Archive
February 2022
Vulnerabilities first published in this month (UTC), newest first.
398 results · Clear filters · Feed
-
Medium 5.3
Microsoft Outlook for Mac Security Feature Bypass Vulnerability
Microsoft Outlook for Mac Security Feature Bypass Vulnerability
-
Medium 6.5
Microsoft Dynamics GP Elevation Of Privilege Vulnerability
Microsoft Dynamics GP Elevation Of Privilege Vulnerability
-
Medium 5.4
Microsoft Dynamics GP Spoofing Vulnerability
Microsoft Dynamics GP Spoofing Vulnerability
-
Medium 5.9
Microsoft OneDrive for Android Security Feature Bypass Vulnerability
Microsoft OneDrive for Android Security Feature Bypass Vulnerability
-
Medium 4.9
Microsoft Power BI Information Disclosure Vulnerability
Microsoft Power BI Information Disclosure Vulnerability
-
Medium 5.5
Microsoft Office Information Disclosure Vulnerability
Microsoft Office Information Disclosure Vulnerability
-
Medium 5.5
Microsoft Excel Information Disclosure Vulnerability
Microsoft Excel Information Disclosure Vulnerability
-
Medium 5.6
Windows Hyper-V Denial of Service Vulnerability
Windows Hyper-V Denial of Service Vulnerability
-
Medium 5.5
Windows Common Log File System Driver Denial of Service Vulnerability
Windows Common Log File System Driver Denial of Service Vulnerability
-
Medium 5.5
Windows User Account Profile Picture Denial of Service Vulnerability
Windows User Account Profile Picture Denial of Service Vulnerability
-
Medium 5.5
Windows Common Log File System Driver Information Disclosure Vulnerability
Windows Common Log File System Driver Information Disclosure Vulnerability
-
Medium 5.5
Windows Remote Access Connection Manager Information Disclosure Vulnerability
Windows Remote Access Connection Manager Information Disclosure Vulnerability
-
Medium 4.3
Microsoft SharePoint Server Security Feature Bypass Vulnerability
Microsoft SharePoint Server Security Feature Bypass Vulnerability
-
Medium 6.5
Improper Privilege Management in chatwoot/chatwoot
Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2.
-
Medium 6.3
Cross-site Scripting (XSS) - Stored in ptrofimov/beanstalk_console
Cross-site Scripting (XSS) - Stored in Packagist ptrofimov/beanstalk_console prior to 1.7.14.
-
Medium 6.5
DoS vulnerability in bundled XStream library in Jenkins Core
Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage.
-
Medium 4.6
Denial-of-Service (DoS) Vulnerability
A vulnerability affecting F-Secure antivirus engine before Capricorn update 2022-02-01_01 was discovered whereby decompression of ACE file causes the scanner service to stop. The vulnerability can be exploited remotely by an attacker. A successful attack will…
-
Medium 6.1
Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot
Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.
-
Medium 6.1
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), …
KEV Feb 25, 2022 -
Medium 5.0
Inadequate access verification when using proxy commands in ArchiSteamFarm
ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code, introduced in version V5.2.2.2, the program didn't adequately verify effective access of the user sending prox…
-
Medium 5.4
Studio 42 elFinder allows stored XSS
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.
-
Medium 6.1
Cross-site Scripting in Gitea
Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field.
-
Medium 6.5
Business Logic Errors in publify/publify
Business Logic Errors in GitHub repository publify/publify prior to 9.2.7.
-
Medium 6.3
Access of Memory Location Before Start of Buffer in radareorg/radare2
Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2.
-
Medium 4.3
Exposure of Sensitive Information in Grafana
Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by q…
-
Medium 6.3
Access of Memory Location After End of Buffer in radareorg/radare2
Access of Memory Location After End of Buffer in GitHub repository radareorg/radare2 prior to 5.6.2.
-
Medium 6.3
Cross Site Request Forgery in Grafana
Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-pri…
-
Medium 6.3
Buffer Access with Incorrect Length Value in radareorg/radare2
Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5.6.2.
-
Medium 6.3
Heap-based Buffer Overflow in radareorg/radare2
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2.
-
Medium 6.5
Cross site scripting in Grafana proxy
Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cr…
-
Medium 6.1CVE-2021-45328 Scanner template
Open redirect in Gitea
Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs.
-
Medium 5.3
Gitea displaying raw OpenID error in UI
Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.
-
Medium 4.3
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1.
-
Medium 6.6
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1.
-
Medium 6.5
Server-Side Request Forgery (SSRF) in chocobozzz/peertube
Server-Side Request Forgery (SSRF) in GitHub repository chocobozzz/peertube prior to f33e515991a32885622b217bf2ed1d1b0d9d6832
-
Medium 6.5
Generation of Error Message Containing Sensitive Information in microweber/microweber
Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.
-
Medium 5.7
Cross-Site Request Forgery (CSRF) in microweber/microweber
Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.
-
Medium 5.5
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where a user in the guest OS can …
-
Medium 5.5
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for priv…
-
Medium —CVE-2022-22931 Public exploit
Path traversal in Apache James 3.6.1
Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by …