CVE-2022-43280

wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr-GetReturnCallDropKeepCount...

MySQL Server DoS

The vulnerability of the MySQL Server component of the database management system exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Cross site request forgery (csrf)

WAYOS LQ09 22.03.17V was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to send crafted requests to the server from the affected device. This vulnerability is exploitable due to a lack of authentication in the component Usbupload.htm...

Integer overflow

GNU oSIP v5.3.0 was discovered to contain an integer overflow via the component osipbodyparseheader...

Default credentials

An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and pages...

psy.c Heap Buffer Overflow DoS

The vulnerability of the barknoisehybridmp function in the psy.c component of the Vorbis multimedia library relates to the issue of writing operations outside of the buffer in memory. Exploiting this vulnerability allows a remote attacker to access confidential data, compromise its integrity, and...

Design/Logic Flaw

An issue in the component postapplogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens...

Cross site request forgery (csrf)

The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using function parameter value as LFI payload...

Arbitrary file deletion

htmly v2.8.1 was discovered to contain an arbitrary file deletion vulnerability via the component \views\backup.html.php...

CVE-2022-34550

Sims v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the component /addNotifyServlet. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the notifyInfo parameter...

CVE-2022-22999

CVE-2022-22999 affects Western Digital My Cloud devices and is described as a cross-site scripting vulnerability that can allow a malicious, elevated-privilege user to inject JavaScript into an authenticated user’s browser, potentially taking control of the session, stealing data, modifying setti...

CVE-2022-32096

Rhonabwy before v1.1.5 was discovered to contain a buffer overflow via the component rjweaesgcmkeyunwrap. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted JWE token...

Design/Logic Flaw

The iTopVPNmini.exe component of iTop VPN 3.2 will try to connect to datastateiTopVPNPipeServer on a loop. An attacker that opened a named pipe with the same name can use it to gain the token of another user by listening for connections and abusing ImpersonateNamedPipeClient...

ColdFusio administrator.cfc Bypass Code Execution

The vulnerability of the administrator.cfc component in the ColdFusion software interface is related to insufficient protection of sensitive data. Exploiting this vulnerability allows an attacker to bypass security restrictions or execute arbitrary code...

MariaDB sql_window Component DoS

The vulnerability of the sql/sqlwindow.cc component in the MariaDB database management system is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

Siebel Core Component Unauthorized Access

The vulnerability of the Loging component of the Siebel Core platform’s Server Framework in the Oracle Siebel CRM system exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information using the HTTP...

CVE-2022-30726

CVE-2022-30726 corresponds to an unprotected DeviceSearchTrampoline component in Samsung SecSettingsIntelligence, enabling local attackers to launch SecSettingsIntelligence activities. Affected: Samsung Mobile/SecSettingsIntelligence (DeviceSearchTrampoline). Root cause: unprotected component exp...

Design/Logic Flaw

74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component \index\controller\Download.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the component /spip.php of Spip Web Framework v3.1.13 and below allows attackers to execute arbitrary web scripts or HTML...

Oracle VM VirtualBox Full Control

The vulnerability of the Core component of the Oracle VM VirtualBox virtualization software for Windows operating systems is related to insufficient testing of input data. Exploiting this vulnerability can allow an attacker to gain full control over the application...