Archive
February 2022
Vulnerabilities first published in this month (UTC), newest first.
429 results · Clear filters · Feed
-
High 7.9
Windows Hyper-V Remote Code Execution Vulnerability
Windows Hyper-V Remote Code Execution Vulnerability
-
High 7.8
Windows DWM Core Library Elevation of Privilege Vulnerability
Windows DWM Core Library Elevation of Privilege Vulnerability
-
High 7.5CVE-2022-21993 EPSS 44%
Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability
Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability
-
High 7.8
Windows Mobile Device Management Remote Code Execution Vulnerability
Windows Mobile Device Management Remote Code Execution Vulnerability
-
High 8.1
Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
-
High 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft Office Visio Remote Code Execution Vulnerability
-
High 8.0
Microsoft SharePoint Server Spoofing Vulnerability
Microsoft SharePoint Server Spoofing Vulnerability
-
High 7.5
.NET Denial of Service Vulnerability
.NET Denial of Service Vulnerability
-
High 8.8
Windows DNS Server Remote Code Execution Vulnerability
Windows DNS Server Remote Code Execution Vulnerability
-
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
-
High 7.8CVE-2022-21974 Public exploit
Roaming Security Rights Management Services Remote Code Execution Vulnerability
Roaming Security Rights Management Services Remote Code Execution Vulnerability
-
High 7.8
Windows Runtime Remote Code Execution Vulnerability
Windows Runtime Remote Code Execution Vulnerability
KEV Aug 18, 2022 -
High 7.5
Microsoft Teams Denial of Service Vulnerability
Microsoft Teams Denial of Service Vulnerability
-
High 7.2
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
-
High 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
HEVC Video Extensions Remote Code Execution Vulnerability
-
High 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
HEVC Video Extensions Remote Code Execution Vulnerability
-
High 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
HEVC Video Extensions Remote Code Execution Vulnerability
-
High 7.5
A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 20…
-
High 7.5
A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC Drive Controlle…
-
High 7.5
A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 20…
-
High 7.8
LPE in ESET products for Windows
ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\SYSTEM.
-
High 7.3
Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot
Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.
-
High 8.4
Out-of-bounds Read in mruby/mruby
Out-of-bounds Read in Homebrew mruby prior to 3.2.
-
High 7.5
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locat…
-
High 8.5CVE-2022-23626 Public exploit
Insufficient file checks in m1k1o/blog
m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*` have not been checked properly. Although PHP issued warnings and the upload function returned `false`, the original file (that could contai…
-
High 8.8
Use After Free in radareorg/radare2
Use After Free in NPM radare2.js prior to 5.6.2.
-
High 7.1
Use After Free in radareorg/radare2
Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0.
-
High 8.8
Cross Site Request Forgery in Gitea
Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
-
High 7.7
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
-
High 8.8
Incorrect Authorization in NATS nats-server
NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature.
-
High 8.8
Use After Free in radareorg/radare2
Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.
-
High 8.1
Validation bypass in frourio
Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work properly for r…
-
High 8.1
Validation bypass in frourio-express
Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Valid…
-
High 8.2
The RNDIS USB device class includes a buffer overflow vulnerability
The RNDIS USB device class includes a buffer overflow vulnerability. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hvfp-w4h8-gxvj
-
High 8.2
Buffer overflow in usb device class
Buffer overflow in usb device class. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fm6v-8625-99jf
-
High 7.8
Privilege escalation on xrdp
xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root.…
-
High 7.7
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
High 7.5
Cookie and header exposure in twisted
twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLike…
-
High 7.5
Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth
In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach.