Archive
8 February 2022
Vulnerabilities first published on this day (UTC), newest first.
43 results · Feed
-
Unscored —
update_code in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive.
-
Unscored —
Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration informati…
-
Medium 5.0
Inadequate access verification when using proxy commands in ArchiSteamFarm
ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code, introduced in version V5.2.2.2, the program didn't adequately verify effective access of the user sending prox…
-
Medium 5.4
Studio 42 elFinder allows stored XSS
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.
-
Medium 6.1
Cross-site Scripting in Gitea
Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field.
-
Medium 6.5
Business Logic Errors in publify/publify
Business Logic Errors in GitHub repository publify/publify prior to 9.2.7.
-
High 8.5CVE-2022-23626 Public exploit
Insufficient file checks in m1k1o/blog
m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*` have not been checked properly. Although PHP issued warnings and the upload function returned `false`, the original file (that could contai…
-
Medium 6.3
Access of Memory Location Before Start of Buffer in radareorg/radare2
Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2.
-
Medium 4.3
Exposure of Sensitive Information in Grafana
Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by q…
-
Medium 6.3
Access of Memory Location After End of Buffer in radareorg/radare2
Access of Memory Location After End of Buffer in GitHub repository radareorg/radare2 prior to 5.6.2.
-
High 8.8
Use After Free in radareorg/radare2
Use After Free in NPM radare2.js prior to 5.6.2.
-
Medium 6.3
Cross Site Request Forgery in Grafana
Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-pri…
-
Medium 6.3
Buffer Access with Incorrect Length Value in radareorg/radare2
Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5.6.2.
-
Medium 6.3
Heap-based Buffer Overflow in radareorg/radare2
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2.
-
Medium 6.5
Cross site scripting in Grafana proxy
Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cr…
-
Low 3.0
OCI Manifest Type Confusion Issue
### Impact Systems that rely on digest equivalence for image attestations may be vulnerable to type confusion. ### Patches Upgrade to at least `v2.8.0-beta.1` if you are running `v2.x` release. If you use the code from the `main` branch, update at least to th…
-
High 7.1
Use After Free in radareorg/radare2
Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0.
-
Medium 6.1CVE-2021-45328 Scanner template
Open redirect in Gitea
Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs.
-
Critical 9.8
Capture-replay in Gitea
Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user execute arbitrary code.
-
High 8.8
Cross Site Request Forgery in Gitea
Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
-
Medium 5.3
Gitea displaying raw OpenID error in UI
Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.
-
Unscored —CVE-2021-44864 EPSS 10%
TP-Link WR886N 3.0 1.0.1 Build 150127 Rel.34123n is vulnerable to Buffer Overflow. Authenticated attackers can crash ro…
-
Medium 4.3
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1.
-
Unscored —
Two Heap based buffer overflow vulnerabilities exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23852. Iss…
-
Unscored —
Global buffer overflow vulnerability exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23705. Issue is in t…
-
Critical 9.8
Joplin Vulnerable to Code Injection
Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results.
-
Unscored —
In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the admin…
-
Unscored —
`structopt` is in maintenance mode
`structopt` has been in maintenance mode, with no new development planned, since at least February of 2022. The status of `structopt` is discussed in a [pinned issue](https://github.com/TeXitoi/structopt/issues/525). ## Recommended alternative The `structopt`…
-
Medium 6.6
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1.
-
Medium 6.5
Server-Side Request Forgery (SSRF) in chocobozzz/peertube
Server-Side Request Forgery (SSRF) in GitHub repository chocobozzz/peertube prior to f33e515991a32885622b217bf2ed1d1b0d9d6832
-
Unscored —
Cross-site scripting vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to inject an…
-
Unscored —
Reflected cross-site scripting vulnerability in the checkbox of php_mailform versions prior to Version 1.40 allows a re…
-
Unscored —
Reflected cross-site scripting vulnerability in the attached file name of php_mailform versions prior to Version 1.40 a…
-
Unscored —
Cross-site scripting vulnerability in ELECOM LAN router WRC-300FEBK-R firmware v1.13 and earlier allows an attacker on …
-
Unscored —CVE-2022-21241 Public exploit
Cross-site scripting vulnerability in CSV+ prior to 0.8.1 allows a remote unauthenticated attacker to inject an arbitra…
-
Unscored —
Directory traversal vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to obtain an …
-
Unscored —
Hidden functionality vulnerability in ELECOM LAN routers (WRH-300BK3 firmware v1.05 and earlier, WRH-300WH3 firmware v1…
-
Unscored —
Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, M…
-
Medium 6.5
Generation of Error Message Containing Sensitive Information in microweber/microweber
Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.
-
Medium 5.7
Cross-Site Request Forgery (CSRF) in microweber/microweber
Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.