Archive
February 2022
Vulnerabilities first published in this month (UTC), newest first.
1,963 results · Feed
-
Medium 5.5
Improper Handling of Exceptional Conditions inn metadata-extractor
metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash. This could be used to mount a denial of service attack against services that use metadata-extractor …
-
Medium 6.8
Denial of Service in radareorg/radare2
Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.
-
Unscored —
Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi…
-
Medium 5.3
EC-CUBE improperly handles HTTP Host header values
EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE use…
-
Unscored —
Cross-site scripting vulnerability in phpUploader v1.2 and earlier allows a remote unauthenticated attacker to inject a…
-
Unscored —
Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versio…
-
Unscored —
SQL injection vulnerability in the phpUploader v1.2 and earlier allows a remote unauthenticated attacker to obtain the …
-
Unscored —
Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versio…
-
Unscored —
Template injection (Improper Neutralization of Special Elements Used in a Template Engine) vulnerability in a-blog cms …
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (…
-
Unscored —
Authentication bypass vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.74, Ver.2.9.x series versi…
-
Unscored —
An integer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to trigger a heap-…
-
Unscored —
WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to retrieve …
-
Unscored —
WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to modify pr…
-
Unscored —
A systemd stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker …
-
Unscored —
A wgagent stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker …
-
Unscored —
WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload fi…
-
Unscored —
Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privil…
-
Medium 4.7
Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 throu…
-
Unscored —
A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a S…
-
Unscored —
A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a S…
-
Unscored —
An security agent resource exhaustion denial-of-service vulnerability in Trend Micro Apex One, Trend Micro Apex One as …
-
Unscored —
A link following privilege escalation vulnerability in Trend Micro Antivirus for Max 11.0.2150 and below could allow a …
-
Unscored —
Uncaught exceptions that can be generated in Trend Micro ServerProtection 6.0/5.8 Information Server could allow a remo…
-
Unscored —
Integer overflow conditions that exist in Trend Micro ServerProtect 6.0/5.8 Information Server could allow a remote att…
-
Unscored —
Trend Micro ServerProtect 6.0/5.8 Information Server uses a static credential to perform authentication when a specific…
-
High 8.1
Multi-Factor Authentication issue in Laravel Fortify
Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.
-
Unscored —
An issue was discovered in USBGuard before 1.1.0. On systems with the usbguard-dbus daemon running, an unprivileged use…
-
Unscored —CVE-2022-25640 Public exploit
In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can…
-
Unscored —
In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to …
-
High 8.8
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a…
KEV Apr 11, 2022 -
Critical 9.8
A potential vulnerability in the Oracle Talent Acquisition Cloud - Taleo Enterprise Edition. This high severity potenti…
-
Unscored —CVE-2022-21824 EPSS 22%
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be pass…
-
Critical 9.8
WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inj…
-
Unscored —
A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage() in coders/svg…
-
Unscored —
A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in ReadTIFFImage() i…
-
Unscored —
A flaw was found in htmldoc in v1.9.12. Heap buffer overflow in pspdf_prepare_page(),in ps-pdf.cxx may lead to execute …
-
High 7.4CVE-2022-24707 Public exploit
SQL injection in anuko timetracker
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker Puncher plugin in versions of anuko timetracker prior to 1.20.0.5642. This was…
-
Medium 6.5
Stored XSS vulnerability in anuko/timetracker
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to …
-
Medium 4.8
Missing server signature validation in OctoberCMS
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advis…