Archive
25 March 2022
Vulnerabilities first published on this day (UTC), newest first.
77 results · Feed
-
Unscored —
A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to…
-
Unscored —CVE-2021-40906 Public exploit
CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is i…
-
High 8.8CVE-2021-40905 Public exploit
The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the upl…
-
Unscored —CVE-2021-40904 Public exploit
The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Do…
-
Low 3.7
Discoverability of user password hash in Statamic CMS
Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's password hash using a specially crafted regular expression filter in the users endpoint of the REST API. Multiple such reques…
-
Critical 10.0
Sandbox bypass leading to arbitrary code execution in Deno
Deno is a runtime for JavaScript and TypeScript. The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are vulnerable to an attack where a malicious actor controlling the code executed in a Deno runtime could bypass all permission checks and exec…
-
Unscored —
The DuckDuckGo browser 7.64.4 on iOS allows Address Bar Spoofing due to mishandling of the JavaScript window.open funct…
-
Unscored —
Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any administrator writable…
-
Unscored —
TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which is exploited via a crafted POST …
-
Unscored —
Incorrect permissions in the Bluetooth Services in the Fortessa FTBTLD Smart Lock as of 12-13-2022 allows a remote atta…
-
Unscored —
A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version …
-
Unscored —
Joget DX 7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Datalist table.
-
Unscored —
libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter.…
-
Unscored —
Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial con…
-
Unscored —
Mendelson OFTP2 before 1.1 b43 is affected by directory traversal. To access the vulnerable code path, the attacker has…
-
Unscored —
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/vod/data.…
-
Unscored —
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/ulog/inde…
-
Unscored —
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/plog/inde…
-
Unscored —
Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/…
-
Unscored —
Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/…
-
Unscored —
SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the syst…
-
High 8.1
Improper Certificate Validation in kubeclient
A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up acceptin…
-
High 7.8
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This…
KEV Aug 26, 2026 -
High 8.8
SQL Injection in Moodle
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
-
Unscored —
A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kern…
-
Unscored —
A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in th…
-
Unscored —
A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts …
-
Medium 6.1
Cross-site Scripting in Keycloak
A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.
-
Unscored —
A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the…
-
Unscored —
It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session au…
-
Unscored —
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVR…
-
Unscored —
A flaw was found in Caribou due to a regression of CVE-2020-25712 fix. An attacker could use this flaw to bypass screen…
-
Unscored —
An improper authorization handling flaw was found in Foreman. The OpenSCAP plugin for the smart-proxy allows foreman cl…
-
Unscored —
A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux ker…
-
Unscored —
An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way user…
-
High 7.5
Indexer denial-of-service via malformed S2S request
The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 …
-
Unscored —
In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a service broke…
-
Critical 9.6
Genian NAC remote code execution vulnerability
An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all connected nodes in NAC t…
-
High 8.1
Netis Korea MEX01 Buffer overflow vulnerability
An Buffer Overflow vulnerability leading to remote code execution was discovered in MEX01. Remote attackers can use this vulnerability by using the property that the target program copies parameter values to memory through the strcpy() function.
-
High 7.5
IPTIME NAS2dual improper authentication vulnerability
An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing …