31 January 2022

28 results · Feed

• Unscored —
  CVE-2022-24266 Scanner template

  Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via …

  Jan 31, 2022
• Unscored —
  CVE-2022-24265 Scanner template

  Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/menu/ via the path=…

  Jan 31, 2022
• Unscored —
  CVE-2022-24263 Public exploit

  Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-…

  Jan 31, 2022
• Unscored —
  CVE-2022-24264 Scanner template

  Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via …

  Jan 31, 2022
• Unscored —
  CVE-2022-23872

  Emlog pro v1.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /admin/co…

  Jan 31, 2022
• Medium 5.3
  CVE-2022-21659

  Observable Response Discrepancy in Flask-AppBuilder

  Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by tim…

  flask-appbuilder PyPI
  Jan 31, 2022
• Unscored —
  CVE-2021-46459

  Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?sourc…

  Jan 31, 2022
• Unscored —
  CVE-2021-42635

  PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use a hardcoded APP_KEY value, leading to pre-auth remote code …

  Jan 31, 2022
• Unscored —
  CVE-2021-42631

  PrinterLogic Web Stack versions 19.1.1.13 SP9 and below deserializes attacker controlled leading to pre-auth remote cod…

  Jan 31, 2022
• Unscored —
  CVE-2021-44114

  Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Stock Management System in PHP/OOP 1.0, which allows …

  Jan 31, 2022
• Unscored —
  CVE-2021-40033

  There is an information exposure vulnerability on several Huawei Products. The vulnerability is due to that the softwar…

  Jan 31, 2022
• Unscored —
  CVE-2021-40042

  There is a release of invalid pointer vulnerability in some Huawei products, successful exploit may cause the process a…

  Jan 31, 2022
• Unscored —
  CVE-2022-0286

  A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of ser…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Jan 31, 2022
• Unscored —
  CVE-2021-46458

  Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin/posts.php?source=add_pos…

  Jan 31, 2022
• Unscored —
  CVE-2021-31617

  In ASQ in Stormshield Network Security (SNS) 1.0.0 through 2.7.8, 2.8.0 through 2.16.0, 3.0.0 through 3.7.20, 3.8.0 thr…

  Jan 31, 2022
• Unscored —
  CVE-2021-28962

  Stormshield Network Security (SNS) before 4.2.2 allows a read-only administrator to gain privileges via CLI commands.

  Jan 31, 2022
• Unscored —
  CVE-2020-36056

  Beetel 777VR1-DI Hardware Version REV.1.01 Firmware Version V01.00.09_55 was discovered to contain a cross-site scripti…

  Jan 31, 2022
• Unscored —
  CVE-2020-36064

  Online Course Registration v1.0 was discovered to contain hardcoded credentials in the source code which allows attacke…

  Jan 31, 2022
• Unscored —
  CVE-2021-46101

  In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly.

  Jan 31, 2022
• High 7.2
  CVE-2021-44255 Public exploit

  Unrestricted Upload of File with Dangerous Type in motionEye

  Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to upload a configuration backup file containing a malicious python pickle file which will execute arbitrary code on the server.

  motioneye PyPI
  Jan 31, 2022
• Medium 5.5
  CVE-2021-23520

  Arbitrary File Write via Archive Extraction (Zip Slip)

  The package juce-framework/juce before 6.1.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) via the ZipFile::uncompressEntry function in juce_ZipFile.cpp. This vulnerability is triggered when the archive is extracted upon calling unc…

  juce juce Debian Ubuntu
  Jan 31, 2022
• Medium 5.5
  CVE-2021-23521

  Link Following

  This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is crafted with an entry containing a symbolic link. When extracted, the symbolic link is followed outside of the target dir allowing writing a…

  juce juce Debian Ubuntu
  Jan 31, 2022
• Unscored —
  CVE-2021-45079

  In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authentica…

  strongswan strongswan strongswan strongswan Debian Ubuntu Azure Linux Alpine
  Jan 31, 2022
• Unscored —
  CVE-2021-34805 Scanner template EPSS 25%

  An issue was discovered in FAUST iServer before 9.0.019.019.7. For each URL request, it accesses the corresponding .fau…

  Jan 31, 2022
• Unscored —
  CVE-2021-27971

  Alps Alpine Touchpad Driver 10.3201.101.215 is vulnerable to DLL Injection.

  Jan 31, 2022
• Unscored —
  CVE-2022-23409 Public exploit EPSS 14%

  The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in…

  Jan 31, 2022
• Unscored —
  CVE-2022-24130

  xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in g…

  xterm xterm xterm xterm Debian Ubuntu Azure Linux Alpine
  Jan 31, 2022
• Medium 4.1
  CVE-2022-0414

  Improper Validation of Specified Quantity in Input in dolibarr/dolibarr

  Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0.

  Dolibarr dolibarr/dolibarr dolibarr dolibarr/dolibarr Ubuntu Packagist
  Jan 31, 2022