CVEs published by Mend

CVEs published by Mend (CVE Numbering Authority). 34 tracked.

• CVE-2022-32177 CRITICAL 9.0 UPGRADE In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads t
• CVE-2022-32176 CRITICAL 9.0 UPGRADE In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to e
• CVE-2022-32175 MEDIUM 5.4 UPGRADE In AdGuardHome, versions v0.95 through v0.108.0-b.13 are vulnerable to Cross-Site Request Forgery (CSRF), in t
• CVE-2022-32174 CRITICAL 9.0 UPGRADE In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an
• CVE-2022-32172 HIGH n/a UPGRADE In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete te
• CVE-2022-32171 HIGH n/a UPGRADE In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete us
• CVE-2022-32170 MEDIUM 4.3 UPGRADE The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauth
• CVE-2022-32169 MEDIUM 4.3 UPGRADE The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthor
• CVE-2022-32168 HIGH 7.8 UPGRADE Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerab
• CVE-2022-32167 MEDIUM 5.4 UPGRADE Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting (XSS), via the file upl
• CVE-2022-32166 MEDIUM 6.1 UPGRADE MITIGATE In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c
• CVE-2022-32159 LOW 3.5 DOWNGRADE In openlibrary versions deploy-2016-07-0 through deploy-2021-12-22 are vulnerable to Stored XSS.
• CVE-2022-23082 HIGH 7.5 UPGRADE In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fa
• CVE-2022-23081 MEDIUM 4.3 UPGRADE In openlibrary versions deploy-2016-07-0 through deploy-2021-12-22 are vulnerable to Reflected XSS.
• CVE-2022-23080 MEDIUM 5.0 UPGRADE In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the m
• CVE-2022-23079 MEDIUM 6.8 UPGRADE In motor-admin versions 0.0.1 through 0.2.56 are vulnerable to host header injection in the password reset fun
• CVE-2022-23078 MEDIUM 5.8 UPGRADE In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page.
• CVE-2022-23077 MEDIUM 6.1 UPGRADE In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page.
• CVE-2022-23074 LOW 3.5 UPGRADE In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ f
• CVE-2022-23073 LOW 3.5 UPGRADE In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in copy to clipb
• CVE-2022-23072 LOW 3.5 UPGRADE In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in “Add to Cart”
• CVE-2022-23071 MEDIUM 6.5 UPGRADE In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import
• CVE-2022-23068 MEDIUM 5.4 UPGRADE ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious cod
• CVE-2022-23067 HIGH 8.8 UPGRADE ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account tak
• CVE-2022-23066 CRITICAL 9.1 DOWNGRADE In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper im
• CVE-2022-23065 MEDIUM 5.4 UPGRADE In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having
• CVE-2022-23064 HIGH 8.8 UPGRADE In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection
• CVE-2022-23063 HIGH 8.8 UPGRADE In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration
• CVE-2022-23061 MEDIUM 6.5 UPGRADE In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot h
• CVE-2022-23060 MEDIUM 4.8 UPGRADE A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0, where a priv
• CVE-2022-23058 LOW 3.5 UPGRADE ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged user
• CVE-2022-23057 MEDIUM 5.4 UPGRADE In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input n
• CVE-2022-23056 LOW 3.5 UPGRADE In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page
• CVE-2022-23055 MEDIUM 5.5 UPGRADE In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms f

← Back to latest CVEs