Archive
24 March 2022
Vulnerabilities first published on this day (UTC), newest first.
31 results · Feed
-
Medium 4.5
Cross-Site Request Forgery in Anchor CMS
Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php. This vulnerability allows attackers to arbitrarily delete posts.
-
Unscored —
EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata.
-
Unscored —CVE-2022-26272 EPSS 22%
A remote code execution (RCE) vulnerability in Ionize v1.0.8.1 allows attackers to execute arbitrary code via a crafted…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Parking Management System v1.0 allows attackers to execute arbit…
-
Unscored —
TuziCMS v2.0.6 was discovered to contain a SQL injection vulnerability via the component App\Manage\Controller\ZhuantiC…
-
Unscored —
Survey King v0.3.0 does not filter data properly when exporting excel files, allowing attackers to execute arbitrary co…
-
Medium 4.3
Secure category names leaked via user activity export in Discourse
Discourse is an open source discussion platform. Versions 2.8.2 and prior in the `stable` branch, 2.9.0.beta3 and prior in the `beta` branch, and 2.9.0.beta3 and prior in the `tests-passed` branch are vulnerable to a data leak. Users can request an export of …
-
High 7.1
Malicious users can take over the session of other players
Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through the browser console and become co-owners of the target session. This issue is patched in version 1.1.0…
-
Unscored —
Bluedon Information Security Technologies Co.,Ltd Internet Access Detector v1.0 was discovered to contain an informatio…
-
Medium 6.1
Open Redirect in Flask-AppBuilder
Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability when using database authentication login page on versions below 3.4.5. This issue is fixed in version 3…
-
Medium 6.5
The BMC (IBM Power 9 AC922 OP910, OP920, OP930, and OP940) may be subject to a firmware downgrade attack which may affe…
-
Unscored —
An SQL Injection vulnerability exists in Dreamer CMS 4.0.0 via the tableName parameter.
-
Critical 9.6
SQL Injection in forkcms/forkcms
SQL Injection in GitHub repository forkcms/forkcms prior to 5.11.1.
-
Medium 6.3CVE-2022-21820 EPSS 17%
NVIDIA DCGM contains a vulnerability in nvhostengine, where a network user can cause detection of error conditions with…
-
High 7.5CVE-2022-25568 Scanner template
MotionEye allows attackers to access sensitive information
MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured.
-
Unscored —CVE-2022-26629 Public exploit
An Access Control vulnerability exists in SoroushPlus+ Messenger 1.0.30 in the Lock Screen Security Feature function du…
-
Medium 6.5
Cross-site Scripting (XSS) - Stored in pimcore/data-hub
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/data-hub prior to 1.2.4.
-
Unscored —
A Cross Site Scripting (XSS) vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan…
-
High 7.2
Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0
Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with admin or import manager roles to execute unattended commands on the appliance using web server user privileges. This issue…
-
High 7.2
Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0
Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an authenticated attacker with admin or report manager roles to execute unattended commands on the appliance using web server user privileges. Thi…
-
High 7.2
Open Redirect on login in go-gitea/gitea
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5.
-
Unscored —
In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTML file, w…
-
High 7.3
Heap Buffer Overflow in iterate_chained_fixups in radareorg/radare2
Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/radare2 prior to 5.6.6.
-
Unscored —
An issue was discovered in ApiManager 1.1. there is sql injection vulnerability that can use in /index.php?act=api&tag=…
-
Medium 6.8
Cross-site Scripting (XSS) - Stored in forkcms/forkcms
Cross-site Scripting (XSS) - Stored in GitHub repository forkcms/forkcms prior to 5.11.1.
-
High 7.3
Heap Buffer Overflow in parseDragons in radareorg/radare2
Heap Buffer Overflow in parseDragons in GitHub repository radareorg/radare2 prior to 5.6.8.
-
High 8.2
Insecure Temporary File in horovod/horovod
Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0.
-
Medium 4.0
Improper Certificate Validation in OWASP ZAP
OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server.
-
Medium 5.9
Default inheritable capabilities for linux container should be empty
Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilit…
-
Unscored —
GNOME OCRFeeder before 0.8.4 allows OS command injection via shell metacharacters in a PDF or image filename.
-
High 7.5
A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when a…