Archive
24 February 2022
Vulnerabilities first published on this day (UTC), newest first.
92 results · Feed
-
Medium 5.3
The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, un…
-
Unscored —
There is a directory traversal vulnerability in some home gateway products of ZTE. Due to the lack of verification of u…
-
Unscored —
Hospital Patient Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the id param…
-
Unscored —
A local file inclusion in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary code via…
-
Unscored —
Hospital Patient Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the id param…
-
Medium 4.3
IBM Sterling External Authentication Server 3.4.3.2, 6.0.2.0, and 6.0.3.0 is vulnerable to path traversals, due to not …
-
Medium 4.4
IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow…
-
Medium 6.2
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kerne…
-
Medium 6.2
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kerne…
-
Medium 6.1
Cybonet - PineApp Mail Relay Local File Inclusion
Cybonet - PineApp Mail Relay Local File Inclusion. Attacker can send a request to : /manage/mailpolicymtm/log/eml_viewer/email.content.body.php?filesystem_path=ENCDODED PATH and by doing that, the attacker can read Local Files inside the server.
-
Medium 6.8
Cybonet - PineApp Mail Relay Unauthenticated Sql Injection
Cybonet - PineApp Mail Relay Unauthenticated Sql Injection. Attacker can send a request to: /manage/emailrichment/userlist.php?CUSTOMER_ID_INNER=1 /admin/emailrichment/userlist.php?CUSTOMER_ID_INNER=1 /manage/emailrichment/usersunlist.php?CUSTOMER_ID_INNER=1 …
-
Unscored —
The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or aut…
-
Medium 6.5
HashiCorp Consul Ingress Gateway Panic Can Shutdown Servers
HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic. Fixed in 1.9.15, 1.10…
-
Medium 5.5
Uncaught Exception in zip4j
zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library.
-
Medium 5.5
Allocation of Resources Without Limits or Throttling in metadata-extractor
When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against…
-
Medium 5.5
Improper Handling of Exceptional Conditions inn metadata-extractor
metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash. This could be used to mount a denial of service attack against services that use metadata-extractor …
-
Medium 6.8
Denial of Service in radareorg/radare2
Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.
-
Unscored —
Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi…
-
Medium 5.3
EC-CUBE improperly handles HTTP Host header values
EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE use…
-
Unscored —
Cross-site scripting vulnerability in phpUploader v1.2 and earlier allows a remote unauthenticated attacker to inject a…
-
Unscored —
Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versio…
-
Unscored —
SQL injection vulnerability in the phpUploader v1.2 and earlier allows a remote unauthenticated attacker to obtain the …
-
Unscored —
Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versio…
-
Unscored —
Template injection (Improper Neutralization of Special Elements Used in a Template Engine) vulnerability in a-blog cms …
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (…
-
Unscored —
Authentication bypass vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.74, Ver.2.9.x series versi…
-
Unscored —
An integer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to trigger a heap-…
-
Unscored —
WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to retrieve …
-
Unscored —
WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to modify pr…
-
Unscored —
A systemd stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker …
-
Unscored —
A wgagent stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker …
-
Unscored —
WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload fi…
-
Unscored —
Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privil…
-
Medium 4.7
Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 throu…
-
Unscored —
A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a S…
-
Unscored —
A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a S…
-
Unscored —
An security agent resource exhaustion denial-of-service vulnerability in Trend Micro Apex One, Trend Micro Apex One as …
-
Unscored —
A link following privilege escalation vulnerability in Trend Micro Antivirus for Max 11.0.2150 and below could allow a …
-
Unscored —
Uncaught exceptions that can be generated in Trend Micro ServerProtection 6.0/5.8 Information Server could allow a remo…
-
Unscored —
Integer overflow conditions that exist in Trend Micro ServerProtect 6.0/5.8 Information Server could allow a remote att…