Archive
January 2022
Vulnerabilities first published in this month (UTC), newest first.
514 results · Clear filters · Feed
-
High 8.7
Improper neutralization of user input in GitLab CE/EE versions 14.3 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allow…
-
High 7.5
An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting fr…
-
High 8.6
An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possibl…
-
High 7.5
Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0, allows brute-forcing of certain type of user accounts.
Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and therefore makes brute-forcing login accounts easier.
-
High 8.8CVE-2022-23307 EPSS 54%
A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
-
High 8.8CVE-2022-23302 EPSS 64%
Deserialization of untrusted data in JMSSink in Apache Log4j 1.x
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a Top…
-
High 8.8
Cross-site Scripting in HTML2PDF
An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious <link> tag in the converted HTML document.
-
High 7.2
Unrestricted Upload of File with Dangerous Type in crater-invoice/crater
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.
-
High 8.3
SQL Injection in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
-
High 7.1
Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
High 7.6
Cross-Site Request Forgery (CSRF) in janeczku/calibre-web
calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)
-
High 7.3
Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq
chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
High 7.7
Business Logic Errors in janeczku/calibre-web
calibre-web is vulnerable to Business Logic Errors
-
High 7.3
Cross-site Scripting (XSS) - Stored in janeczku/calibre-web
calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
High 8.8
Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
-
High 7.8
Open Design Alliance Drawings SDK before 2022.12.1 mishandles the loading of JPG files. Unchecked input data from a cra…
-
High 7.5
Denial of Service (DoS)
The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusab…
-
High 7.8
Omron CX-One
Omron CX-One Versions 4.60 and prior are vulnerable to a stack-based buffer overflow while processing specific project files, which may allow an attacker to execute arbitrary code.
-
High 7.8
WECON LeviStudioU
WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code.
-
High 7.8
WECON LeviStudioU
WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code.
-
High 7.8CVE-2021-44710 EPSS 11%
Adobe Acrobat Reader Use-after-free could lead to Arbitrary code execution
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the conte…
-
High 7.8
Adobe Acrobat Reader Use-After-Free could lead to Arbitrary code execution
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the conte…
-
High 7.8CVE-2021-44703 EPSS 58%
Adobe Acrobat Pro DC Stack Overflow Vulnerability Arbitrary code execution
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a stack buffer overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution…
-
High 7.8CVE-2021-44704 EPSS 11%
Adobe Acrobat Reader Use-After-Free could lead to Arbitrary code execution
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the conte…
-
High 7.8CVE-2021-44708 EPSS 38%
Adobe Acrobat Pro DC Heap Overflow could lead to Arbitrary code execution
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a heap overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution in the …
-
High 7.8CVE-2021-45064 EPSS 11%
Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the conte…
-
High 7.8
Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation…
-
High 7.8
Adobe Acrobat Reader Collab.registerReview Use-After-Free Remote Execution Vulnerability
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the conte…
-
High 7.8
Adobe Acrobat Reader DC TTF Font Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory s…
-
High 7.8
Adobe Acrobat Reader DC OTF Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation…
-
High 7.8
Adobe Acrobat Reader DC annotation gestures integer overflow vulnerability
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. E…
-
High 7.8CVE-2021-44701 EPSS 21%
Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the conte…
-
High 7.8CVE-2021-44709 EPSS 28%
Adobe Acrobat Pro DC Heap Overflow Vulnerability could lead to Arbitrary code execution
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a heap overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution in the …
-
High 7.8CVE-2021-45068 EPSS 12%
Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation…
-
High 7.8CVE-2021-45062 EPSS 16%
Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the conte…
-
High 7.8
Adobe Bridge JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interactio…
-
High 8.3
SQL Injection in dolibarr/dolibarr
dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
-
High 8.8
Authenticated file write leads to remote code execution in october/system
October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with "create, modify and delete website pages" privileges in the backend is able to execute PHP code by …
-
High 8.8
Arbitrary code execution in october/system
October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypa…
-
High 7.5
Clam AntiVirus (ClamAV) Denial of Service Vulnerability
A vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulner…