Archive
February 2022
Vulnerabilities first published in this month (UTC), newest first.
429 results · Clear filters · Feed
-
High 8.1
Missing Authorization in Rundeck
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. M…
-
High 7.5
HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling
HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0.18, 1.1.12, and 1.2.6.
-
High 8.6
Server-Side Request Forgery (SSRF) in rudloff/alltube
Server-Side Request Forgery (SSRF) in GitHub repository rudloff/alltube prior to 3.0.2.
-
High 8.2
UAF due to php_filter_float() failing
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which c…
-
High 8.0
Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.11.
-
High 7.5
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
-
High 7.2CVE-2022-26149 Public exploit
Unrestricted Upload of File with Dangerous Type in MODX Revolution
MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.
-
High 7.2
Multi-use invitations can grant access to other organizations in Zulip
Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control with multi-use invitations. A Zulip Server deployment which hosts multiple organizations is vulnerab…
-
High 8.1
Gabia Firstmall remote code execution vulnerability
This issues due to insufficient verification of the various input values from user’s input. The vulnerability allows remote attackers to execute malicious code in Firstmall via navercheckout_add function.
-
High 7.5
ICSA-22-053-02 GE Proficy CIMPLICITY-Cleartext
The affected product is vulnerable due to cleartext transmission of credentials seen in the CIMPLICITY network, which can be easily spoofed and used to log in to make operational changes to the system.
-
High 7.5
ICSA-22-053-01 GE Proficy CIMPLICITY-IPM
Exploitation of this vulnerability may result in local privilege escalation and code execution. GE maintains exploitation of this vulnerability is only possible if the attacker has login access to a machine actively running CIMPLICITY, the CIMPLICITY server i…
-
High 7.8
ICSA-22-055-01 FATEK Automation FvDesigner
The affected product is vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary code
-
High 7.8
ICSA-22-055-01 FATEK Automation FvDesigner
The affected product is vulnerable to an out-of-bounds read while processing project files, which allows an attacker to craft a project file that would allow arbitrary code execution.
-
High 7.8
ICSA-22-055-01 FATEK Automation FvDesigner
The affected product is vulnerable to an out-of-bounds write while processing project files, which allows an attacker to craft a project file that would allow arbitrary code execution.
-
High 7.5
Write access to VMO data through copy-on-write in Fuchsia
An issue exists in Fuchsia where VMO data can be modified through access to copy-on-write snapshots. A local attacker could modify objects in the VMO that they do not have permission to. We recommend upgrading past commit d97c05d2301799ed585620a9c5c739d36e7b5…
-
High 8.8
Apache JSPWiki CSRF Account Takeover
Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
-
High 8.8
Apache Airflow: RCE in example DAGs
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
-
High 8.8
Cross site scripting in @awsui/components-react
@awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface development. Multiple components in versions before 3.0.367 have been found to not properly neutralize user input and m…
-
High 8.8
ICSA-20-140-02 Emerson OpenEnterprise
Inadequate folder security permissions in Emerson OpenEnterprise versions through 3.3.4 may allow modification of important configuration files, which could cause the system to fail or behave in an unpredictable manner.
-
High 7.1
IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611
A local, authenticated attacker could use an XML External Entity (XXE) attack to exploit weakly configured XML files to access local or remote content. A successful exploit could potentially cause a denial-of-service condition and allow the attacker to arbitr…
-
High 7.8
The DeskLock tool provided with FactoryTalk View SE uses a weak encryption algorithm that may allow a local, authentica…
-
High 7.2
WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via platform
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers to inject arbitrary web scripts o…
-
High 7.2CVE-2022-25305 EPSS 79%
WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via IP
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto seve…
-
High 7.2
WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via browser
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the ~/includes/class-wp-statistics-visitor.php file which allows attackers to inject arbitrary web scripts…
-
High 8.1
Multi-Factor Authentication issue in Laravel Fortify
Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.
-
High 8.8
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a…
KEV Apr 11, 2022 -
High 7.4CVE-2022-24707 Public exploit
SQL injection in anuko timetracker
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker Puncher plugin in versions of anuko timetracker prior to 1.20.0.5642. This was…
-
High 7.5
IBM Sterling External Authentication Server and IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 could allow a r…
-
High 7.2CVE-2022-21705 Scanner template
Authenticated remote code execution in octobercms
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vu…
-
High 8.6CVE-2022-20623 EPSS 12%
Cisco Nexus 9000 Series Switches Bidirectional Forwarding Detection Denial of Service Vulnerability
A vulnerability in the rate limiter for Bidirectional Forwarding Detection (BFD) traffic of Cisco NX-OS Software for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to cause BFD traffic to be dropped on an affected device. Thi…
-
High 8.6CVE-2022-20624 EPSS 12%
Cisco NX-OS Software Cisco Fabric Services Over IP Denial of Service Vulnerability
A vulnerability in the Cisco Fabric Services over IP (CFSoIP) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validat…
-
High 8.8CVE-2022-20650 EPSS 15%
Cisco NX-OS Software NX-API Command Injection Vulnerability
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation of user supplied data that is sent to the…
-
High 7.3
Denial of Service in radareorg/radare2
Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.
-
High 8.8
Insertion of Sensitive Information Into Debugging Code in microweber/microweber
Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to 1.3.
-
High 7.6
Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.
-
High 8.2
Insecure Temporary File in mlflow/mlflow
Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.
-
High 7.8
Use of Out-of-range Pointer Offset in vim/vim
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440.
-
High 8.1
Exposure of Sensitive Information to an Unauthorized Actor in fgribreau/node-request-retry
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0.
-
High 7.5
Directory Traversal in OpenMRS Startup Filter
OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system. Affected versions are subject to arbitrary file exfiltration due to failure to sanitize request when satisfying GET requests fo…
-
High 7.5
Crash when tunneling TCP over HTTP in Envoy
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when configured for :ref:`upstream tunneling <envoy_v3_api_field_extensions.filters.network.tcp_proxy.v3.TcpProxy.tunneling_co…