Archive
18 January 2022
Vulnerabilities first published on this day (UTC), newest first.
85 results · Feed
-
Medium 4.3
In all versions of GitLab CE/EE since version 12.0, a lower privileged user can import users from projects that they do…
-
Medium 4.3
A denial of service vulnerability in GitLab CE/EE affecting all versions starting from 12.0 before 14.3.6, all versions…
-
High 8.7
Improper neutralization of user input in GitLab CE/EE versions 14.3 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allow…
-
Medium 6.5
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 a…
-
Low 3.5
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 a…
-
Medium 4.3
An issue has been discovered in GitLab affecting all versions starting from 12.0 before 14.4.5, all versions starting f…
-
High 7.5
An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting fr…
-
Medium 4.3
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 a…
-
High 8.6
An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possibl…
-
Medium 6.5
An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.4.5, all versions starting …
-
Medium 6.5
An issue has been discovered in GitLab affecting all versions starting from 13.10 before 14.4.5, all versions starting …
-
Low 3.5
Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.4, between 14.5.0 and 14.5.2, and…
-
Medium 5.3
An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was…
-
Low 2.0
In M-Files Server product with versions before 21.11.10775.0, enabling logging of federated authentication would write sensitive information to event logs.
In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default.
-
High 7.5
Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0, allows brute-forcing of certain type of user accounts.
Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and therefore makes brute-forcing login accounts easier.
-
Low 3.5
SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, allows requests from server.
SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, in a preview function allowed making queries from the server with certain document types referencing external entities.
-
Medium 4.3
Server-side Denial of Service while processing a specifically crafted GIF file
Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Ser…
-
Unscored —
A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers i…
-
Unscored —
In FreeBSD 13.0-STABLE before n247428-9352de39c3dc, 12.2-STABLE before r370674, 13.0-RELEASE before p6, and 12.2-RELEAS…
-
Unscored —
AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain sensitive informat…
-
Medium 5.4
IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header inje…
-
Medium 6.6
Unrestricted Upload of File with Dangerous Type in pimcore/pimcore
Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7.
-
Medium 6.6
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7.
-
Medium 4.3
Business Logic Errors in pimcore/pimcore
Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6.
-
High 8.8CVE-2022-23307 EPSS 54%
A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
-
Critical 9.8
SQL injection in JDBC Appender in Apache Log4j V1
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate…
-
High 8.8CVE-2022-23302 EPSS 64%
Deserialization of untrusted data in JMSSink in Apache Log4j 1.x
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a Top…
-
Medium 6.1CVE-2021-44217 Public exploit
Cross-site Scripting in Ericsson CodeChecker
In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.
-
Medium 6.5
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7.
-
Unscored —
Leostream Connection Broker 9.0.40.17 allows administrator to upload and execute Perl code.
-
Unscored —
Leostream Connection Broker 9.0.40.17 allows administrators to conduct directory traversal attacks by uploading z ZIP f…
-
Unscored —
SoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows attackers to upload files …
-
Unscored —
SoftVibe SARABAN for INFOMA 1.1 has Incorrect Access Control vulnerability, that allows attackers to access signature f…
-
Medium 5.1
Incorrect mapping of Executable bits in Fuchsia Kernel
An incorrect setting of UXN bits within mmu_flags_to_s1_pte_attr lead to privileged executable pages being mapped as executable from an unprivileged context. This can be leveraged by an attacker to bypass executability restrictions of kernel-mode pages from u…
-
Unscored —
SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting (XSS) that allows users to store scripts i…
-
Unscored —
SoftVibe SARABAN for INFOMA 1.1 allows SQL Injection.
-
Unscored —
There is a NULL pointer deference in the Allwinner R818 SoC Android Q SDK V1.0 camera driver /dev/cedar_dev that could …
-
Unscored —
There is a NULL pointer dereference in the syscall open_exec function of Allwinner R818 SoC Android Q SDK V1.0 that cou…
-
Unscored —
There is a Out-of-Bound Write in the Allwinner R818 SoC Android Q SDK V1.0 camera driver "/dev/cedar_dev" through iotcl…
-
Unscored —
China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRMesh/set_ZRMesh which receives parameters by…