Archive
February 2022
Vulnerabilities first published in this month (UTC), newest first.
1,963 results · Feed
-
High 8.4
Improper input validation in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) W…
-
Unscored —
Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header w…
-
Unscored —
Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP file…
-
Unscored —
Exponent CMS 2.6.0patch2 allows an authenticated admin user to inject persistent JavaScript code inside the "Site/Organ…
-
Unscored —
There is a race condition vulnerability in the binder driver subsystem in the kernel.Successful exploitation of this vu…
-
Unscored —
There is a permission verification vulnerability in the Bluetooth module.Successful exploitation of this vulnerability …
-
Unscored —
There is a vulnerability of signature verification mechanism failure in system upgrade through recovery mode.Successful…
-
Unscored —
There is an arbitrary address access vulnerability with the product line test code.Successful exploitation of this vuln…
-
Unscored —
There is a vulnerability of unstrict input parameter verification in the audio assembly.Successful exploitation of this…
-
Unscored —
There is an improper security permission configuration vulnerability on ACPU.Successful exploitation of this vulnerabil…
-
Unscored —
There is an improper memory access permission configuration on ACPU.Successful exploitation of this vulnerability may c…
-
Unscored —
There is a security protection bypass vulnerability with the modem.Successful exploitation of this vulnerability may ca…
-
Unscored —
There is an unauthorized rewriting vulnerability with the memory access management module on ACPU.Successful exploitati…
-
Unscored —
There is an unauthorized rewriting vulnerability with the memory access management module on ACPU.Successful exploitati…
-
Unscored —
There is an unauthorized rewriting vulnerability with the memory access management module on ACPU.Successful exploitati…
-
Unscored —
A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gif_get_code() an…
-
Critical 9.1
Prototype Pollution leading to Remote Code Execution in superjson
superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitrary code on any server using superjson input without prior authentication or knowledge. The only requ…
-
Medium 6.3
Array literal misordering in github.com/open-policy-agent/opa
OPA is an open source, general-purpose policy engine. Under certain conditions, pretty-printing an abstract syntax tree (AST) that contains synthetic nodes could change the logic of some statements by reordering array literals. Example of policies impacted ar…
-
High 7.4
Cross site scripting in registration template in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a cross site scripting (XSS) vector in the `registerinline.vm` template related to the `xredirect` hidden field. This templa…
-
Medium 5.5
Missing authorization in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can read any file located in the XWiki WAR (for example xwiki.cfg and xwiki.properties) through XWiki#invo…
-
Medium 6.8
Path traversal in xwiki-platform-skin-skinx
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandler#processSx does not escape anything from SSX document references when serializing it on filesy…
-
Medium 5.3
Information exposure in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to g…
-
Medium 4.7
Open Redirect in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is no protection against URL redirection to untrusted sites, in particular some well known parameters (xredirect) can be used t…
-
Medium 6.5
Missing authorization in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit right can copy the content of a page it does not have access to by using it as template of a new page. This issue …
-
High 8.8
Remote code execution in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for an unprivileged user to perform a remote code execution by injecting a groovy script in her own profile and by call…
-
Medium 5.4
Partial authorization bypass on document save in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming rig…
-
Medium 4.7
Select Dell Client Commercial and Consumer platforms are vulnerable to an insufficient verification of data authenticit…
-
Medium 6.9
Select Dell Client Commercial and Consumer platforms contain a pre-boot direct memory access (DMA) vulnerability. An au…
-
Critical 9.9
All Dell EMC Integrated System for Microsoft Azure Stack Hub versions contain a privilege escalation vulnerability. A r…
-
High 8.1CVE-2022-21660 Public exploit
Missing authorization in gin-vue-admin
Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higher privilege users. Authentication is missing on the `setUserInfo` function. Users are advised to update as soon as poss…
-
Unscored —
Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1) index.php, 2) bottom.php, and 3) to…
-
Unscored —
An HTTP smuggling attack in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthentica…
-
Critical 9.8
Reuse of one time passwords allowed in Gitea
An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once.
-
Critical 9.8
Improper Privilege Management in Gitea
An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains valid on the server side for reuse.
-
Unscored —
A DoS attack in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker…
-
Medium 5.3
Microsoft Outlook for Mac Security Feature Bypass Vulnerability
Microsoft Outlook for Mac Security Feature Bypass Vulnerability
-
High 7.8
SQL Server for Linux Containers Elevation of Privilege Vulnerability
SQL Server for Linux Containers Elevation of Privilege Vulnerability
-
High 8.8
Microsoft Dynamics GP Remote Code Execution Vulnerability
Microsoft Dynamics GP Remote Code Execution Vulnerability
-
High 7.1
Microsoft Dynamics GP Elevation Of Privilege Vulnerability
Microsoft Dynamics GP Elevation Of Privilege Vulnerability
-
High 8.1
Microsoft Dynamics GP Elevation Of Privilege Vulnerability
Microsoft Dynamics GP Elevation Of Privilege Vulnerability