Archive
February 2022
Vulnerabilities first published in this month (UTC), newest first.
1,963 results · Feed
-
High 8.3
Mitsubishi Electric Factory Automation Products Path Traversal
Multiple Mitsubishi Electric Factory Automation products have a vulnerability that allows an attacker to execute arbitrary code.
-
Unscored —
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that coul…
-
High 8.3
Mitsubishi Electric Factory Automation Engineering Products Unquoted Search Path or Element
Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use this vulnerability to obtain information, modify information, and cause a denial-of-service condition.
-
Unscored —
An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissio…
-
Medium 5.7
Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.15-6 allows privileged attackers to trig…
-
Medium 4.2
Improper privilege management vulnerability in Samsung Video Player prior to version 7.3.15.30 allows attackers to exec…
-
Medium 4.4
Improper input validation vulnerability in SettingsProvider prior to Android S(12) allows privileged attackers to trigg…
-
Low 2.2CVE-2022-24924 Public exploit
An improper access control in LiveWallpaperService prior to versions 3.0.9.0 allows to create a specific named system d…
-
Medium 4.0
Improper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrust…
-
Medium 4.0
Exposure of Sensitive Information vulnerability in Bixby Vision prior to version 3.7.50.6 allows attackers to access in…
-
Medium 4.0
Improper Authorization vulnerability in Link Sharing prior to version 12.4.00.3 allows attackers to open protected acti…
-
Low 3.8
Information disclosure vulnerability in Edge Panel prior to Android S(12) allows physical attackers to access screensho…
-
Low 3.9
PendingIntent hijacking vulnerability in DataUsageReminderReceiver prior to SMR Feb-2022 Release 1 allows local attacke…
-
Low 3.9
PendingIntent hijacking vulnerability in CpaReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access m…
-
Medium 6.2
Improper access control vulnerability in Camera prior to versions 11.1.02.16 in Android R(11), 10.5.03.77 in Android Q(…
-
Medium 4.0
Unprotected component vulnerability in StTheaterModeDurationAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2…
-
Medium 4.0
Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release a…
-
Low 3.3
An Improper access control vulnerability in StBedtimeModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Rele…
-
Medium 4.0
Unprotected component vulnerability in StBedtimeModeAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Rele…
-
Medium 4.4
A vulnerability using PendingIntent in Bixby Vision prior to versions 3.7.60.8 in Android S(12), 3.7.50.6 in Andorid R(…
-
Medium 4.3
Improper access control vulnerability in Reminder prior to versions 12.3.01.3000 in Android S(12), 12.2.05.6000 in Andr…
-
Medium 6.4
An improper boundary check in RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code executio…
-
Medium 6.4
An improper input validation in SMC_SRPMB_WSM handler of RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary mem…
-
Medium 5.3
An improper boundary check in audio hal service prior to SMR Feb-2022 Release 1 allows attackers to read invalid memory…
-
High 8.4
An improper boundary check in eden_runtime hal service prior to SMR Feb-2022 Release 1 allows arbitrary memory write an…
-
Low 3.9
PendingIntent hijacking vulnerability in KnoxPrivacyNoticeReceiver prior to SMR Feb-2022 Release 1 allows local attacke…
-
Medium 4.4
A vulnerability using PendingIntent in DeX Home and DeX for PC prior to SMR Feb-2022 Release 1 allows attackers to acce…
-
High 8.6
Improper input validation in Exynos baseband prior to SMR Feb-2022 Release 1 allows attackers to send arbitrary NAS sig…
-
High 7.1
Unprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitra…
-
Medium 5.5
Logging of excessive data vulnerability in telephony prior to SMR Feb-2022 Release 1 allows privileged attackers to get…
-
Medium 5.4
TCMAN GIM Cross-Site Scripting (XSS)
The m_txtNom y m_txtCognoms parameters in TCMAN GIM v8.01 allow an attacker to perform persistent XSS attacks. This vulnerability could be used to carry out a number of browser-based attacks including browser hijacking or theft of sensitive data.
-
Low 3.5
Wocu Monitoring stored Cross-Site Scripting (XSS)
A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports.
-
Unscored —CVE-2021-31932 EPSS 22%
Nokia BTS TRS web console FTM_W20_FP2_2019.08.16_0010 allows Authentication Bypass. A malicious unauthenticated user ca…
-
Medium 4.4
Path Traversal in S-Cart
A Directory Traversal vulnerability exists in S-Cart 6.7 via download in sc-admin/backup.
-
High 7.5
Denial of Service (DoS)
This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. **Note:** This is a bypass of CVE-2020-8136 (https://security.snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-1290382).
-
High 7.5
Drupal core access bypass vulnerability
Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.
-
Unscored —
A Cross Site Scripting (XSS) vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allo…
-
Medium 6.5
Incorrect Authorization in Drupal core
The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
-
High 7.5
Exposure of Resource to Wrong Sphere in Drupal Core
Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x version…
-
Medium 6.5
Cross-Site Request Forgery in Drupal core
The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard …