Archive
March 2022
Vulnerabilities first published in this month (UTC), newest first.
68 results · Clear filters · Feed
-
Low 2.4
Exposure of Sensitive Information to an Unauthorized Actor in httpie/httpie
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0.
-
Low —
Inconsistent storage layout for ERC2771ContextUpgradeable
### Impact The storage layout of the ERC2771ContextUpgradeable is not constant between versions. - versions `4.0.0`, `4.1.0` and `4.2.0`, the contract has a length of 51 slots. - since `4.3.0`, the contract has a length of 50 slots - future versions will cont…
-
Low 3.7
An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but…
-
Low —
Infinite loop in Pillow
JpegImagePlugin may append an EOF marker to the end of a truncated file, so that the last segment of the data will still be processed by the decoder. If the EOF marker is not detected as such however, this could lead to an infinite loop where JpegImagePlugin …
-
Low 3.7
IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused…
-
Low 2.6
Insufficient Session Expiration in shopware
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. F…
-
Low 3.5
High memory usage in Nextcloud server
Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading specially crafted files which will cause the server to allocate too much memory / CPU. It is recommended…
-
Low 3.7
Reflected XSS in graph configuration window of Zabbix Frontend
An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predi…
-
Low 3.7
Reflected XSS in item configuration window of Zabbix Frontend
An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predic…
-
Low 3.7
Reflected XSS in service configuration window of Zabbix Frontend
An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to pre…
-
Low 3.3
Microsoft Intune Portal for iOS Security Feature Bypass Vulnerability
Microsoft Intune Portal for iOS Security Feature Bypass Vulnerability
-
Low 3.3
Media Foundation Information Disclosure Vulnerability
Media Foundation Information Disclosure Vulnerability
-
Low 2.4
Nextcloud Talk app exposes chat messages on lockscreen
Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen state when a call was incoming. If an attacker got physical access to the locked phone, and the victi…
-
Low 1.9
Information Exposure vulnerability in Galaxy Watch3 Plugin prior to version 2.2.09.22012751 allows attacker to access p…
-
Low 1.9
Information Exposure vulnerability in Watch Active2 Plugin prior to version 2.2.08.22012751 allows attacker to access p…
-
Low 1.9
Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access pa…
-
Low 1.9
Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.22012751 allows attacker to access pa…
-
Low 1.9
Information Exposure vulnerability in Galaxy S3 Plugin prior to version 2.2.03.22012751 allows attacker to access passw…
-
Low 1.9
Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.220126741 allows attackers to access …
-
Low 3.3
Improper use of SMS buffer pointer in Shannon baseband prior to SMR Mar-2022 Release 1 allows OOB read.
-
Low 3.4
Open Redirect in archivy/archivy
Open Redirect in GitHub repository archivy/archivy prior to 1.7.0.
-
Low 3.5
Cross-site Scripting (XSS) - Generic in hestiacp/hestiacp
Cross-site Scripting (XSS) - Generic in GitHub repository hestiacp/hestiacp prior to 1.5.9.
-
Low 3.8
OS Command Injection in ljharb/npm-lockfile
OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4.
-
Low 3.5
Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.9.
-
Low 2.7
JFrog Artifactory before 7.31.10, is vulnerable to Broken Access Control where a project admin user is able to list all…
-
Low 2.8
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiManager v…
-
Low 2.6
Unauthorized forwarding of confidential headers in fluture-node
Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using `followRedirects` or `followRedirectsWith` with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential hea…
-
Low 2.6
A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version 6.0.11 and …