Archive
23 February 2022
Vulnerabilities first published on this day (UTC), newest first.
46 results · Feed
-
High 7.4CVE-2022-24707 Public exploit
SQL injection in anuko timetracker
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker Puncher plugin in versions of anuko timetracker prior to 1.20.0.5642. This was…
-
Medium 6.5
Stored XSS vulnerability in anuko/timetracker
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to …
-
Medium 4.8
Missing server signature validation in OctoberCMS
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advis…
-
Medium 4.7
B2 Command Line Tool TOCTOU application key disclosure
B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by …
-
Medium 4.7
b2-sdk-python TOCTOU application key disclosure
b2-sdk-python is a python library to access cloud storage provided by backblaze. Linux and Mac releases of the SDK version 1.14.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-…
-
Medium 5.9
Dell BSAFE SSL-J contains remediation for a covert timing channel vulnerability that may be exploited by malicious user…
-
Unscored —
Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in change_box.php via the DELETE_STR paramete…
-
Unscored —
A vulnerability in the component /languages/index.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via…
-
Critical 9.1
Arbitrary file delete in ectouch/ectouch
ECTouch v2 suffers from arbitrary file deletion due to insufficient filtering of the filename parameter.
-
Unscored —
A vulnerability in the component /templates/install.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code v…
-
Unscored —
HorizontCMS v1.0.0-beta.2 was discovered to contain an arbitrary file download vulnerability via the component /admin/f…
-
Unscored —
The copy function of the file manager in Cuppa CMS v1.0 allows any file to be copied to the current directory, granting…
-
Unscored —
HMS v1.0 was discovered to contain a SQL injection vulnerability via the component admin.php.
-
Unscored —
An incorrect access control issue in HMS v1.0 allows unauthenticated attackers to read and modify all PHP files.
-
Unscored —
Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in delete.php via the DELETE_STR parameter.
-
Unscored —
Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in delete_query.php via the DELETE_STR parame…
-
Unscored —
A Directory Traversal vulnerability exists in WeBankPartners wecube-platform 3.2.1 via the file variable in PluginPacka…
-
Critical 9.8
Access Control vulnerability within CoreNLP
An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).
-
Medium 5.9
Off-by-one Error in v2fly/v2ray-core
Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0.
-
High 7.5
IBM Sterling External Authentication Server and IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 could allow a r…
-
Medium 6.5
IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 and IBM Sterling External Authentication Server are vulnerable …
-
Unscored —
Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) URLs, (2) lang_id, (3) tmpl_id, …
-
High 7.2CVE-2022-21705 Scanner template
Authenticated remote code execution in octobercms
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vu…
-
Unscored —
Multiple Cross Site Scripting (XSS) vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) file parameter and…
-
Unscored —
A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file.
-
Medium 5.4
Improper Access Control (IDOR) in dolibarr/dolibarr
Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0.
-
Unscored —
A Cross Site Scripting (XSS) vulnerability exits in Subrion CMS through 4.2.1 in the Create Page functionality of the a…
-
High 8.6CVE-2022-20623 EPSS 12%
Cisco Nexus 9000 Series Switches Bidirectional Forwarding Detection Denial of Service Vulnerability
A vulnerability in the rate limiter for Bidirectional Forwarding Detection (BFD) traffic of Cisco NX-OS Software for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to cause BFD traffic to be dropped on an affected device. Thi…
-
High 8.6CVE-2022-20624 EPSS 12%
Cisco NX-OS Software Cisco Fabric Services Over IP Denial of Service Vulnerability
A vulnerability in the Cisco Fabric Services over IP (CFSoIP) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validat…
-
Medium 4.3
Cisco FXOS and NX-OS Software Cisco Discovery Protocol Service Denial of Service Vulnerability
A vulnerability in the Cisco Discovery Protocol service of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause the service to restart, resulting in a denial of service (DoS) condition. This vulnerability is …
-
High 8.8CVE-2022-20650 EPSS 15%
Cisco NX-OS Software NX-API Command Injection Vulnerability
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation of user supplied data that is sent to the…
-
Unscored —
The GOV.UK Theme (`govuk_theme`) is a Drupal theme for the GOV.UK Design System. The theme doesn't sanitize user input …
-
Unscored —
This module provides an entity relationship hierarchy tree widget for an entity reference field. The module doesn't suf…
-
High 7.3
Denial of Service in radareorg/radare2
Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.
-
Unscored —
Piwigo version 12.2.0 is vulnerable to stored cross-site scripting (XSS), which can lead to privilege escalation. In th…
-
Medium 5.4
Improper Access Control in chocobozzz/peertube
Improper Access Control in GitHub repository chocobozzz/peertube prior to 4.1.0.
-
Unscored —
In Checkmk <=2.0.0p19 fixed in 2.0.0p20 and Checkmk <=1.6.0p27 fixed in 1.6.0p28, the title of a Predefined condition i…
-
Critical 9.1
Insecure Storage of Sensitive Information in microweber/microweber
Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.
-
High 8.8
Insertion of Sensitive Information Into Debugging Code in microweber/microweber
Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to 1.3.
-
High 7.6
Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.