Archive
7 March 2022
Vulnerabilities first published on this day (UTC), newest first.
128 results · Feed
-
Medium 6.1
A local attacker can overwrite arbitrary files on the system with VPN client logs using administrator privileges, poten…
-
Medium 6.5
Exposure of Sensitive Information to an Unauthorized Actor in httpie
HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. Before 3.1.0, HTTPie didn‘…
-
Medium 6.5
Improper Restriction of XML External Entity Reference in trytond and proteus
An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and…
-
High 7.5
XML Entity Expansion in trytond and proteus
An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x throu…
-
Unscored —
Ming 0.4.8 has an out-of-bounds buffer overwrite issue in the function getName() in decompiler.c file that causes a dir…
-
Unscored —
Ming 0.4.8 has an out-of-bounds buffer access issue in the function getString() in decompiler.c file that causes a dire…
-
Unscored —
Ming 0.4.8 has an out-of-bounds buffer access issue in the function decompileINCR_DECR() in decompiler.c file that caus…
-
Unscored —
Ming 0.4.8 has an out-of-bounds read vulnerability in the function decompileIF() in the decompile.c file that causes a …
-
Unscored —
Ming 0.4.8 has an out-of-bounds read vulnerability in the function newVar_N() in decompile.c which causes a huge inform…
-
Critical 9.8
TP-LINK Tapo C200 remote code execution vulnerability
TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root. The exploitation of this vulnerability allows an attacker to take full control…
-
Unscored —
A null byte interaction error has been discovered in the code that the telnetd_startup daemon uses to construct a pair …
-
Unscored —CVE-2022-24644 Public exploit
ZZ Inc. KeyMouse Windows 3.08 and prior is affected by a remote code execution vulnerability during an unauthenticated …
-
Unscored —
Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical acc…
-
Unscored —
Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove…
-
Unscored —
The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated a…
-
Unscored —
Use of a hard-coded cryptographic key pair by the telnetd_startup service allows an attacker on the local area network …
-
Unscored —
Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensit…
-
Unscored —
"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations …
-
Unscored —
Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokeniza…
-
High 8.1
Account compromise in Evmos
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from user addresses. To do this an attacker must create a new chain which does not enforce signature verific…
-
Unscored —
An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS ope…
-
Unscored —
SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attac…
-
Unscored —
An arbitrary file upload vulnerability exists in albumimages.jsp in Quicklert for Digium 10.0.0 (1043) via a .mp3;.jsp …
-
Unscored —
The login.jsp page of Quicklert for Digium 10.0.0 (1043) is affected by both Blind SQL Injection with Out-of-Band Inter…
-
Unscored —
An issue was discovered in OverIT Geocall before 8.0. An authenticated user who has the Test Trasformazione XSL functio…
-
Unscored —CVE-2022-22835 EPSS 15%
An issue was discovered in OverIT Geocall before version 8.0. An authenticated user who has the Test Trasformazione XSL…
-
Unscored —
Couchbase Operator 2.2.x before 2.2.3 exposes Sensitive Information to an Unauthorized Actor. Secrets are not redacted …
-
Unscored —
A cross-site scripting (XSS) vulnerability in the component cgi-bin/ej.cgi of Ex libris ALEPH 500 v18.1 and v20 allows …
-
Unscored —
SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Sche…
-
Unscored —
Proofpoint Insider Threat Management Agent for Windows relies on an inherently dangerous function that could enable an …
-
Unscored —CVE-2022-26488 Public exploit
In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. Th…
-
Medium —
pgjdbc Arbitrary File Write Vulnerability
In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could crea…
-
Medium 6.1
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged trusted host user to exploit a vulnerability in the ni…
-
Medium 6.2
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kerne…
-
Medium 6.2
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kerne…
-
Unscored —
A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspecti…
-
Critical 9.3
ICSA-22-063-01 Improper Protection against Electromagnetic Fault Injection in Trailer Power Line Communications (PLC) J2497
Power Line Communications PLC4TRUCKS J2497 trailer receivers are susceptible to remote RF induced signals.
-
Medium 6.1
ICSA-22-063-01 Missing Authentication for Critical Function in Trailer Power Line Communications (PLC) J2497
Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 messages. There is no authentication or authorization for these functions.
-
Unscored —
A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspecti…
-
Medium 6.5
SiteManager Log View XSS Issue
Cross-site Scripting (XSS) vulnerability in log view of Secomea SiteManager allows a logged in user to store javascript for later execution. This issue affects: Secomea SiteManager Version 9.6.621421014 and all prior versions.