Archive
11 March 2022
Vulnerabilities first published on this day (UTC), newest first.
89 results · Feed
-
Unscored —
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation …
-
Unscored —
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation …
-
Unscored —
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation …
-
Unscored —
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation …
-
Unscored —
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation …
-
Unscored —CVE-2022-23731 Public exploit
V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models.
-
Unscored —
The public API error causes for the attacker to be able to bypass API access control.
-
Medium 5.4
WordPress WP Google Map plugin <= 4.2.3 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3).
-
Medium 4.7
WordPress Contact Form X plugin <= 2.4 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4).
-
Medium 5.5
User interface misrepresentation of critical information in Hitachi ABB Power Grids Ellipse EAM
An attacker could trick a user of Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 into visiting a malicious website posing as a login page for the Ellipse application and gather authentication credentia…
-
Medium 5.5
Cross-site scripting in Hitachi ABB Power Grids Ellipse EAM
An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 by tricking a user to click on a link containing malicious code that would then be run by the web browser.…
-
Medium 5.0
Missing XSS guards on firmware page
Cross-site Scripting (XSS) vulnerability in firmware section of Secomea GateManager allows logged in user to inject javascript in browser session. This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions.
-
High 7.2
Abusing Backup/Restore feature to achieve Remote Code Execution in microweber/microweber
Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.
-
High 8.1
Command Injection
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git op…
-
Unscored —
A Command Injection vulnerability exits in TOTOLINK A3100R <=V4.1.2cu.5050_B20200504 in adm/ntm.asp via the hosTime par…
-
Critical 9.8
Server-side Template Injection in nystudio107/craft-seomatic
A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header.
-
High 8.2
Improper Authorization in cobbler/cobbler
Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.
-
Medium 5.0CVE-2022-0870 Scanner template
Server-Side Request Forgery (SSRF) in gogs/gogs
Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.
-
Medium 6.8CVE-2022-0928 Scanner template
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12.
-
Medium 4.8
Unrestricted Upload of File with Dangerous Type in microweber/microweber
Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11.
-
Critical 9.1
Integer Overflow or Wraparound in microweber/microweber
Integer Overflow or Wraparound in GitHub repository microweber/microweber prior to 1.3.
-
Unscored —
The following Yokogawa Electric products hard-code the password for CAMS server applications: CENTUM VP versions from R…
-
Unscored —
The following Yokogawa Electric products contain insecure DLL loading issues. CENTUM CS 3000 versions from R3.08.10 to …
-
Unscored —
CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets…
-
Unscored —
CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs:…
-
Unscored —
'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper AC…
-
Unscored —
CAMS for HIS Log Server contained in the following Yokogawa Electric products is vulnerable to uncontrolled resource co…
-
Unscored —
'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pip…
-
Unscored —
Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTU…
-
Unscored —
The following Yokogawa Electric products do not change the passwords of the internal Windows accounts from the initial …
-
Unscored —
There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric product…
-
Medium 6.1
Spoofing attack in swagger-ui-dist
The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's cli…
-
Medium 4.3
Spoofing attack in swagger-ui
Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be r…
-
Unscored —
drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated…
-
Unscored —
lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to accou…
-
Medium 5.4
Cross-site Scripting (XSS) - Reflected in orchardcms/orchardcore
Cross-site Scripting (XSS) - Reflected in GitHub repository orchardcms/orchardcore prior to 1.3.0.
-
High 7.5CVE-2020-36518 Public exploit
Deeply nested json in jackson-databind
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
-
Medium 6.5CVE-2022-0001 Public exploit
Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authori…
-
Medium 6.5
Missing Authorization in saleor/saleor
Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2.
-
High 7.7
Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff…