Archive
4 March 2022
Vulnerabilities first published on this day (UTC), newest first.
56 results · Feed
-
Critical 9.1
An XML external entity (XXE) injection vulnerability exists in the Apache Any23 RDFa XSLTStylesheet extractor
An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attack…
-
Critical 9.8
Remote code execution in net.mingsoft:ms-mcms
https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template.utility.Execute"?new()("calc")}. ¶¶ MCMS has a pre-auth RCE vulnerability through which allows unaut…
-
Unscored —
An issue was discovered in Rhinode Trading Paints through 2.0.36. TP Updater.exe uses cleartext HTTP to check, and requ…
-
Unscored —
There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n dev…
-
Critical 9.9
Logged-in Administrator may get unrestricted file system access
This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Improper Limitation of a Pathname to restricted directory, allows logged in GateManager admin to delete system Files or Directories.
-
Unscored —
"TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure ciphers are not enable…
-
Unscored —
An information disclosure in web interface in D-Link DIR-X1860 before 1.03 RevA1 allows a remote unauthenticated attack…
-
Medium 6.0
Dell EMC Enterprise Storage Analytics for vRealize Operations, versions 4.0.1 to 6.2.1, contain a Plain-text password s…
-
High 7.2
Remote Code Execution (RCE)
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to comman…
-
Unscored —
D-Link DIR-859 v1.05 was discovered to contain a stack-based buffer overflow via the function genacgi_main. This vulner…
-
Unscored —
" Insecure password storage issue.The application stores sensitive information in cleartext within a resource that migh…
-
Unscored —CVE-2021-3656 Public exploit
A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VM…
-
High 7.4
Improper Resolution of Path Equivalence in microweber-dev/whmcs_plugin
Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to 0.0.4.
-
Medium 4.9
An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patc…
-
Medium 4.8
An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patc…
-
Critical 9.8
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulne…
KEV Mar 25, 2022 -
Unscored —
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are susceptible to a vulnerability which when succ…
-
Unscored —
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are susceptible to a vulnerability which when succ…
-
Unscored —
A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2…
-
Unscored —
A flaw was found in the Linux kernel. A denial of service problem is identified if an extent tree is corrupted in a cra…
-
High 7.8
coreos-installer improperly verifies GPG signature when decompressing gzipped artifact
An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to …
-
Unscored —
A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Conne…
-
Unscored —
The Symantec Management Agent is susceptible to a privilege escalation vulnerability. A low privilege local account can…
-
Unscored —
A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c,…
-
Unscored —
An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sa…
-
Unscored —
When the device is in factory state, it can be access the shell without adb authentication process. The LG ID is LVE-SM…
-
Unscored —
In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or…
-
Unscored —
Unauthenticated cross-site scripting (XSS) in Netgear WAC120 AC Access Point may lead to mulitple attacks like session …
-
Unscored —
Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd…
-
Unscored —
DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrus…
-
Unscored —
DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote…
-
High 7.3
Improper Restriction of XML External Entity Reference in liquibase/liquibase
Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.
-
Medium 6.1CVE-2020-18325 Public exploit
Cross-site Scripting in intelliants/subrion
Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.
-
Medium 6.1CVE-2020-18324 Public exploit
Cross-site Scripting in Subrion CMS
Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template.
-
High 8.8CVE-2020-18326 Public exploit
Cross Site Request Forgery in intelliants/subrion
Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unauthenticated malicious user send an authorised request to victim and successfully create an arbitrary …
-
Unscored —
Cross Site Scripting (XSS) vulnerability exists in Alfresco Alfresco Community Edition v5.2.0 via the action parameter …
-
Medium 4.6CVE-2022-0832 EPSS 67%
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
-
Medium 4.6
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
-
Unscored —
Victor CMS v1.0 was discovered to contain a SQL injection vulnerability.
-
Unscored —
There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. T…