CVE-2022-0421

The Five Star Restaurant Reservations WordPress plugin prior to version 2.4.12 has an authorization flaw that allows unauthenticated users to change the payment status of arbitrary bookings. The issue is exacerbated by insufficient sanitization/escaping, enabling stored XSS against administrators...

CVE-2022-44785

An issue was discovered in Appalti & Contratti 9.12.2. The target web applications are subject to multiple SQL Injection vulnerabilities, some of which executable even by unauthenticated users, as demonstrated by the GetListaEnti.do cfamm parameter...

CVE-2022-38165

Arbitrary file write in F-Secure Policy Manager through 2022-08-10 allows unauthenticated users to write the file with the contents in arbitrary locations on the F-Secure Policy Manager Server...

CVE-2022-38165

Arbitrary file write in F-Secure Policy Manager through 2022-08-10 allows unauthenticated users to write the file with the contents in arbitrary locations on the F-Secure Policy Manager Server...

CVE-2022-38165

The CVE-2022-38165 entry concerns Arbitrary file write in F-Secure Policy Manager (and WithSecure rebrand) prior to 2022-08-10. An unauthenticated attacker could write arbitrary files to arbitrary locations on the Policy Manager Server. Publicly available connected documents corroborate the flaw’...

CVE-2022-3538

The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing unauthenticated users to disable arbitrary plugins...

Cross site request forgery (csrf)

The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing unauthenticated users to disable arbitrary plugins...

Grafana 9.2 < 9.2.4 Race Condition Vulnerability (GHSA-vqc4-mpj8-jxch)

Grafana is prone to a race condition vulnerability Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2022-27233

XML injection in the QuartusR Prime Programmer included in the IntelR Quartus Prime Pro and Standard edition software may allow an unauthenticated user to potentially enable information disclosure via network access...

UBUNTU-CVE-2022-39307

Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the /api/user/password/sent-reset-email URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks...

CVE-2022-39307

Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the /api/user/password/sent-reset-email URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks...

CVE-2022-3481

The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection...

Sql injection

The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection...

CVE-2022-3481 WooCommerce Dropshipping < 4.4 - Unauthenticated SQLi

The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection...

EUVD-2022-42853

The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection...

Rocket.Chat: NoSQL injection in listEmojiCustom method call

Vulnerability description not provided...

WordPress LearnPress Plugin < 4.1.7.2 RCE Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2022-41776

Delta Electronics InfraSuite Device Master versions 00.00.01a and older expose WriteConfiguration without authentication, enabling an attacker to alter user configuration files (e.g., UserListInfo.xml) and potentially change administrative passwords. Multiple sources (NVD, Red Hat CVE page, ZDI a...

CVE-2022-3254

The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading to a SQL injection...

Design/Logic Flaw

The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is present, leadint to remote code execution RCE. To successfully exploit this vulnerability attackers...