Archive
25 February 2022
Vulnerabilities first published on this day (UTC), newest first.
88 results · Feed
-
High 7.2
Multi-use invitations can grant access to other organizations in Zulip
Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control with multi-use invitations. A Zulip Server deployment which hosts multiple organizations is vulnerab…
-
Unscored —
Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parame…
-
Unscored —
Home Owners Collection Management System v1.0 allows unauthenticated attackers to compromise user accounts via a crafte…
-
Unscored —CVE-2022-25094 EPSS 23%
Home Owners Collection Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via…
-
Medium 5.4
Cross-site Scripting in Weblate
Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via…
-
Unscored —CVE-2022-24442 Public exploit
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
-
Unscored —
JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS.
-
Unscored —CVE-2022-25260 Public exploit
JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF).
-
Medium 5.4
Open Redirect
The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter.
-
Unscored —
JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS.
-
Unscored —CVE-2022-25262 Public exploit
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible.
-
Unscored —
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration.
-
Unscored —
In JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be logged in some cases.
-
Unscored —
Zepl Notebooks before 2021-10-25 are affected by a sandbox escape vulnerability. Upon launching Remote Code Execution f…
-
Unscored —
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_se…
-
Unscored —
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a remote code execution (RCE) vulnerability via the functi…
-
Unscored —CVE-2022-25062 Public exploit
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain an integer overflow via the function dm_checkString. This …
-
Unscored —
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_st…
-
Unscored —CVE-2021-44132 Public exploit
A command injection vulnerability in the function formImportOMCIShell of C-DATA ONU4FERW V2.1.13_X139 allows attackers …
-
Unscored —
A cross-site scripting (XSS) vulnerability in PaquitoSoftware Notimoo v1.2 allows attackers to execute arbitrary web sc…
-
Medium 6.1
jQuery-Upload-File XSS in fileNameStr
A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name.
-
Unscored —
PCManager versions 11.1.1.95 has a privilege escalation vulnerability. Successful exploit could allow the attacker to a…
-
Unscored —
The laser command injection vulnerability exists on AIS-BW80H-00 versions earlier than AIS-BW80H-00 9.0.3.4(H100SP13C00…
-
Unscored —
There is an improper permission management vulnerability in the Wallet apps. Successful exploitation of this vulnerabil…
-
Unscored —
There is a memory address out of bounds in smartphones. Successful exploitation of this vulnerability may cause malicio…
-
Unscored —
There is a vulnerability when configuring permission isolation in smartphones. Successful exploitation of this vulnerab…
-
Unscored —
There is a memory address out of bounds in smartphones. Successful exploitation of this vulnerability may cause malicio…
-
Unscored —
There is a logic bypass vulnerability in smartphones. Successful exploitation of this vulnerability may cause code inje…
-
Unscored —
There is a vulnerability when configuring permission isolation in smartphones. Successful exploitation of this vulnerab…
-
Unscored —
There is a memory address out of bounds in smartphones. Successful exploitation of this vulnerability may cause malicio…
-
Unscored —
There is a memory address out of bounds vulnerability in smartphones. Successful exploitation of this vulnerability may…
-
Unscored —
There is a buffer overflow vulnerability in smartphones. Successful exploitation of this vulnerability may cause DoS of…
-
Unscored —
There is a code injection vulnerability in smartphones. Successful exploitation of this vulnerability may affect servic…
-
Unscored —
There is an improper verification vulnerability in smartphones. Successful exploitation of this vulnerability may cause…
-
Unscored —
There is a DoS vulnerability in smartphones. Successful exploitation of this vulnerability may affect service integrity.
-
Unscored —
There is a DoS vulnerability in smartphones. Successful exploitation of this vulnerability may affect service availabil…
-
Unscored —
There is an improper verification vulnerability in smartphones. Successful exploitation of this vulnerability may cause…
-
Unscored —
The interface of a certain HarmonyOS module has an integer overflow vulnerability. Successful exploitation of this vuln…
-
Unscored —
There is a software integer overflow leading to a TOCTOU condition in smartphones. Successful exploitation of this vuln…
-
Unscored —
The interface of a certain HarmonyOS module has an invalid address access vulnerability. Successful exploitation of thi…