Archive
11 February 2022
Vulnerabilities first published on this day (UTC), newest first.
12 results · Clear filters · Feed
-
High 8.8CVE-2021-46366 Public exploit
Cross-Site Request Forgery in Magnolia CMS
An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery (CSRF) in order to brute force and exfiltrate users' credentials.
-
High 7.8CVE-2021-46365 Public exploit
Improper Restriction of XML External Entity Reference in Magnolia CMS
An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file.
-
High 7.8CVE-2021-46364 Public exploit
Deserialization of Untrusted Data in Magnolia CMS
A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file.
-
Unscored —CVE-2021-46362 Public exploit
A Server-Side Template Injection (SSTI) vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2…
-
High 7.8CVE-2021-46363 Public exploit
Arbitrary code execution in Magnolia CMS
An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas may result in arbitrary code execution on a victim's computer when opening the exported files with Mic…
-
Critical 9.8CVE-2021-46361 Public exploit
Arbitrary code execution in Magnolia CMS
An issue in the Freemark Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a crafted FreeMarker payload.
-
High 8.4
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functi…
KEV Aug 21, 2024 -
Low 2.2CVE-2022-24924 Public exploit
An improper access control in LiveWallpaperService prior to versions 3.0.9.0 allows to create a specific named system d…
-
Critical 9.8
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of A…
KEV Aug 25, 2022 -
Critical 9.1
Remote code execution for scripted UDFs
When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host.…
-
High 8.1
OS Command Injection in microweber/microweber
OS Command Injection in Packagist microweber/microweber prior to 1.2.11.
-
Unscored —CVE-2022-23773 Public exploit
Incorrect access control in the go command in cmd/go/internal/modfetch
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.