Archive
28 March 2022
Vulnerabilities first published on this day (UTC), newest first.
8 results · Clear filters · Feed
-
Critical 10.0
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions sta…
-
Critical 9.1
A CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exist…
-
Critical 9.1
A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could…
-
Critical 9.8
An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.7…
-
Critical 10.0
Sandbox bypass in fenom
In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCode()to bypass sandbox to execute arbitrary PHP code when disable_native_funcs is true.
-
Critical 9.8
Type Confusion in ImpressCMS
ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==).
-
Critical 9.8
SQL Injection in ImpressCMS
ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.
-
Critical 9.1
Path traversal in Pillow
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.