Archive
2 March 2022
Vulnerabilities first published on this day (UTC), newest first.
77 results · Feed
-
Unscored —
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
-
Low 2.7
JFrog Artifactory before 7.31.10, is vulnerable to Broken Access Control where a project admin user is able to list all…
-
Medium 4.3
JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to d…
-
Medium 5.6
Puppet Firewall Module May Leave Unmanaged Rules
In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe stat…
-
Unscored —
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
-
Unscored —
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
-
Unscored —
Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to…
-
Unscored —
VMware Workspace ONE Boxer contains a stored cross-site scripting (XSS) vulnerability. Due to insufficient sanitization…
-
Medium 4.6
Cross-site scripting vulnerability in Zulip Server
Zulip is an open source team chat app. The `main` development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerability on the recent topics page. An attacker could maliciously craft a full name for their account an…
-
Critical 9.8
Improper Restriction of XML External Entity Reference in Excel-Streaming-Reader
Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.…
-
Medium 6.5
Liferay Portal and Liferay DXP has incorrect default permissions for site members
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote…
-
Unscored —
seacms V11.5 is affected by an arbitrary code execution vulnerability in admin_config.php.
-
Unscored —
Home Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the …
-
Medium 5.4
Multiple relative path traversal vulnerabilities [CWE-23] in FortiWLM management interface 8.6.2 and below, 8.5.2 and b…
-
Medium 6.2
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in CAA to cause …
-
Medium 6.2
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kerne…
-
High 7.2CVE-2022-0819 EPSS 43%
Code Injection in dolibarr/dolibarr
Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1.
-
Unscored —
An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. A service exposed by the application allows …
-
Unscored —
Zoho ManageEngine SharePoint Manager Plus before 4329 is vulnerable to a sensitive data leak that leads to privilege es…
-
Unscored —
Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled.
-
Unscored —
Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname…
-
Unscored —
Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.
-
Medium 5.4
Improper Authorization in webmin/webmin
Improper Authorization in GitHub repository webmin/webmin prior to 1.990.
-
Medium 6.1
Prototype Pollution in jquery.cookie
jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
-
Medium 4.1
An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and…
-
High 7.8
An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiAP-C console 5.4.0 …
-
Low 2.8
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiManager v…
-
High 8.8
Exposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapy
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.
-
High 8.3
Improper Access Control to Remote Code Execution in webmin/webmin
Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.
-
Unscored —
A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default confi…
-
Unscored —
A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one…
-
Medium 6.1
Open Redirect in CPython that affects users of OpenStack Nova
A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
-
Unscored —
In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanis…
-
Unscored —
An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoo…
-
Unscored —
A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through inv…
-
Unscored —
A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request,…
-
Unscored —
A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certi…