Archive
January 2022
Vulnerabilities first published in this month (UTC), newest first.
94 results · Clear filters · Feed
-
Unscored —CVE-2022-24263 Public exploit
Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-…
-
High 7.2CVE-2021-44255 Public exploit
Unrestricted Upload of File with Dangerous Type in motionEye
Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to upload a configuration backup file containing a malicious python pickle file which will execute arbitrary code on the server.
-
Unscored —
The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in…
-
High 7.5
SQL Injection in Casdoor
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
-
Unscored —CVE-2022-24122 Public exploit
kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled, allows a use-af…
-
Unscored —CVE-2021-45897 Public exploit
SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows remote code execution.
-
High 7.8
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid too…
KEV Jun 27, 2022 -
Unscored —CVE-2022-22828 Public exploit
An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacke…
-
High 8.8CVE-2021-32849 Public exploit
Arbitrary command execution in Gerapy
Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds.
-
Unscored —CVE-2022-22852 Public exploit
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management Syste…
-
Unscored —CVE-2022-22850 Public exploit
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management Syste…
-
High 7.5CVE-2022-23990 Public exploit
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
-
Unscored —CVE-2022-22851 Public exploit
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management Syste…
-
Medium 5.3CVE-2022-22932 Public exploit
Path traversal flaws
Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as obr:* commands are not very used and the entry is set by user. This has been fixed in revision: htt…
-
Medium 6.6
Double Free in net/packet/af_packet.c leading to priviledge escalation
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1…
KEV Apr 11, 2022 -
High 8.6CVE-2021-43799 Public exploit
RabbitMQ exposes ports with weak default secrets in Zulip Server
Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server prior to 4.9, the initial installation (until first reboot, or restart of RabbitMQ) does not successfully limit the defau…
-
Critical 9.8
SQL injection in Moodle
A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.
-
Unscored —CVE-2022-23935 Public exploit
lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection.
-
Unscored —CVE-2022-22296 Public exploit
Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure Permissions via the id parame…
-
Unscored —
WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also l…
-
Critical 9.8CVE-2022-23852 Public exploit
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML…
-
Medium 6.1
Cross-site Scripting in phpmyadmin
An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.
-
Unscored —CVE-2022-23366 Public exploit
HMS v1.0 was discovered to contain a SQL injection vulnerability via patientlogin.php.
-
Unscored —CVE-2021-44593 Public exploit
Simple College Website 1.0 is vulnerable to unauthenticated file upload & remote code execution via UNION-based SQL inj…
-
Medium 5.5CVE-2022-0219 Public exploit
Improper Restriction of XML External Entity Reference in skylot/jadx
Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.
-
Medium 5.5CVE-2021-34600 Public exploit
Telenot complex: Insecure AES Key Generation
Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags used for local authorization of users. This may lead to total loss of trustworthiness of the installation.
-
Unscored —
Access-Token in ElasticJob UI causes password disclosure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache ShardingSphere ElasticJob-UI allows an attacker who has guest account to do privilege escalation. This issue affects Apache ShardingSphere ElasticJob-UI Apache ShardingSphere E…
-
High 7.3CVE-2022-21658 Public exploit
Race condition in std::fs::remove_dir_all in rustlang
Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condi…
-
Unscored —
PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a s…
-
High 8.8CVE-2022-21392 Public exploit
Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework…
-
High 7.5
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported v…
-
Medium 6.5CVE-2022-21350 Public exploit
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
Medium 5.3CVE-2022-21340 Public exploit
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…
-
Critical 9.8CVE-2022-21306 Public exploit
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
Critical 9.8
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported ve…
KEV Nov 28, 2022 -
Critical 9.8
Arbitrary code execution in H2 Console
H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.
-
Unscored —
Sourcecodester Car Rental Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via vehicalorcview paramete…
-
High 7.5CVE-2022-0236 Public exploit
WP Import Export (Lite) <= 3.9.15 Unauthenticated Sensitive Data Disclosure
The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download found in the ~/includes/classes/class-wpie-…
-
Critical 9.8
SQL injection in JDBC Appender in Apache Log4j V1
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate…
-
Medium 6.1CVE-2021-44217 Public exploit
Cross-site Scripting in Ericsson CodeChecker
In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.