Archive
9 March 2022
Vulnerabilities first published on this day (UTC), newest first.
184 results · Feed
-
Medium 5.3
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a disruption of c…
-
Medium 5.3
A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could caus…
-
High 8.8
A CWE-200: Information Exposure vulnerability exists which could allow a session hijack when the door panel is communic…
-
High 7.7
Code injection in Stripe CLI on windows
Stripe CLI is a command-line tool for the Stripe eCommerce platform. A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directory where an attacker has planted files. The commands are `stripe login`, `stripe config -e`, `stripe…
-
Low 2.6
Insufficient Session Expiration in shopware
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. F…
-
Medium 4.8
Guest session is shared between customers in shopware
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared between customers when HTTP cache is enabled. This can lead to inconsistent experiences for guest users. …
-
Medium 6.1
HTML injection possibility in voucher code form
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possible to inject code via the voucher code form. This issue has been patched in version 6.4.8.1. There are no known workaro…
-
Medium 6.3
HTTP caching is marking private HTTP headers as public
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sensitive HTTP headers to be non-cacheable. If there is an HTTP cache between the server and client the…
-
Medium 6.8
Incorrect Authentication in shopware
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modify customers and to create orders without App Permission. This issue is a result of improper api rout…
-
Unscored —
A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/upgrade_info …
-
Unscored —
A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/reset_cloud_p…
-
Unscored —
A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/modify_accoun…
-
Unscored —
A Buffer Overflow vulnerabilitiy exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/register fea…
-
Unscored —
A Buffer Overflow vulnerabiltiy exists in TP-LINK WR-886N 20190826 2.3.8 in thee /cloud_config/router_post/login featur…
-
Unscored —
A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/get_reset_pwd…
-
Unscored —
A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/get_reg_verif…
-
Unscored —
A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in /cloud_config/cloud_device/info interface, …
-
Low 3.5
High memory usage in Nextcloud server
Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading specially crafted files which will cause the server to allocate too much memory / CPU. It is recommended…
-
High 7.2
Remote code execution in mybb
MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type `php` with PHP code, executed…
-
Unscored —
A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 via the /cloud_config/router_post/check_reset_…
-
Unscored —
A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/check_reg_ver…
-
High 8.1
An elevation of privilege vulnerability in the QNX Neutrino Kernel of affected versions of QNX Software Development Pla…
-
High 7.5
Denial of service via HTTP/2 HEADERS frames padding
A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This vulnerability is caused by a logical error when parsing a HTTP/2 HEADERS or HTTP/2 PUSH_PROMISE frame where th…
-
Medium 6.3
Maddy Mail Server does not implement account expiry
Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually…
-
Medium 5.4
WAGO PLCs WBM vulnerable to reflected XSS
Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use this to gain access to confidential information on a PC that connects to the WBM after it has been co…
-
Low 3.7
Reflected XSS in graph configuration window of Zabbix Frontend
An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predi…
-
Low 3.7
Reflected XSS in item configuration window of Zabbix Frontend
An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predic…
-
Low 3.7
Reflected XSS in service configuration window of Zabbix Frontend
An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to pre…
-
Medium 4.6
Reflected XSS in action configuration window of Zabbix Frontend
An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page b…
-
Unscored —CVE-2022-22806 EPSS 12%
A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection …
-
Unscored —CVE-2022-22805 EPSS 12%
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause…
-
High 8.9
A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior…
-
Unscored —
This module is used as part of the Opigno LMS distribution and implements learning paths for the LMS. The module was pr…
-
Unscored —CVE-2022-24995 EPSS 14%
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability…
-
Unscored —
Tenda AX12 v22.03.01.21 was discovered to contain a stack buffer overflow in the function sub_422CE4. This vulnerabilit…
-
Unscored —
SVG Formatter module provides support for using SVG images on your website. Our dependency library enshrined/svg-saniti…
-
Unscored —
Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function saveParentControlInfo. This vulnerabil…
-
Unscored —
Tenda AX12 v22.03.01.21 was discovered to contain a stack overflow in the function sub_4327CC. This vulnerability allow…
-
Unscored —
Tenda AX12 v22.03.01.21 was discovered to contain a stack overflow in the function sub_42DE00. This vulnerability allow…
-
Unscored —
Tenda AX1806 v1.0.0.1 was discovered to contain a heap overflow in the function saveParentControlInfo. This vulnerabili…