Archive
March 2022
Vulnerabilities first published in this month (UTC), newest first.
381 results · Clear filters · Feed
-
Medium 6.5
Missing authorization in Nextcloud text
Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is by default shipped with Nextcloud Server, an attacker is able to access the folder names of "File D…
-
Medium 6.1
Cross-site Scripting in jeecg-boot
A Cross Site Scripting (XSS) vulnerabilitiy exits in jeecg-boot 3.0 in /jeecg-boot/jmreport/view with a mouseover event.
-
Medium 5.3
IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 could disclose internal IP address information when the web back…
-
Medium 6.2
IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 saves user-provided information into a Comma-Separated Value (CS…
-
Medium 4.3
Unrestricted file upload leads to stored XSS in microweber/microweber
Unrestricted file upload leads to stored XSS in GitHub repository microweber/microweber prior to 1.1.12.
-
Medium 6.5
Arbitrary file write in nats-server
NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected.
-
Medium 5.5
NULL Pointer Dereference in mruby/mruby
NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2.
-
Medium 6.5
Missing Authorization in go-gitea/gitea
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4.
-
Medium 5.3
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a disruption of c…
-
Medium 5.3
A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could caus…
-
Medium 4.8
Guest session is shared between customers in shopware
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared between customers when HTTP cache is enabled. This can lead to inconsistent experiences for guest users. …
-
Medium 6.1
HTML injection possibility in voucher code form
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possible to inject code via the voucher code form. This issue has been patched in version 6.4.8.1. There are no known workaro…
-
Medium 6.3
HTTP caching is marking private HTTP headers as public
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sensitive HTTP headers to be non-cacheable. If there is an HTTP cache between the server and client the…
-
Medium 6.8
Incorrect Authentication in shopware
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modify customers and to create orders without App Permission. This issue is a result of improper api rout…
-
Medium 6.3
Maddy Mail Server does not implement account expiry
Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually…
-
Medium 5.4
WAGO PLCs WBM vulnerable to reflected XSS
Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use this to gain access to confidential information on a PC that connects to the WBM after it has been co…
-
Medium 4.6
Reflected XSS in action configuration window of Zabbix Frontend
An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page b…
-
Medium 4.1
PAN-OS: Use of a Weak Cryptographic Algorithm for Stored Password Hashes
Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not created with a sufficient level of computational effort, which allows for password cracking attacks on acc…
-
Medium 6.1
Visual Studio Code Spoofing Vulnerability
Visual Studio Code Spoofing Vulnerability
-
Medium 6.5
Skype Extension for Chrome Information Disclosure Vulnerability
Skype Extension for Chrome Information Disclosure Vulnerability
-
Medium 6.5
Azure Site Recovery Elevation of Privilege Vulnerability
Azure Site Recovery Elevation of Privilege Vulnerability
-
Medium 6.5
Azure Site Recovery Elevation of Privilege Vulnerability
Azure Site Recovery Elevation of Privilege Vulnerability
-
Medium 6.5
Azure Site Recovery Elevation of Privilege Vulnerability
Azure Site Recovery Elevation of Privilege Vulnerability
-
Medium 6.3
.NET and Visual Studio Remote Code Execution Vulnerability
.NET and Visual Studio Remote Code Execution Vulnerability
-
Medium 5.5
Microsoft Office Word Tampering Vulnerability
Microsoft Office Word Tampering Vulnerability
-
Medium 6.5
Azure Site Recovery Elevation of Privilege Vulnerability
Azure Site Recovery Elevation of Privilege Vulnerability
-
Medium 5.4
Remote Desktop Protocol Client Information Disclosure Vulnerability
Remote Desktop Protocol Client Information Disclosure Vulnerability
-
Medium 4.3CVE-2022-24502 EPSS 33%
Windows HTML Platforms Security Feature Bypass Vulnerability
Windows HTML Platforms Security Feature Bypass Vulnerability
-
Medium 6.5CVE-2022-24463 EPSS 32%
Microsoft Exchange Server Spoofing Vulnerability
Microsoft Exchange Server Spoofing Vulnerability
-
Medium 5.5
Microsoft Word Security Feature Bypass Vulnerability
Microsoft Word Security Feature Bypass Vulnerability
-
Medium 5.5
Windows NT Lan Manager Datagram Receiver Driver Information Disclosure Vulnerability
Windows NT Lan Manager Datagram Receiver Driver Information Disclosure Vulnerability
-
Medium 5.5
Windows Common Log File System Driver Information Disclosure Vulnerability
Windows Common Log File System Driver Information Disclosure Vulnerability
-
Medium 5.9
Microsoft Defender for Endpoint Spoofing Vulnerability
Microsoft Defender for Endpoint Spoofing Vulnerability
-
Medium 6.5
Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability
Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability
-
Medium 4.4
Media Foundation Information Disclosure Vulnerability
Media Foundation Information Disclosure Vulnerability
-
Medium 4.7
Windows Hyper-V Denial of Service Vulnerability
Windows Hyper-V Denial of Service Vulnerability
-
Medium 5.5
Windows Media Center Update Denial of Service Vulnerability
Windows Media Center Update Denial of Service Vulnerability
-
Medium 4.7
Reflected Cross-site Scripting at DsaDataTest
It was discovered that the /DsaDataTest endpoint is susceptible to Cross-site scripting (XSS) attack. It was noted that the Metric parameter does not have any input checks on the user input that allows an attacker to craft its own malicious payload to trigger…
-
Medium 5.3
Directory Traversal Partial Write at AgentDaServlet
It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDaServlet has directory traversal vulnerabilities at the "/api/appInternals/1.0/agent/da/pcf" API. The affected endpoint does not have any validation of the user's input …
-
Medium 5.3
Sensitive Data Disclosure Vulnerability
Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details about the Web Help Desk installation.