vulnerabilitylab@mend.io
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS vulnerabilitylab@mend.io
03
assessed vulnerabilities (73)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-32167US | medium5.4 | — | ||
Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting (XSS), via the file upload functionality. A low privileged user will be able to share a file… | ||||
| CVE-2022-23082US | high7.5 | Exploit | ||
In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal. | ||||
| CVE-2022-23068US | medium5.4 | — | ||
ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user… | ||||
| CVE-2022-23067US | medium6.8 | — | ||
ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup link and then clicks… | ||||
| CVE-2022-23066US | medium6.4 | — | ||
In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution… | ||||
| CVE-2022-23063US | medium6.5 | — | ||
In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already… | ||||
| CVE-2022-23065US | low3.5 | — | ||
In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaS… | ||||
| CVE-2022-23064US | medium6.8 | — | ||
In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send… | ||||
| CVE-2022-23061US | medium5.5 | — | ||
In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen according to the documentation) via Insecure Direct Object Refer… | ||||
| CVE-2022-23060US | low3.5 | — | ||
A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0, where a privileged user (attacker) can inject malicious JavaScript in the filename… | ||||
| CVE-2022-23059US | low3.5 | — | ||
A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containi… | ||||
| CVE-2022-23054US | medium6.1 | — | ||
Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Summary Widget” element, that allows the injection of malicious JavaScript into the ‘URL’ field. This iss… | ||||
| CVE-2022-23053US | medium6.1 | — | ||
Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Condition Widget” element, that allows the injection of malicious JavaScript into the ‘URL’ field. This i… | ||||
| CVE-2022-22126US | medium6.1 | — | ||
Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Web Page” element, that allows the injection of malicious JavaScript into the ‘URL’ field. This issue aff… | ||||
| CVE-2021-25992US | high7.5 | — | ||
In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies… | ||||
| CVE-2021-25939US | low2.7 | — | ||
In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filte… | ||||
| CVE-2022-22125US | low3.5 | — | ||
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin attacker can inject arbitrary javascript… | ||||
| CVE-2022-22124US | low3.5 | — | ||
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a carefully crafted SVG… | ||||
| CVE-2022-22123US | medium5.4 | — | ||
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title. An authenticated attacker can inject arbitrary javascript cod… | ||||
| CVE-2022-22113US | high8.8 | — | ||
In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a use… | ||||