Archive
10 March 2022
Vulnerabilities first published on this day (UTC), newest first.
42 results · Feed
-
High 7.1
Improper Authorization in orchardcms/orchardcore
Improper Authorization in GitHub repository orchardcms/orchardcore prior to 1.3.0.
-
High 7.5
Exposure of Sensitive Information to an Unauthorized Actor in FreeTAKServer-UI
FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys.
-
Medium 6.5
Path traversal in FreeTAKServer-UI
An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place arbitrary files anywhere on the system.
-
High 8.8
Hard coded credentials in FreeTAKServer
FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges.
-
High 7.5
Improper Authentication in FreeTAKServer
An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8 allows unauthenticated attackers to cause a Denial of Service (DoS) via an unusually large amount of created routes, or create unsafe or false routes for legitimate users.
-
Medium 6.5
SQL Injection in FreeTAKServer-UI
FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser.
-
Medium 5.4
Cross-site Scripting in FreeTAKServer-UI
FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Callsign parameter.
-
Medium 4.7
Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore
Cross-site Scripting (XSS) - Stored in GitHub repository orchardcms/orchardcore prior to 1.3.0.
-
High 7.5
McAfee Total Protection (MTP) - File Deletion vulnerability
A race condition vulnerability exists in the QuickClean feature of McAfee Total Protection for Windows prior to 16.0.43 that allows a local user to gain privilege elevation and perform an arbitrary file delete. This could lead to sensitive files being deleted…
-
Medium 6.5
McAfee WebAdvisor - Extension Fingerprinting vulnerability
Improper access control vulnerability in McAfee WebAdvisor Chrome and Edge browser extensions up to 8.1.0.1895 allows a remote attacker to gain access to McAfee WebAdvisor settings and other details about the user’s system. This could lead to unexpected behav…
-
High 7.5
Unauthenticated control plane denial of service attack in Istio
Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in th…
-
Medium 6.5
Missing authorization in Nextcloud text
Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is by default shipped with Nextcloud Server, an attacker is able to access the folder names of "File D…
-
Medium 6.1
Cross-site Scripting in jeecg-boot
A Cross Site Scripting (XSS) vulnerabilitiy exits in jeecg-boot 3.0 in /jeecg-boot/jmreport/view with a mouseover event.
-
Medium 5.3
IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 could disclose internal IP address information when the web back…
-
Medium 6.2
IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 saves user-provided information into a Comma-Separated Value (CS…
-
Low 3.7
IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused…
-
Unscored —
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the …
-
Unscored —
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the …
-
Unscored —
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the …
-
Unscored —
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the …
-
Unscored —
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the …
-
Unscored —
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the …
-
Unscored —
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the …
-
High 8.8CVE-2021-44673 Public exploit
Unrestricted Upload of File with Dangerous Type in Croogo
A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2via admin/file-manager/attachments, which lets a malicoius user upload a web shell script.
-
Unscored —
sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, re…
-
Unscored —
sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, re…
-
Unscored —
An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPac…
-
Unscored —CVE-2022-22814 Public exploit
The System Diagnosis service of MyASUS before 3.1.2.0 allows privilege escalation.
-
Medium 4.3
Unrestricted file upload leads to stored XSS in microweber/microweber
Unrestricted file upload leads to stored XSS in GitHub repository microweber/microweber prior to 1.1.12.
-
Unscored —
The function bitstr_tell at bitstr.c in ffjpeg commit 4ab404e has a NULL pointer dereference.
-
Unscored —
Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function panoParserFindOLine() …
-
Unscored —
An out-of-bounds read in the function write_title() in subs.c of abcm2ps v8.14.11 allows remote attackers to cause a De…
-
Unscored —
Stack-based buffer overflow in the function get_key in parse.c of abcm2ps v8.14.11 allows remote attackers to cause a D…
-
Unscored —
abcm2ps v8.14.11 was discovered to contain an out-of-bounds read in the function calculate_beam at draw.c.
-
High 7.7
Static Code Injection in microweber/microweber
Static Code Injection in GitHub repository microweber/microweber prior to 1.3.
-
High 7.5
Apache Spark Key Negotiation Vulnerability
Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an …
-
Unscored —
SPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary code.
-
Unscored —
SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about editorial objects.
-
Medium 6.5
Arbitrary file write in nats-server
NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected.
-
Medium 5.5
NULL Pointer Dereference in mruby/mruby
NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2.