3620 matches found
Inductive Automation Ignition
1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Inductive Automation Equipment: Ignition Vulnerability: Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an authenticated attacker with network access to...
fmsports.ca Cross Site Scripting vulnerability OBB-2484303
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
lynhan.hanam.gov.vn Cross Site Scripting vulnerability OBB-2451390
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-1040
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older...
SUSE-SU-2022:0945-1 Security update for bind
This update for bind fixes the following issues: - CVE-2021-25220: Fixed a DNS cache poisoning vulnerability due to loose caching rules bsc1197135...
CVE-2021-40734 Adobe Audition Memory Corruption could lead to Arbitrary code execution
Adobe Audition version 14.4 and earlier is affected by a memory corruption vulnerability when parsing a SVG file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability...
CVE-2022-21828
creationtimestamp| type| source ---|---|--- 2022-03-04 20:30:11+00:00| seen| https://t.me/cibsecurity/38446...
Polkit pkexec Local Privilege Escalation
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Local Privilege Escalation in polkits pkexec', 'Description' = %q A bug exists in the polkit pkexec binary in how it processes arguments. If the...
SUSE SLES12: kernel-livepatch-4_12_14-150_69-default / etc (SUSE-SU-2022:0667-1)
The remote SUSE Linux SLES12 / SLES15 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0667-1 advisory. This update for the Linux Kernel 4.12.14-15069 fixes one issue. The following security issue was fixed: - CVE-2021-0920: Fixed a...
OPENSUSE-SU-2022:0068-1 Security update for shapelib
This update for shapelib fixes the following issues: - CVE-2022-0699: Fixed a Double-free vulnerability in contrib/shpsort.c...
CVE-2021-24898
The EditableTable WordPress plugin through 0.1.4 does not sanitise and escape any of the Table and Column fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2022-0651 WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the currentpagetype parameter found in the /includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain...
CVE-2022-25084
creationtimestamp| type| source ---|---|--- 2022-02-24 18:14:40+00:00| seen| https://t.me/cibsecurity/37991...
Exploit for Code Injection in Exiftool_Project Exiftool
CVE-2021-22204-exiftool Python exploit for the CVE-2021-22204...
CVE-2021-44399
A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot. GetPtzPreset param is not object. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2021-44382
A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a reboot.SetIrLights param is not object. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2021-40408
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13620121102. At 1 or 2, based on DDNS type, the ddns-username variable, that has the value of the userName parameter provided through the SetDdns API, is not validated properly. Th...
CVE-2022-22895
Jerryscript 3.0.0 was discovered to contain a heap-buffer-overflow via ecmautf8stringtonumberbyradix in /jerry-core/ecma/base/ecma-helpers-conversion.c...
AZL-7739 CVE-2022-21363 affecting package mysql for versions less than 8.0.28-1
Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful...