Archive
January 2022
Vulnerabilities first published in this month (UTC), newest first.
2,026 results · Feed
-
Unscored —
**Update** Maintainers stepped forward, fixed the security issue, and Vocabulary Permissions Per Role is supported agai…
-
Unscored —
This module enables you to automatically scan images uploaded to the site to extract their meta data and store it in ta…
-
Unscored —
The security team is marking this project unsupported. There is a known security issue with the project that has not be…
-
Unscored —
The security team is marking this project unsupported. There is a known security issue with the project that has not be…
-
Unscored —
The security team is marking this project unsupported. There is a known security issue with the project that has not be…
-
Unscored —
The security team is marking this project unsupported. There is a known security issue with the project that has not be…
-
Unscored —
Update 2022-03-01. New maintainers have volunteered for the project and created a new release which includes fixes for …
-
Unscored —
The security team is marking this project unsupported. There is a known security issue with the project that has not be…
-
High 7.5
IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to con…
-
Unscored —
In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not…
-
Unscored —
OneBlog <= 2.2.8 is vulnerable to Insecure Permissions. Low level administrators can delete high-level administrators b…
-
Unscored —
uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via the input box of the statistical code.
-
Unscored —
uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via "close registration information" input box.
-
Unscored —
xzs-mysql >= t3.4.0 is vulnerable to Insecure Permissions. The front end of this open source system is an online examin…
-
Medium 6.5
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NET…
-
High 7.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-…
-
High 7.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-…
-
High 7.5
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-…
-
High 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An…
-
High 8.8
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of multiple NET…
-
High 7.5
SQL Injection in FileContentProvider (GHSL-2021-1007)
The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. The Nextcloud Android app uses content providers to manage its data. Prior to version 3.18.1, the providers `FileContentProvider` and `DiskLruImageCacheFilePro…
-
Unscored —
A problem was found in ForestBlog, as of 2021-12-29, there is a XSS vulnerability that can be injected through the nick…
-
Unscored —
In ForestBlog, as of 2021-12-28, File upload can bypass verification.
-
Critical 9.1
Authentication Bypass by Primary Weakness in adodb/adodb
Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21.
-
Critical 9.8
SQL Injection in JeecgBoot
In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges.
-
Medium 6.3
SSRF vulnerability (requires authentication)
Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Side Request Forgery (SSRF). Any user deploying Jupyter Server or Notebook with jupyter-proxy-server ex…
-
Unscored —
Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x…
-
Unscored —
A PV guest could DoS Xen while unmapping a grant To address XSA-380, reference counting was introduced for grant mappin…
-
Unscored —
arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p…
-
Unscored —
Several missing input validations in the 3MF parser component of Slic3r libslic3r 1.3.0 can each allow an attacker to c…
-
Unscored —
A flaw in the AMF parser of Slic3r libslic3r 1.3.0 allows an attacker to cause an application crash using a crafted AMF…
-
High 7.5
Apache ShenYu missing authentication allows gateway registration
Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
-
Critical 9.1
Apache ShenYu 2.4.1 Improper access control
User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
-
High 7.5
Apache ShenYu Password leakage
On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.
-
Critical 9.8
Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection
Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
-
Unscored —
In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by…
-
Unscored —
MartDevelopers iResturant 1.0 is vulnerable to SQL Injection. SQL Injection occurs because this view parameter value is…
-
Unscored —
MartDevelopers iResturant 1.0 is vulnerable to SQL Injection. SQL Injection occurs because the email and phone paramete…
-
Unscored —
The Path Sanity Check script of FreeCAD 0.19 is vulnerable to OS command injection, allowing an attacker to execute arb…
-
Unscored —
Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to inject OS command…