Archive
February 2022
Vulnerabilities first published in this month (UTC), newest first.
1,963 results · Feed
-
Unscored —
A local unquoted search path security vulnerability has been identified in HPE Agentless Management Service for Windows…
-
Unscored —
A potential local buffer overflow vulnerability has been identified in HPE FlexNetwork 5130 EL Switch Series version: P…
-
Unscored —
VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text wi…
-
Unscored —
When combined with specific software sequences, AMD CPUs may transiently execute non-canonical loads and store using on…
-
Unscored —
AMD Radeon Software may be vulnerable to DLL Hijacking through path variable. An unprivileged user may be able to drop …
-
Unscored —
AMD EPYC™ Processors contain an information disclosure vulnerability in the Secure Encrypted Virtualization with Encryp…
-
Critical 9.0
A heap-based buffer overflow vulnerability exists in the OTA Update u-download functionality of Sealevel Systems, Inc. …
-
High 8.1
A file write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.3…
-
High 7.7
A misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. This misconfigu…
-
High 8.8
A memory corruption vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.1.0.52543.…
-
High 8.8
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.1.0.52543. A …
-
High 8.6
A denial of service vulnerability exists in the Modbus configuration functionality of Sealevel Systems, Inc. SeaConnect…
-
High 8.6
A denial of service vulnerability exists in the SeaMax remote configuration functionality of Sealevel Systems, Inc. Sea…
-
Critical 10.0
A stack-based buffer overflow vulnerability exists in the NBNS functionality of Sealevel Systems, Inc. SeaConnect 370W …
-
Critical 10.0
A stack-based buffer overflow vulnerability exists in both the LLMNR functionality of Sealevel Systems, Inc. SeaConnect…
-
Low 3.7
An out-of-bounds write vulnerability exists in the URL_decode functionality of Sealevel Systems, Inc. SeaConnect 370W v…
-
High 7.4
An information disclosure vulnerability exists in the Web Server functionality of Sealevel Systems, Inc. SeaConnect 370…
-
Low 3.7
An out-of-bounds write vulnerability exists in the HandleSeaCloudMessage functionality of Sealevel Systems, Inc. SeaCon…
-
Low 3.7
An out-of-bounds write vulnerability exists in the HandleSeaCloudMessage functionality of Sealevel Systems, Inc. SeaCon…
-
High 7.8
A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon DCodeNumber parsing functio…
-
High 7.8
A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon GCodeNumber parsing functio…
-
High 8.8CVE-2022-23614 Public exploit
Code injection in Twig
Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced…
-
Unscored —
Emlog v6.0 was discovered to contain a SQL injection vulnerability via the $TagID parameter of getblogidsfromtagid().
-
High 7.5
Cross-Site Request Forgery in xwiki-platform
### Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually tied to that email by forging a request to the Forgot username page. Note that since this page does not have a CSRF check…
-
Unscored —
A remote code execution (RCE) vulnerability in HelloWorldAddonController.java of jpress v4.2.0 allows attackers to exec…
-
Unscored —CVE-2022-23329 EPSS 14%
A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows attackers to execute a…
-
High 7.7CVE-2022-24348 Public exploit
Path traversal and dereference of symlinks in Argo CD
Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.
-
Unscored —
options.c in atftp before 0.7.5 reads past the end of an array, and consequently discloses server-side /etc/group data …
-
High 7.5
Prototype Pollution
The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK…
-
High 8.2
Prototype Pollution
This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives f…
-
High 7.5
Prototype Pollution
This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-STRIKEENTCOS…
-
Unscored —
An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag,…
-
Unscored —
Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect u…
-
Unscored —CVE-2022-24129 Scanner template
The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery (SSRF) due to insuf…
-
Unscored —
Directory traversal in /northstar/Common/NorthFileManager/fileManagerObjects.jsp Northstar Technologies Inc NorthStar C…
-
Unscored —
Cleartext Transmission of Sensitive Information in /northstar/Admin/login.jsp in Northstar Technologies Inc NorthStar C…
-
Unscored —
Systemic Insecure Permissions in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated…
-
Unscored —
Directory travesal in /northstar/filemanager/download.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 a…
-
Unscored —
Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 al…
-
Unscored —
Remote Code Execution in cominput.jsp and comoutput.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 all…