Archive
3 March 2022
Vulnerabilities first published on this day (UTC), newest first.
51 results · Feed
-
Unscored —
A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls …
-
Unscored —
VMware Tools for Windows (11.x.y and 10.x.y prior to 12.0.0) contains an uncontrolled search path vulnerability. A mali…
-
Unscored —
PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code inside the markdown desc…
-
Unscored —
PeteReport Version 0.5 contains a Cross Site Request Forgery (CSRF) vulnerability allowing an attacker to trick users i…
-
Unscored —
PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code while adding an 'Attack …
-
High 7.4
Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.
-
Unscored —
A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern P…
-
Unscored —
A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A us…
-
Medium 4.3
Elasticsearch privilege escalation
A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.
-
Unscored —
A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memo…
-
High 7.8
Path traversal in claircore
A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remot…
-
High 7.3CVE-2022-0265 Public exploit
Improper Restriction of XML External Entity Reference in hazelcast/hazelcast
Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.
-
Medium 6.2
Exposure of home directory through shescape on Unix with Bash
Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bash with the `escape` or `escapeAll` functions from the _shescape_ API with the `interpolation` option…
-
Medium 5.3
Improper Input Validation in URI.js
URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from valu…
-
High 8.8
Integer overflow in table parsing extension leads to heap memory corruption
cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing `table.c:row_from_string` may lead to heap memory corruption when pa…
-
High —
Execution with Unnecessary Privileges in arc-electron
### Impact When the end-user click on the response header that contains a link the target will be opened in ARC new window. This window will have the default preload script loaded which allows the scripts embedded in the link target to execute any logic that …
-
Medium 5.5
Buildah processes using chroot isolation may leak environment values to intermediate processes
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a co…
-
Unscored —
.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in th…
-
Medium 5.5
Ansible discloses sensitive information in traceback error message
A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
-
Unscored —
CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header …
-
Unscored —CVE-2022-25125 Scanner template
MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp.
-
Critical 9.8
SQL injection in net.mingsoft:ms-mcms
MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java.
-
Critical 9.8CVE-2022-23898 Scanner template
SQL injection in net.mingsoft:ms-mcms
MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.
-
High 7.8
Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the subtlv length in the functi…
-
Unscored —
A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to a wrong check on the input packet length in th…
-
Unscored —
A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to missing a check on the input packet length in …
-
Unscored —
Axelor Open Suite v5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Name paramet…
-
Low 3.8
OS Command Injection in ljharb/npm-lockfile
OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4.
-
Low 3.5
Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.9.
-
Unscored —
A risky-algorithm issue was discovered on Fujifilm DocuCentre-VI C4471 1.8 devices. An attacker that obtained access to…
-
High 7.8
Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects…
KEV Mar 30, 2023 -
Unscored —
Remote Desktop Commander Suite Agent before v4.8 contains an unquoted service path which allows attackers to escalate p…
-
Medium 6.4
Wordline HIDCCEMonitorSVC before v5.2.4.3 contains an unquoted service path which allows attackers to escalate privileg…
-
Unscored —
OS4ED openSIS 8.0 is affected by cross-site scripting (XSS) in EmailCheckOthers.php. An attacker can inject JavaScript …
-
Unscored —
OS4ED openSIS 8.0 is affected by SQL Injection in CheckDuplicateName.php, which can extract information from the databa…
-
Unscored —
OS4ED openSIS 8.0 is affected by SQL injection in ChooseCpSearch.php, ChooseRequestSearch.php. An attacker can inject a…
-
Medium 6.5
Server-Side Request Forgery (SSRF) in transloadit/uppy
Server-Side Request Forgery (SSRF) in GitHub repository transloadit/uppy prior to 3.3.1.
-
Unscored —
Remote Code Execution (RCE) vulnerability exists in Zepl Notebooks all previous versions before October 25 2021. Users …
-
Unscored —
The biometric lock in Devolutions Password Hub for iOS before 2021.3.4 allows attackers to access the application becau…
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in the admin interface in Element-IT HTTP Commander 7.0.0 allows unau…