Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-28704 | 1 Rakuten | 1 Casa | 2022-06-22 | 9.0 HIGH | 7.2 HIGH |
| Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to log in with the root privilege and perform an arbitrary operation if the product is in its default settings in which is set to accept SSH connections from the WAN side, and is also connected to the Internet with the authentication information unchanged from the default settings. | |||||
| CVE-2022-22950 | 1 Vmware | 1 Spring Framework | 2022-06-22 | 4.0 MEDIUM | 6.5 MEDIUM |
| n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition. | |||||
| CVE-2022-32741 | 1 Otrs | 1 Otrs | 2022-06-22 | 5.0 MEDIUM | 5.3 MEDIUM |
| Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time. | |||||
| CVE-2022-1985 | 1 Wpdownloadmanager | 1 Wordpress Download Manager | 2022-06-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is due to insufficient input sanitization and output escaping on the 'frameid' parameter found in the ~/src/Package/views/shortcode-iframe.php file. | |||||
| CVE-2022-32740 | 1 Otrs | 1 Otrs | 2022-06-22 | 4.3 MEDIUM | 5.3 MEDIUM |
| A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances. | |||||
| CVE-2022-2061 | 1 Chafa Project | 1 Chafa | 2022-06-22 | 2.1 LOW | 3.3 LOW |
| Heap-based Buffer Overflow in GitHub repository hpjansson/chafa prior to 1.12.0. | |||||
| CVE-2017-20041 | 1 Ucweb | 1 Uc Browser | 2022-06-22 | 4.3 MEDIUM | 6.5 MEDIUM |
| A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title leads to improper restriction of rendered ui layers (URL). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2022-29894 | 1 Strapi | 1 Strapi | 2022-06-22 | 3.5 LOW | 4.8 MEDIUM |
| Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege. | |||||
| CVE-2022-32739 | 1 Otrs | 2 Calendar Resource Planning, Otrs | 2022-06-22 | 5.0 MEDIUM | 5.3 MEDIUM |
| When Secure::DisableBanner system configuration has been disabled and agent shares his calendar via public URL, received ICS file contains OTRS release number. | |||||
| CVE-2022-24396 | 1 Sap | 1 Simple Diagnostics Agent | 2022-06-21 | 7.2 HIGH | 7.8 HIGH |
| The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localhost on http port 3005. Due to lack of authentication checks, an attacker could access administrative or other privileged functionalities and read, modify, or delete sensitive information and configurations. | |||||
| CVE-2022-22547 | 1 Sap | 1 Simple Diagnostics Agent | 2022-06-21 | 5.0 MEDIUM | 7.5 HIGH |
| Simple Diagnostics Agent - versions 1.0 (up to version 1.57.), allows an attacker to access information which would otherwise be restricted via a random port 9000-65535. This allows information gathering which could be used exploit future open-source security exploits. | |||||
| CVE-2022-1659 | 1 Artbees | 1 Jupiterx | 2022-06-21 | 7.5 HIGH | 7.3 HIGH |
| Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the includes/condition/class-condition-manager.php file by sending the desired function to call in the sub_action parameter. This can be used to view site configuration and logged-in users, modify post conditions, or perform a denial of service attack. | |||||
| CVE-2022-1658 | 1 Artbees | 1 Jupiter | 2022-06-21 | 5.5 MEDIUM | 5.4 MEDIUM |
| Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via the abb_remove_plugin AJAX action registered in the framework/admin/control-panel/logic/plugin-management.php file. Using this functionality, any logged-in user can delete any installed plugin on the site. | |||||
| CVE-2022-1657 | 1 Artbees | 2 Jupiter, Jupiterx | 2022-06-21 | 6.5 MEDIUM | 8.8 HIGH |
| Vulnerable versions of the Jupiter (<= 6.10.1) and JupiterX (<= 2.0.6) Themes allow logged-in users, including subscriber-level users, to perform Path Traversal and Local File inclusion. In the JupiterX theme, the jupiterx_cp_load_pane_action AJAX action present in the lib/admin/control-panel/control-panel.php file calls the load_control_panel_pane function. It is possible to use this action to include any local PHP file via the slug parameter. The Jupiter theme has a nearly identical vulnerability which can be exploited via the mka_cp_load_pane_action AJAX action present in the framework/admin/control-panel/logic/functions.php file, which calls the mka_cp_load_pane_action function. | |||||
| CVE-2022-1654 | 1 Artbees | 2 Jupiter, Jupiterx | 2022-06-21 | 9.0 HIGH | 8.8 HIGH |
| Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrative privileges via the "abb_uninstall_template" (both) and "jupiterx_core_cp_uninstall_template" (JupiterX Core Only) AJAX actions | |||||
| CVE-2022-1750 | 1 Sticky Popup Project | 1 Sticky Popup | 2022-06-21 | 3.5 LOW | 4.8 MEDIUM |
| The Sticky Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ popup_title' parameter in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with admin level capabilities and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This issue mostly affects sites where unfiltered_html has been disabled for administrators and on multi-site installations where unfiltered_html is disabled for administrators. | |||||
| CVE-2022-1749 | 1 Wpmk Ajax Finder Project | 1 Wpmk Ajax Finder | 2022-06-21 | 6.8 MEDIUM | 8.8 HIGH |
| The WPMK Ajax Finder WordPress plugin is vulnerable to Cross-Site Request Forgery via the createplugin_atf_admin_setting_page() function found in the ~/inc/config/create-plugin-config.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1. | |||||
| CVE-2022-1969 | 1 Script | 1 Mobile Browser Color Select | 2022-06-21 | 6.8 MEDIUM | 8.8 HIGH |
| The Mobile browser color select plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the admin_update_data() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via forged request granted they can trick a site administrator into performing an action such as clicking on a link. | |||||
| CVE-2019-25063 | 1 Sricam | 1 Deviceviewer | 2022-06-21 | 7.2 HIGH | 7.8 HIGH |
| A vulnerability was found in Sricam IP CCTV Camera. It has been classified as critical. Affected is an unknown function of the component Device Viewer. The manipulation leads to memory corruption. Local access is required to approach this attack. | |||||
| CVE-2019-25062 | 1 Sricam | 1 Deviceviewer | 2022-06-21 | 7.2 HIGH | 7.8 HIGH |
| A vulnerability was found in Sricam IP CCTV Camera and classified as critical. This issue affects some unknown processing of the component Device Viewer. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. | |||||