| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-43619 | Hig | 0.51 | 7.8 | 0.00 | Mar 1, 2022 | Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition. In the IPC model, a psa_fwu_write caller from SPE or NSPE can overwrite stack memory locations. | ||
| CVE-2022-25022 | Med | 0.35 | 5.4 | 0.01 | Mar 1, 2022 | A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to excute arbitrary web scripts HTML via a crafted payload in the content field of a blog post. | ||
| CVE-2022-25020 | Med | 0.35 | 5.4 | 0.01 | Mar 1, 2022 | A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post. | ||
| CVE-2022-25018 | Hig | 0.57 | 8.8 | 0.03 | Mar 1, 2022 | Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages. | ||
| CVE-2022-24446 | Med | 0.28 | 4.3 | 0.01 | Mar 1, 2022 | An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH servers (and user information) even if no SSH server or user is associated to the operator. | ||
| CVE-2022-22262 | Hig | 0.50 | 7.7 | 0.00 | Mar 1, 2022 | ROG Live Service’s function for deleting temp files created by installation has an improper link resolution before file access vulnerability. Since this function does not validate the path before deletion, an unauthenticated local attacker can create an unexpected symbolic… | ||
| CVE-2021-44962 | Med | 0.36 | 5.5 | 0.01 | Mar 1, 2022 | An out-of-bounds read vulnerability exists in the GCode::extrude() functionality of Slic3r libslic3r 1.3.0 and Master Commit b1a5500. A specially crafted stl file could lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability. | ||
| CVE-2021-44961 | Med | 0.36 | 5.5 | 0.01 | Mar 1, 2022 | A memory leakage flaw exists in the class PerimeterGenerator of Slic3r libslic3r 1.3.0 and Master Commit b1a5500. Specially crafted stl files can exhaust available memory. An attacker can provide malicious files to trigger this vulnerability. | ||
| CVE-2021-42951 | Hig | 0.57 | 8.8 | 0.02 | Mar 1, 2022 | A Remote Code Execution (RCE) vulnerability exists in Algorithmia MSOL all versions before October 10 2021 of SaaS. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new,… | ||
| CVE-2021-42767 | — | Cri | 0.59 | 9.1 | 0.02 | Mar 1, 2022 | A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1. | |
| CVE-2020-12775 | Cri | 0.64 | 9.8 | 0.03 | Mar 1, 2022 | Hicos citizen certificate client-side component does not filter special characters for command parameters in specific web URLs. An unauthenticated remote attacker can exploit this vulnerability to perform command injection attack to execute arbitrary system command, disrupt… | ||
| CVE-2022-26332 | Med | 0.35 | 5.4 | 0.01 | Mar 1, 2022 | Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field. | ||
| CVE-2022-25413 | Med | 0.35 | 5.4 | 0.00 | Feb 28, 2022 | Maxsite CMS v108 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_tags at /admin/page_edit/3. | ||
| CVE-2022-25412 | Hig | 0.53 | 8.1 | 0.01 | Feb 28, 2022 | Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /admin_page/all-files-update-ajax.php via the dir and deletefile parameters. | ||
| CVE-2022-25411 | Cri | 0.64 | 9.8 | 0.03 | Feb 28, 2022 | A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted PHP file. | ||
| CVE-2022-25410 | Med | 0.35 | 5.4 | 0.00 | Feb 28, 2022 | Maxsite CMS v180 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_file_description at /admin/files. | ||
| CVE-2022-25409 | Med | 0.35 | 5.4 | 0.00 | Feb 28, 2022 | Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the demail parameter at /admin-panel1.php. | ||
| CVE-2022-25408 | Med | 0.35 | 5.4 | 0.00 | Feb 28, 2022 | Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the dpassword parameter at /admin-panel1.php. | ||
| CVE-2022-25407 | Med | 0.35 | 5.4 | 0.00 | Feb 28, 2022 | Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Doctor parameter at /admin-panel1.php. | ||
| CVE-2022-25028 | Med | 0.40 | 6.1 | 0.01 | Feb 28, 2022 | Home Owners Collection Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the collected_by parameter under the List of Collections module. | ||
| CVE-2022-23907 | Med | 0.40 | 6.1 | 0.01 | Feb 28, 2022 | CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage. | ||
| CVE-2022-23906 | Hig | 0.47 | 7.2 | 0.02 | Feb 28, 2022 | CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file. | ||
| CVE-2022-0743 | Med | 0.23 | 4.6 | 0.01 | Feb 28, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31. | ||
| CVE-2021-45414 | Cri | 0.64 | 9.8 | 0.04 | Feb 28, 2022 | A Remote Code Execution (RCE) vulnerability exists in DataRobot through 2021-10-28 because it allows submission of a Docker environment or Java driver. | ||
| CVE-2021-41112 | Hig | 0.53 | 8.1 | 0.01 | Feb 28, 2022 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. Modifying or removing… | ||
| CVE-2021-41111 | Med | 0.42 | 6.4 | 0.01 | Feb 28, 2022 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.5 and 3.3.15, an authenticated user with authorization to read webhooks in one project can craft a request to reveal Webhook definitions and tokens in another… | ||
| CVE-2022-26315 | Med | 0.35 | 5.3 | 0.01 | Feb 28, 2022 | qrcp through 0.8.4, in receive mode, allows ../ Directory Traversal via the file name specified by the uploader. | ||
| CVE-2022-26181 | Hig | 0.51 | 7.8 | 0.01 | Feb 28, 2022 | Dropbox Lepton v1.2.1-185-g2a08b77 was discovered to contain a heap-buffer-overflow in the function aligned_dealloc():src/lepton/bitops.cc:108. | ||
| CVE-2022-25023 | Hig | 0.57 | 8.8 | 0.01 | Feb 28, 2022 | Audio File commit 004065d was discovered to contain a heap-buffer overflow in the function fouBytesToInt():AudioFile.h. | ||
| CVE-2022-25015 | Med | 0.35 | 5.4 | 0.01 | Feb 28, 2022 | A stored cross-site scripting (XSS) vulnerability in Ice Hrm 30.0.0.OS allows attackers to steal cookies via a crafted payload inserted into the First Name field. | ||
| CVE-2022-25014 | Med | 0.40 | 6.1 | 0.01 | Feb 28, 2022 | Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "m" parameter in the Dashboard of the current user. This vulnerability allows attackers to compromise session credentials via user interaction with a crafted link. | ||
| CVE-2022-25013 | Med | 0.40 | 6.1 | 0.01 | Feb 28, 2022 | Ice Hrm 30.0.0.OS was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the "key" and "fm" parameters in the component login.php. | ||
| CVE-2020-22845 | Hig | 0.49 | 7.5 | 0.01 | Feb 28, 2022 | A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted FTP requests. | ||
| CVE-2020-22844 | Hig | 0.49 | 7.5 | 0.01 | Feb 28, 2022 | A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted SMB requests. | ||
| CVE-2021-44342 | Hig | 0.51 | 7.8 | 0.01 | Feb 28, 2022 | David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow via function ok_png_transform_scanline() in "/ok_png.c:494". | ||
| CVE-2021-44331 | Hig | 0.51 | 7.8 | 0.01 | Feb 28, 2022 | ARM astcenc 3.2.0 is vulnerable to Buffer Overflow in function encode_ise(). | ||
| CVE-2022-26158 | Med | 0.40 | 6.1 | 0.01 | Feb 28, 2022 | An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. It accepts and reflects arbitrary domains supplied via a client-controlled Host header. Injection of a malicious URL in the Host: header of the HTTP Request results in a 302 redirect to… | ||
| CVE-2022-26157 | Med | 0.34 | 5.3 | 0.01 | Feb 28, 2022 | An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. The ASP.NET_Sessionid cookie is not protected by the Secure flag. This makes it prone to interception by an attacker if traffic is sent over unencrypted channels. | ||
| CVE-2022-26156 | Med | 0.40 | 6.1 | 0.01 | Feb 28, 2022 | An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. Injection of a malicious payload within the RelayState= parameter of the HTTP request body results in the hijacking of the form action. Form-action hijacking vulnerabilities arise when an… | ||
| CVE-2022-26155 | Med | 0.40 | 6.1 | 0.01 | Feb 28, 2022 | An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. XSS can occur via a payload in the SAMLResponse parameter of the HTTP request body. | ||
| CVE-2022-24712 | Med | 0.41 | 6.3 | 0.01 | Feb 28, 2022 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypass the CodeIgniter4 Cross-Site Request Forgery (CSRF) protection mechanism. Users should upgrade to version 4.1.9. There… | ||
| CVE-2022-24711 | Cri | 0.54 | 9.4 | 0.01 | Feb 28, 2022 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for… | ||
| CVE-2021-44340 | Hig | 0.51 | 7.8 | 0.01 | Feb 28, 2022 | David Brackeen ok-file-formats dev version is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurred in function ok_jpg_generate_huffman_table() in "/ok_jpg.c:403". | ||
| CVE-2021-44339 | Hig | 0.51 | 7.8 | 0.01 | Feb 28, 2022 | David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurred in function ok_png_transform_scanline() in "/ok_png.c:712". | ||
| CVE-2022-25642 | Med | 0.40 | 6.1 | 0.01 | Feb 28, 2022 | Obyte (formerly Byteball) Wallet before 3.4.1 allows XSS. A crafted chat message can lead to remote code execution. | ||
| CVE-2021-44334 | Hig | 0.51 | 7.8 | 0.01 | Feb 28, 2022 | David Brackeen ok-file-formats 97f78ca is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurs in function ok_jpg_convert_YCbCr_to_RGB() in "/ok_jpg.c:513" . | ||
| CVE-2021-43086 | Cri | 0.64 | 9.8 | 0.01 | Feb 28, 2022 | ARM astcenc 3.2.0 is vulnerable to Buffer Overflow. When the compression function of the astc-encoder project with -cl option was used, a stack-buffer-overflow occurred in function encode_ise() in function compress_symbolic_block_for_partition_2planes() in… | ||
| CVE-2022-24685 | Hig | 0.49 | 7.5 | 0.02 | Feb 28, 2022 | HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0.18, 1.1.12, and 1.2.6. | ||
| CVE-2022-24572 | Med | 0.40 | 6.1 | 0.01 | Feb 28, 2022 | Car Driving School Management System v1.0 is affected by Cross Site Scripting (XSS) in the User Enrollment Form (Username Field). To exploit this Vulnerability, an admin views the registered user details. | ||
| CVE-2022-24571 | Cri | 0.64 | 9.8 | 0.02 | Feb 28, 2022 | Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access. |
- risk 0.51cvss 7.8epss 0.00
Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition. In the IPC model, a psa_fwu_write caller from SPE or NSPE can overwrite stack memory locations.
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to excute arbitrary web scripts HTML via a crafted payload in the content field of a blog post.
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post.
- risk 0.57cvss 8.8epss 0.03
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.
- risk 0.28cvss 4.3epss 0.01
An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH servers (and user information) even if no SSH server or user is associated to the operator.
- risk 0.50cvss 7.7epss 0.00
ROG Live Service’s function for deleting temp files created by installation has an improper link resolution before file access vulnerability. Since this function does not validate the path before deletion, an unauthenticated local attacker can create an unexpected symbolic…
- risk 0.36cvss 5.5epss 0.01
An out-of-bounds read vulnerability exists in the GCode::extrude() functionality of Slic3r libslic3r 1.3.0 and Master Commit b1a5500. A specially crafted stl file could lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability.
- risk 0.36cvss 5.5epss 0.01
A memory leakage flaw exists in the class PerimeterGenerator of Slic3r libslic3r 1.3.0 and Master Commit b1a5500. Specially crafted stl files can exhaust available memory. An attacker can provide malicious files to trigger this vulnerability.
- risk 0.57cvss 8.8epss 0.02
A Remote Code Execution (RCE) vulnerability exists in Algorithmia MSOL all versions before October 10 2021 of SaaS. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new,…
- risk 0.59cvss 9.1epss 0.02
A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1.
- risk 0.64cvss 9.8epss 0.03
Hicos citizen certificate client-side component does not filter special characters for command parameters in specific web URLs. An unauthenticated remote attacker can exploit this vulnerability to perform command injection attack to execute arbitrary system command, disrupt…
- risk 0.35cvss 5.4epss 0.01
Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field.
- risk 0.35cvss 5.4epss 0.00
Maxsite CMS v108 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_tags at /admin/page_edit/3.
- risk 0.53cvss 8.1epss 0.01
Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /admin_page/all-files-update-ajax.php via the dir and deletefile parameters.
- risk 0.64cvss 9.8epss 0.03
A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted PHP file.
- risk 0.35cvss 5.4epss 0.00
Maxsite CMS v180 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_file_description at /admin/files.
- risk 0.35cvss 5.4epss 0.00
Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the demail parameter at /admin-panel1.php.
- risk 0.35cvss 5.4epss 0.00
Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the dpassword parameter at /admin-panel1.php.
- risk 0.35cvss 5.4epss 0.00
Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Doctor parameter at /admin-panel1.php.
- risk 0.40cvss 6.1epss 0.01
Home Owners Collection Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the collected_by parameter under the List of Collections module.
- risk 0.40cvss 6.1epss 0.01
CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage.
- risk 0.47cvss 7.2epss 0.02
CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file.
- risk 0.23cvss 4.6epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.
- risk 0.64cvss 9.8epss 0.04
A Remote Code Execution (RCE) vulnerability exists in DataRobot through 2021-10-28 because it allows submission of a Docker environment or Java driver.
- risk 0.53cvss 8.1epss 0.01
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. Modifying or removing…
- risk 0.42cvss 6.4epss 0.01
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.5 and 3.3.15, an authenticated user with authorization to read webhooks in one project can craft a request to reveal Webhook definitions and tokens in another…
- risk 0.35cvss 5.3epss 0.01
qrcp through 0.8.4, in receive mode, allows ../ Directory Traversal via the file name specified by the uploader.
- risk 0.51cvss 7.8epss 0.01
Dropbox Lepton v1.2.1-185-g2a08b77 was discovered to contain a heap-buffer-overflow in the function aligned_dealloc():src/lepton/bitops.cc:108.
- risk 0.57cvss 8.8epss 0.01
Audio File commit 004065d was discovered to contain a heap-buffer overflow in the function fouBytesToInt():AudioFile.h.
- risk 0.35cvss 5.4epss 0.01
A stored cross-site scripting (XSS) vulnerability in Ice Hrm 30.0.0.OS allows attackers to steal cookies via a crafted payload inserted into the First Name field.
- risk 0.40cvss 6.1epss 0.01
Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "m" parameter in the Dashboard of the current user. This vulnerability allows attackers to compromise session credentials via user interaction with a crafted link.
- risk 0.40cvss 6.1epss 0.01
Ice Hrm 30.0.0.OS was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the "key" and "fm" parameters in the component login.php.
- risk 0.49cvss 7.5epss 0.01
A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted FTP requests.
- risk 0.49cvss 7.5epss 0.01
A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted SMB requests.
- risk 0.51cvss 7.8epss 0.01
David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow via function ok_png_transform_scanline() in "/ok_png.c:494".
- risk 0.51cvss 7.8epss 0.01
ARM astcenc 3.2.0 is vulnerable to Buffer Overflow in function encode_ise().
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. It accepts and reflects arbitrary domains supplied via a client-controlled Host header. Injection of a malicious URL in the Host: header of the HTTP Request results in a 302 redirect to…
- risk 0.34cvss 5.3epss 0.01
An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. The ASP.NET_Sessionid cookie is not protected by the Secure flag. This makes it prone to interception by an attacker if traffic is sent over unencrypted channels.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. Injection of a malicious payload within the RelayState= parameter of the HTTP request body results in the hijacking of the form action. Form-action hijacking vulnerabilities arise when an…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. XSS can occur via a payload in the SAMLResponse parameter of the HTTP request body.
- risk 0.41cvss 6.3epss 0.01
CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypass the CodeIgniter4 Cross-Site Request Forgery (CSRF) protection mechanism. Users should upgrade to version 4.1.9. There…
- risk 0.54cvss 9.4epss 0.01
CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for…
- risk 0.51cvss 7.8epss 0.01
David Brackeen ok-file-formats dev version is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurred in function ok_jpg_generate_huffman_table() in "/ok_jpg.c:403".
- risk 0.51cvss 7.8epss 0.01
David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurred in function ok_png_transform_scanline() in "/ok_png.c:712".
- risk 0.40cvss 6.1epss 0.01
Obyte (formerly Byteball) Wallet before 3.4.1 allows XSS. A crafted chat message can lead to remote code execution.
- risk 0.51cvss 7.8epss 0.01
David Brackeen ok-file-formats 97f78ca is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurs in function ok_jpg_convert_YCbCr_to_RGB() in "/ok_jpg.c:513" .
- risk 0.64cvss 9.8epss 0.01
ARM astcenc 3.2.0 is vulnerable to Buffer Overflow. When the compression function of the astc-encoder project with -cl option was used, a stack-buffer-overflow occurred in function encode_ise() in function compress_symbolic_block_for_partition_2planes() in…
- risk 0.49cvss 7.5epss 0.02
HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0.18, 1.1.12, and 1.2.6.
- risk 0.40cvss 6.1epss 0.01
Car Driving School Management System v1.0 is affected by Cross Site Scripting (XSS) in the User Enrollment Form (Username Field). To exploit this Vulnerability, an admin views the registered user details.
- risk 0.64cvss 9.8epss 0.02
Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access.