Archive
9 February 2022
Vulnerabilities first published on this day (UTC), newest first.
276 results · Feed
-
Unscored —
There is an unauthorized rewriting vulnerability with the memory access management module on ACPU.Successful exploitati…
-
Unscored —
There is an unauthorized rewriting vulnerability with the memory access management module on ACPU.Successful exploitati…
-
Unscored —
A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gif_get_code() an…
-
Critical 9.1
Prototype Pollution leading to Remote Code Execution in superjson
superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitrary code on any server using superjson input without prior authentication or knowledge. The only requ…
-
Medium 6.3
Array literal misordering in github.com/open-policy-agent/opa
OPA is an open source, general-purpose policy engine. Under certain conditions, pretty-printing an abstract syntax tree (AST) that contains synthetic nodes could change the logic of some statements by reordering array literals. Example of policies impacted ar…
-
High 7.4
Cross site scripting in registration template in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a cross site scripting (XSS) vector in the `registerinline.vm` template related to the `xredirect` hidden field. This templa…
-
Medium 5.5
Missing authorization in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can read any file located in the XWiki WAR (for example xwiki.cfg and xwiki.properties) through XWiki#invo…
-
Medium 6.8
Path traversal in xwiki-platform-skin-skinx
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandler#processSx does not escape anything from SSX document references when serializing it on filesy…
-
Medium 5.3
Information exposure in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to g…
-
Medium 4.7
Open Redirect in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is no protection against URL redirection to untrusted sites, in particular some well known parameters (xredirect) can be used t…
-
Medium 6.5
Missing authorization in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit right can copy the content of a page it does not have access to by using it as template of a new page. This issue …
-
High 8.8
Remote code execution in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for an unprivileged user to perform a remote code execution by injecting a groovy script in her own profile and by call…
-
Medium 5.4
Partial authorization bypass on document save in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming rig…
-
Medium 4.7
Select Dell Client Commercial and Consumer platforms are vulnerable to an insufficient verification of data authenticit…
-
Medium 6.9
Select Dell Client Commercial and Consumer platforms contain a pre-boot direct memory access (DMA) vulnerability. An au…
-
Critical 9.9
All Dell EMC Integrated System for Microsoft Azure Stack Hub versions contain a privilege escalation vulnerability. A r…
-
High 8.1CVE-2022-21660 Public exploit
Missing authorization in gin-vue-admin
Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higher privilege users. Authentication is missing on the `setUserInfo` function. Users are advised to update as soon as poss…
-
Unscored —
Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1) index.php, 2) bottom.php, and 3) to…
-
Unscored —
An HTTP smuggling attack in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthentica…
-
Critical 9.8
Reuse of one time passwords allowed in Gitea
An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once.
-
Critical 9.8
Improper Privilege Management in Gitea
An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains valid on the server side for reuse.
-
Unscored —
A DoS attack in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker…
-
Medium 5.3
Microsoft Outlook for Mac Security Feature Bypass Vulnerability
Microsoft Outlook for Mac Security Feature Bypass Vulnerability
-
High 7.8
SQL Server for Linux Containers Elevation of Privilege Vulnerability
SQL Server for Linux Containers Elevation of Privilege Vulnerability
-
High 8.8
Microsoft Dynamics GP Remote Code Execution Vulnerability
Microsoft Dynamics GP Remote Code Execution Vulnerability
-
High 7.1
Microsoft Dynamics GP Elevation Of Privilege Vulnerability
Microsoft Dynamics GP Elevation Of Privilege Vulnerability
-
High 8.1
Microsoft Dynamics GP Elevation Of Privilege Vulnerability
Microsoft Dynamics GP Elevation Of Privilege Vulnerability
-
Medium 6.5
Microsoft Dynamics GP Elevation Of Privilege Vulnerability
Microsoft Dynamics GP Elevation Of Privilege Vulnerability
-
Medium 5.4
Microsoft Dynamics GP Spoofing Vulnerability
Microsoft Dynamics GP Spoofing Vulnerability
-
High 8.1
Azure Data Explorer Spoofing Vulnerability
Azure Data Explorer Spoofing Vulnerability
-
Medium 5.9
Microsoft OneDrive for Android Security Feature Bypass Vulnerability
Microsoft OneDrive for Android Security Feature Bypass Vulnerability
-
Medium 4.9
Microsoft Power BI Information Disclosure Vulnerability
Microsoft Power BI Information Disclosure Vulnerability
-
Medium 5.5
Microsoft Office Information Disclosure Vulnerability
Microsoft Office Information Disclosure Vulnerability
-
High 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
KEV Apr 19, 2022 -
High 7.0
Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
-
Medium 5.5
Microsoft Excel Information Disclosure Vulnerability
Microsoft Excel Information Disclosure Vulnerability
-
High 7.8
Named Pipe File System Elevation of Privilege Vulnerability
Named Pipe File System Elevation of Privilege Vulnerability
-
Medium 5.6
Windows Hyper-V Denial of Service Vulnerability
Windows Hyper-V Denial of Service Vulnerability
-
Medium 5.5
Windows Common Log File System Driver Denial of Service Vulnerability
Windows Common Log File System Driver Denial of Service Vulnerability
-
High 7.8
VP9 Video Extensions Remote Code Execution Vulnerability
VP9 Video Extensions Remote Code Execution Vulnerability