Archive

10 March 2022

Vulnerabilities first published on this day (UTC), newest first.

← February 2022 2022 / March /10 April 2022 →

All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

Medium 6.5

CVE-2022-25511

Path traversal in FreeTAKServer-UI

An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place arbitrary files anywhere on the system.

freetakserver-ui PyPI

Mar 10, 2022
Medium 6.5

CVE-2022-25506

SQL Injection in FreeTAKServer-UI

FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser.

freetakserver-ui PyPI

Mar 10, 2022
Medium 5.4

CVE-2022-25507

Cross-site Scripting in FreeTAKServer-UI

FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Callsign parameter.

freetakserver-ui PyPI

Mar 10, 2022
Medium 4.7

CVE-2022-0820

Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore

Cross-site Scripting (XSS) - Stored in GitHub repository orchardcms/orchardcore prior to 1.3.0.

OrchardCMS orchardcms/orchardcore

Mar 10, 2022
Medium 6.5

CVE-2022-0815

McAfee WebAdvisor - Extension Fingerprinting vulnerability

Improper access control vulnerability in McAfee WebAdvisor Chrome and Edge browser extensions up to 8.1.0.1895 allows a remote attacker to gain access to McAfee WebAdvisor settings and other details about the user’s system. This could lead to unexpected behav…

McAfee McAfee WebAdvisor

Mar 10, 2022
Medium 6.5

CVE-2021-41233

Missing authorization in Nextcloud text

Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is by default shipped with Nextcloud Server, an attacker is able to access the folder names of "File D…

Nextcloud security-advisories

Mar 10, 2022
Medium 6.1

CVE-2021-44585

Cross-site Scripting in jeecg-boot

A Cross Site Scripting (XSS) vulnerabilitiy exits in jeecg-boot 3.0 in /jeecg-boot/jmreport/view with a mouseover event.

org.jeecgframework.boot:jeecg-boot-base org.jeecgframework.boot:jeecg-boot-base-core Maven

Mar 10, 2022
Medium 5.3

CVE-2021-39025

IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 could disclose internal IP address information when the web back…

IBM Security Guardium Data Encryption

Mar 10, 2022
Medium 6.2

CVE-2021-39022

IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 saves user-provided information into a Comma-Separated Value (CS…

IBM Security Guardium Data Encryption

Mar 10, 2022
Medium 4.3

CVE-2022-0906

Unrestricted file upload leads to stored XSS in microweber/microweber

Unrestricted file upload leads to stored XSS in GitHub repository microweber/microweber prior to 1.1.12.

microweber microweber/microweber microweber/microweber Packagist

Mar 10, 2022
Medium 6.5

CVE-2022-26652

Arbitrary file write in nats-server

NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected.

github.com/nats-io/nats-server/v2 github.com/nats-io/nats-server github.com/nats-io/nats-streaming-server Go

Mar 10, 2022
Medium 5.5

CVE-2022-0890

NULL Pointer Dereference in mruby/mruby

NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2.

mruby mruby/mruby rust mruby Debian Ubuntu Azure Linux Alpine

Mar 10, 2022
Medium 6.5

CVE-2022-0905

Missing Authorization in go-gitea/gitea

Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4.

go-gitea go-gitea/gitea code.gitea.io/gitea Go

Mar 10, 2022