Archive
January 2022
Vulnerabilities first published in this month (UTC), newest first.
2,026 results · Feed
-
Unscored —
Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, bu…
-
Unscored —
Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the d…
-
Unscored —CVE-2022-22836 Public exploit
CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTT…
-
Unscored —
A link following denial-of-service vulnerability in Trend Micro Worry-Free Business Security (on prem only) could allow…
-
Unscored —
A origin validation error vulnerability in Trend Micro Apex One (on-prem and SaaS) could allow a local attacker drop an…
-
Unscored —
A unnecessary privilege vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security 10.0 SP1 (on…
-
Unscored —
A link following privilege escalation vulnerability in Trend Micro Apex One (on-prem and SaaS) and Trend Micro Worry-Fr…
-
Unscored —
A link following denial-of-service vulnerability in Trend Micro Apex One (on-prem and SaaS) and Trend Micro Worry-Free …
-
Critical 9.8CVE-2022-22822 Public exploit
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
Critical 9.8
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
Critical 9.8
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.8
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.8
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.8
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
Low 2.0
Path Traversal in nemo-toolkit
NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any directory when admin privileges are available.
-
Low —
Prototype Pollution in node-forge debug API.
### Impact The `forge.debug` API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist,…
-
Low —
Prototype Pollution in node-forge util.setPath API
### Impact `forge.util.setPath` had a potential prototype pollution issue if called with untrusted keys. This API was not used by forge itself. ### Patches The `forge.util.setPath` API and related functions were removed in 0.10.0. ### Workarounds Don't call `…
-
Low —
URL parsing in node-forge could lead to undesired behavior.
### Impact The regex used for the `forge.util.parseUrl` API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior. ### Patches `forge.util.parseUrl` and other very old related URL APIs were removed …
-
Unscored —
LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0…
-
Unscored —
Users have access to the directory where the installation repair occurs. Since the MS Installer allows regular users to…
-
Medium 4.3
Log entry injection in Spring Framework
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against add…
-
Low 2.6
ICSMA-22-006-01 Philips Engage Software
The affected product is vulnerable to an improper access control, which may allow an authenticated user to gain unauthorized access to sensitive data.
-
Unscored —
A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that c…
-
Medium 4.3CVE-2021-35247 Exploited
Improper Input Validation Vulnerability in Serv-U
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as t…
KEV Jan 21, 2022 -
Unscored —
There is a Heap-based buffer overflow vulnerability with the NFC module in smartphones. Successful exploitation of this…
-
Unscored —
There is an Integer overflow vulnerability with ACPU in smartphones. Successful exploitation of this vulnerability may …
-
Unscored —
There is Vulnerability of APIs being concurrently called for multiple times in HwConnectivityExService a in smartphones…
-
Unscored —
The bone voice ID TA has a vulnerability in information management,Successful exploitation of this vulnerability may af…
-
Unscored —
The eID module has an out-of-bounds memory write vulnerability,Successful exploitation of this vulnerability may affect…
-
Unscored —
The bone voice ID TA has a vulnerability in calculating the buffer length,Successful exploitation of this vulnerability…
-
Unscored —
The weaver module has a vulnerability in parameter type verification,Successful exploitation of this vulnerability may …
-
Unscored —
The eID module has a vulnerability that causes the memory to be used without being initialized,Successful exploitation …
-
Unscored —
The eID module has an out-of-bounds memory write vulnerability,Successful exploitation of this vulnerability may affect…
-
Unscored —
The eID module has a null pointer reference vulnerability. Successful exploitation of this vulnerability may affect dat…
-
Unscored —
The bone voice ID trusted application (TA) has a heap overflow vulnerability. Successful exploitation of this vulnerabi…
-
Unscored —
The bone voice ID TA has a heap overflow vulnerability.Successful exploitation of this vulnerability may result in mali…
-
Unscored —
There is a Null pointer dereference vulnerability in the camera module in smartphones. Successful exploitation of this …
-
Unscored —
There is a Double free vulnerability in the AOD module in smartphones. Successful exploitation of this vulnerability ma…
-
Unscored —
There is a Vulnerability of accessing resources using an incompatible type (type confusion) in the MPTCP subsystem in s…
-
Unscored —
There is a Buffer overflow vulnerability due to a boundary error with the Samba server in the file management module in…