Archive
16 February 2022
Vulnerabilities first published on this day (UTC), newest first.
95 results · Feed
-
Medium 6.5
Incorrect authorization in Drupal core
The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit mo…
-
High —
Server crash if running Python 3.10 w/ Sanic 20.12
**!!! ONLY APPLIES TO VERSIONS PRIOR TO Sanic v20.12 WHEN USING Python 3.10 !!!** Sanic v20.12 officially supports Python versions 3.6, 3.7, 3.8, and 3.9. However, if you accidentally run it with version 3.10 (**which is not supported by Sanic 20.12**), your …
-
Medium 5.1CVE-2022-23636 Public exploit
Invalid drop of partially-initialized instances in wasmtime
Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an `externref` glob…
-
Critical 9.8
Improper Certificate Validation in Hutool
Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation.
-
Critical 9.8
SQL Injection in Jeecg-boot
Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId.
-
Critical 9.8
SQL Injection in Jeecg-boot
Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData.
-
Unscored —
Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to bypass authentication and…
-
Unscored —
Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated…
-
Unscored —
Forms generated by JQueryForm.com before 2022-02-05 allow remote attackers to obtain the URI to any uploaded file by ca…
-
Unscored —
Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to access the cleartext cred…
-
Unscored —
A reflected cross-site scripting (XSS) vulnerability in forms generated by JQueryForm.com before 2022-02-05 allows remo…
-
Unscored —CVE-2022-25265 Public exploit
In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approxi…
-
Unscored —
DuxCMS v3.1.3 was discovered to contain a SQL injection vulnerability via the component s/tools/SendTpl/index?keyword=.
-
Unscored —
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from t…
-
Unscored —
A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket a…
-
Unscored —
A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised …
-
Unscored —CVE-2021-3773 Public exploit
A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for furth…
-
Unscored —
A flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat to confident…
-
High 8.8
Server-side request forgery in BookWyrm
BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible…
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to…
-
Unscored —
This advisory addresses a similar issue to [Drupal core - Moderately critical - Information disclosure - SA-CORE-2022-0…
-
High 7.3
Prototype Pollution
This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized …
-
Low 2.4
IBM Maximo Anywhere 7.6.4.0 applications could allow obfuscation of the application source code. IBM X-Force ID: 161494.
-
Low 2.1
IBM Maximo Anywhere 7.6.4.0 applications could disclose sensitive information to a user with physical access to the dev…
-
Medium 6.5
IBM Maximo Anywhere 7.6.4.0 could allow an attacker to reverse engineer the application due to the lack of binary prote…
-
Unscored —
VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge applianc…
-
High 7.8
A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadIJCoord coordinate pars…
-
High 7.8
A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadXYCoord coordinate pars…
-
Medium 5.3
An information disclosure vulnerability exists in the HTTP Server /ping.html functionality of Texas Instruments CC3200 …
-
High 7.8
A heap-based buffer overflow vulnerability exists in the Hword HwordApp.dll functionality of Hancom Office 2020 11.0.0.…
-
High 7.0
Adobe Creative Cloud Desktop Uncontrolled Search Path Element Arbitrary code execution
Adobe Creative Cloud Desktop version 2.7.0.13 (and earlier) is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction…
-
Critical 9.8
Adobe Commerce checkout improper input validation leads to remote code execution
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code e…
KEV Feb 15, 2022 -
High 7.8
Adobe After Effects 3GP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe After Effects versions 22.1.1 (and earlier) and 18.4.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interact…
-
Medium 5.5
Adobe Premiere Rush JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe Premiere Rush versions 2.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue re…
-
Medium 5.5
Adobe Illustrator Out-of-bounds Read could lead to Memory leak
Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. E…
-
High 7.8
Adobe Photoshop Buffer Overflow could lead to Arbitrary code execution
Adobe Photoshop versions 22.5.4 (and earlier) and 23.1 (and earlier) are affected by a buffer overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution in the context of the current user. Exploitation…
-
Medium 5.5
Adobe Illustrator NULL Pointer Dereference Application denial-of-service
Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the …
-
Medium 5.5
Adobe Illustrator NULL Pointer Dereference Application denial-of-service
Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the …
-
Medium 5.5
Adobe Illustrator Out-of-bounds Read could lead to Memory leak
Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. E…
-
Medium 5.5
Adobe Illustrator Out-of-bounds Read could lead to Memory leak
Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. E…