Archive
March 2022
Vulnerabilities first published in this month (UTC), newest first.
335 results · Clear filters · Feed
-
High 7.7
Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a maliciou…
-
High 7.5
Sensitive Auth & Cookie data stored in Jupyter server logs
The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth…
-
High 7.2
Ninja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the ~/includes/ajax/controllers/uploads.php file which can be used by unauthenticate…
-
High 7.2
Amelia <= 1.0.46 - Stored Cross Site Scripting via lastName
The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter found in the ~/src/Application/Controller/User/Customer/AddCustomerController.php file which allows attackers to inject a…
-
High 8.6
Rockwell Automation Connected Components Workbench Deserialization of Untrusted Data
Rockwell Automation Connected Components Workbench v12.00.00 and prior does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Work…
-
High 7.7
Rockwell Automation Connected Components Workbench Path Traversal
The parsing mechanism that processes certain file types does not provide input sanitization for file paths. This may allow an attacker to craft malicious files that, when opened by Rockwell Automation Connected Components Workbench v12.00.00 and prior, can tr…
-
High 7.5
GE UR family exposure of sensitive information to an unauthorized actor
GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without authentication.
-
High 8.4
GE UR family hardcoded credentials
GE UR bootloader binary Version 7.00, 7.01 and 7.02 included unused hardcoded credentials. Additionally, a user with physical access to the UR IED can interrupt the boot sequence by rebooting the UR.
-
High 8.0
Missing Authentication for Critical Function in Foreman Ansible
An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity a…
-
High 7.5
Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named proc…
-
High 7.2
Unrestricted Upload of File with Dangerous Type in crater-invoice/crater
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.
-
High 7.3
Use After Free in op_is_set_bp in radareorg/radare2
Use After Free in op_is_set_bp in GitHub repository radareorg/radare2 prior to 5.6.6.
-
High —
Removal of functional code in faker.js
Faker.js helps users create large amounts of data for testing and development. The maintainer deliberately removed the functional code from this package. This appears to be a purposeful and successful attempt to make the package unusable. This is related to t…
-
High 7.1
Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository Server
CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may…
-
High 7.5
Assertion failure on delayed DS lookup
When the vulnerability is triggered the BIND process will exit. BIND 9.18.0
-
High 7.5
Stack buffer overflow in pjproject
PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applica…
-
High 8.8
A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute cod…
-
High 7.5
Improper Input Validation in guzzlehttp/psr7
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are current…
-
High 8.8CVE-2022-25766 EPSS 35%
Remote Code Execution (RCE)
The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api/fetch endpoint. User controlled values (remote and ref) are passed to the git fetch command. By injecting some git opt…
-
High 7.5
The IBM Spectrum Protect 8.1.14.000 server could allow a remote attacker to bypass security restrictions, caused by imp…
-
High 8.8
Untrusted Search Path in PNPM
PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is…
-
High 8.2
Insufficient Session Expiration in admidio/admidio
Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9.
-
High 7.8
Rockwell Automation ISaGRAF5 Runtime Unprotected Storage of Credentials
Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A lo…
-
High 7.5
Rockwell Automation ISaGRAF5 Runtime Cleartext Transmission of Sensitive Information
ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol un…
-
High 8.3
WordPress Responsive Menu plugin <= 4.1.7 - Nonce token leak leading to arbitrary file upload, theme deletion, plugin settings change vulnerability
Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (versions <= 4.1.7).
-
High 8.8
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS…
KEV Feb 11, 2022 -
High 7.8
Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation…
-
High 7.8
Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation…
-
High 7.5
Syltek Insufficient Verification of Data Authenticity
Syltek application before its 10.22.00 version, does not correctly check that a product ID has a valid payment associated to it. This could allow an attacker to forge a request and bypass the payment system by marking items as payed without any verification.
-
High 7.5
Improper Verification of Cryptographic Signature in `node-forge`
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. …
-
High 7.5
Improper Verification of Cryptographic Signature in node-forge
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structur…
-
High 7.5
golang.org/x/crypto/ssh Denial of service via crafted Signer
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
-
High 8.8CVE-2022-26500 Exploited · Ransomware
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated…
KEV Dec 13, 2022 -
High 8.8
Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging
`gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutralization of Formula Elements in a CSV File. The `gradio` library has a flagging functionality which …
-
High 7.5
Allocation of Resources Without Limits or Throttling in nvflare
NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, which may lead to cause system unavailable.
-
High 8.1
Failure to validate signature during handshake in @chainsafe/libp2p-noise
`@chainsafe/libp2p-noise` contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. `@chainsafe/libp2p-noise` before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-i…
-
High 7.5
HTTP Request Smuggling in waitress
Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disag…
-
High 8.6
Prototype Pollution
The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/v…
-
High 7.5
Prototype Pollution
The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incomplete fix for [CVE-2020-28283](https://security.snyk.io/vuln/SNYK-JS-LIBNESTED-1054930)
-
High 7.1
Arbitrary Code Injection
All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor funct…