In TBD of keymaster_ipc.cpp, there is a possible to force gatekeeper, fingerprint, and faceauth to use a known HMAC key.

In lwis_buffer_alloc of lwis_buffer.c, there is a possible arbitrary code execution due to a use after free.

In (TBD) of (TBD), there is a possible out of bounds write due to kernel stack overflow.

Out of bounds read in Dawn in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Insufficient policy enforcement in Background Fetch in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Side-channel information leakage in Keyboard input in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.

Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Insufficient validation of untrusted input in Internals in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to bypass download restrictions via a malicious file .

In Gitea before 1.16.9, it was possible for users to add existing issues to projects.

In Bluetooth, there is a possible cleanup failure due to an uncaught exception.

In Bluetooth, there is a possible out of bounds read due to a heap buffer overflow.

In Bluetooth, there is a possible crash due to a missing null check.

In Bluetooth, there are possible process crashes due to dereferencing a null pointer.

In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

In updateAudioTrackInfoFromESDS_MPEG4Audio of MPEG4Extractor.cpp, there is a possible out of bounds read due to an incorrect bounds check.

Linux deployments of StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.2 deployed with a Linux kernel version less than 4.7.0 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to view limited metrics information and modify alert email recipients and content.

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.

IBM Spectrum Scale Data Access Services (DAS) 5.1.3.1 could allow an authenticated user to insert code which could allow the attacker to manipulate cluster resources due to excessive permissions.

Dell Wyse Management Suite 3.6.1 and below contains a Sensitive Data Exposure vulnerability.

Dell Wyse Management Suite 3.6.1 and below contains an Improper Access control vulnerability in UI.

Dell Wyse Management Suite 3.6.1 and below contains an improper access control vulnerability.

Dell Wyse Management Suite 3.6.1 and below contains a Session Fixation vulnerability.

WMS 3.7 contains a Path Traversal Vulnerability in Device API.

Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1.

Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame hijacking attack against a user of the web interface.

Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1.

The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discy_update_options action, allowing any logged in users (with privileges as low as Subscriber,) to change Theme options by sending a crafted POST request.

The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's username includes the admin

In Zammad 5.2.0, customers who have secondary organizations assigned were able to see all organizations of the system rather than only those to which they are assigned.

A vulnerability was found in SourceCodester Company Website CMS and classified as critical.

In the Audio HAL, there is a possible out of bounds write due to a race condition.

In dm_bow_dtr and related functions of dm-bow.c, there is a possible use after free due to a race condition.

In st21nfc_loc_set_polaritymode of fc/st21nfc.c, there is a possible use after free due to a race condition.

BookWyrm is a social network for tracking your reading, talking about books, writing reviews, and discovering what to read next.

A vulnerability, which was classified as problematic, has been found in SourceCodester Gym Management System.

In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine.

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack

The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.11.0 are susceptible to a URL parsing vulnerability.

A vulnerability classified as problematic was found in SourceCodester Library Management System.

A vulnerability was found in SourceCodester Apartment Visitor Management System.

A vulnerability classified as problematic has been found in SourceCodester Online Admission System.

A vulnerability was found in SourceCodester Simple Online Book Store System.

A vulnerability in the VPN web client services component of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct browser-based attacks against users of an affected device.

Dell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in EndUserSummary page.

A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting attack against a user of the interface.

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (RXSS) vulnerability in the TeamManagement.jspa endpoint.

Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.

Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.

A vulnerability was found in SourceCodester Company Website CMS.

A Cross-site scripting (XSS) vulnerability in json search parse and the json response in wrteam.in, eShop - Multipurpose Ecommerce Store Website version 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the get_products?search parameter.

In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a stored XSS vulnerability.

The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

A vulnerability classified as problematic was found in SourceCodester Simple E-Learning System.

VMware Workstation (16.x prior to 16.2.4) contains an unprotected storage of credentials vulnerability.

An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0.

Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” and “Zen 3” that use simultaneous multithreading (SMT).

An out-of-bounds read vulnerability exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker to induce an information disclosure issue in the context of the current user.

An out-of-bounds read vulnerability exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker to induce an information disclosure issue in the context of the current user.

In Telephony, there is a possible leak of ICCID and EID due to a missing permission check.

In the Phone app, there is a possible crash loop due to resource exhaustion.

In ActivityManager, there is a way to read process state for other users due to a missing permission check.

In Content, there is a possible way to learn gmail account name on the device due to a permissions bypass.

In PermissionController, there is a possible misunderstanding about the default SMS application's permission set due to misleading text.

In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In Accounts, there is a possible way to write sensitive information to the system log due to insufficient log filtering.

In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In Telephony, there is a possible information disclosure due to a missing permission check.

In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In AppSearchManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In AppSearchManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In PackageInstaller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In Midi, there is a possible way to learn about private midi devices due to a permissions bypass.

In AppOpsService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In LauncherApps, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In Content, there is a possible way to learn about an account present on the device due to a missing permission check.

In ContentService, there is a possible way to check if an account exists on the device due to a missing permission check.

In ContentService, there is a possible way to check if an account exists on the device due to a missing permission check.

In ContentService, there is a possible way to check if an account exists on the device due to a missing permission check.

In ContentService, there is a possible way to check if the given account exists on the device due to a missing permission check.

In Content, there is a possible way to check if the given account exists on the device due to a missing permission check.

In Content, there is a possible way to check if an account exists on the device due to a missing permission check.

In ContentService, there is a possible way to determine if an account is on the device without GET_ACCOUNTS permission due to a missing permission check.

In Content, there is a possible way to determinate the user's account due to side channel information disclosure.

In WifiP2pManager, there is a possible toobtain WiFi P2P MAC address without user consent due to missing permission check.

In SystemUI, there is a possible way to unexpectedly enable the external speaker due to a logic error in the code.

In PackageManager, there is a possible installed package disclosure due to a missing permission check.

In PackageManager, there is a possible package installation disclosure due to a missing permission check.

In Framework, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In Telephony, there is a possible disclosure of SIM identifiers due to a missing permission check.

In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In ConnectivityService, there is a possible bypass of network permissions due to a missing permission check.

In Settings, there is a possible way to determine whether an app is installed without query permissions, due to side channel information disclosure.

In PackageManager, there is a possible way to get information about installed packages ignoring limitations introduced in Android 11 due to a missing permission check.

In USB Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In Telephony, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.

In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to trick the victim to grant notification access to the wrong app due to improper input validation.

In addProviderRequestListener of LocationManagerService.java, there is a possible way to learn which packages request location information due to a missing permission check.

In onSaveRingtone of DefaultRingtonePreference.java, there is a possible inappropriate file read due to improper input validation.

In get of PacProxyService.java, there is a possible system service crash due to improper input validation.

In writeToParcel of SurfaceControl.cpp, there is a possible information disclosure due to uninitialized data.

In ImageMagick, a crafted file could trigger an assertion failure when a call to WriteImages was made in MagickWand/operation.c, due to a NULL image list.

Zoom On-Premise Meeting Connector MMR before version 4.8.129.20220714 contains an improper access control vulnerability.

Zoom On-Premise Meeting Connector MMR before version 4.8.129.20220714 contains an improper access control vulnerability.

A vulnerability, which was classified as problematic, has been found in SourceCodester Company Website CMS.

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.1.

An issue was discovered in EyouCMS 1.5.8.

Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame hijacking attack against a user of the web interface.

Improper Restriction of Rendered UI Layers or Frames in GitHub repository openemr/openemr prior to 7.0.0.1.

Cross-site Scripting (XSS) - DOM in GitHub repository openemr/openemr prior to 7.0.0.1.

The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users with a role as low as subscriber to change them, and use that to conduct Stored Cross-Site Scripting attack due to the lack of escaping in them as well.

The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript into the description.

Nextcloud Talk is a video and audio conferencing app for Nextcloud.

A vulnerability classified as problematic has been found in SourceCodester Gym Management System.

Dell Wyse Management Suite 3.6.1 and below contains an Improper Access control vulnerability with which an attacker with no access to create rules could potentially exploit this vulnerability and create rules.

Dell Wyse Management Suite 3.6.1 and below contains an Improper Access control vulnerability in UI.

In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases

In Companion, there is a possible way to keep a service running with elevated importance without showing foreground service notification due to improper input validation.

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to obtain sensitive Azure bot credential information.

A vulnerability in the External RESTful Services (ERS) API of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to obtain sensitive information.

The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from.

A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the title of a rule node.

A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the description of a rule node.

A stored cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "start_date" Parameter

A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_date" Parameter

A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_time" Parameter.

A cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "end_date" Parameter

Affected devices do not properly sanitize data introduced by an user when rendering the web interface.

The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

The Rough Chart WordPress plugin through 1.0.0 does not properly escape chart data label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

The mTouch Quiz WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

The Auto More Tag WordPress plugin through 4.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

The Better Tag Cloud WordPress plugin through 0.99.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

The DW Promobar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

The Google Maps Anywhere WordPress plugin through 1.2.6.3 does not sanitise and escape any of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

The WP DS Blog Map WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators.

In Settings, there is a possible way to bypass factory reset permissions due to a permissions bypass.

In SettingsProvider, there is a possible way to read or change the default ringtone due to a missing permission check.

In Core Utilities, there is a possible log information disclosure.

Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted HTML page.

VMware vRealize Operations contains an information disclosure vulnerability.

In Bluetooth, there is a possible way to connect or disconnect bluetooth devices without user awareness due to a missing permission check.

In Bluetooth, there is a possible way to pair a display only device without PIN confirmation due to a logic error in the code.

In ActivityManager, there is a possible way to check another process's capabilities due to a missing permission check.

In bluetooth, there is a possible way to enable or disable bluetooth connection without user consent due to a missing permission check.

In MMSProvider, there is a possible read of protected data due to improper input validationSQL injection.

In ContentService, there is a possible disclosure of available account types due to a missing permission check.

In AlarmManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In PackageInstaller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In Telecomm, there is a possible disclosure of registered self managed phone accounts due to a missing permission check.

In Telecomm, there is a possible disclosure of registered self managed phone accounts due to a missing permission check.

In ActivityManager, there is a possible disclosure of installed packages due to a missing permission check.

In ContentResolver, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In PackageInstaller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In ActivityManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In Settings, there is a possible way for an application without permissions to read content of WiFi QR codes due to a missing permission check.

In PackageManager, there is a possible way to determine whether an app is installed due to a missing permission check.

In Wifi Slice, there is a possible way to adjust Wi-Fi settings even when the permission has been disabled due to a missing permission check.

In Settings, there is a possible installed application disclosure due to a missing permission check.

In HierarchicalUri.readFrom of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation.

In Android, there is a possible access of network neighbor table information due to an insecure SEpolicy configuration.

In SELinux policy, there is a possible way of inferring which websites are being opened in the browser due to a missing permission check.

In WiFi, there is a possible disclosure of WiFi password to the end user due to an insecure default value.

In Messaging, there is a possible way to attach a private file to an SMS message due to improper input validation.

In LocaleManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In LocaleManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

In startSync of AbstractThreadedSyncAdapter.java, there is a possible way to access protected content of content providers due to a missing permission check.

Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.

In Wi-Fi, there is a possible way to retrieve the WiFi SSID without location permissions due to a missing permission check.

In WindowManager, there is a possible method to create a recording of the lock screen due to an insecure default value.

In LocationManager, there is a possible way to get location information due to a missing permission check.