Archive
March 2022
Vulnerabilities first published in this month (UTC), newest first.
381 results · Clear filters · Feed
-
Medium 5.5
ICSA-22-062-01 IPCOMM ipDIO
Persistent cross-site scripting (XSS) in the web interface of ipDIO allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into specific fields. The XSS payload will be executed when a legitimate user attempts to…
-
Medium 6.3
ICSA-22-062-01 IPCOMM ipDIO
Persistent cross-site scripting in the web interface of ipDIO allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into a specific parameter. The XSS payload will be executed when a legitimate user attempts t…
-
Medium 4.3
Stack overflow in document extractor in Mattermost
A stack overflow bug in the document extractor in Mattermost Server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted Apple Pages document.
-
Medium 5.3
Stack overflow in SAML login in Mattermost
A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted POST body.
-
Medium 5.8
Vulnerability: Authenticated SQL Injection in API
Found a potential security vulnerability inside the Pandora API. Affected Pandora FMS version range: all versions of NG version, up to OUM 759. This vulnerability could allow an attacker with authenticated IP to inject SQL.
-
Medium 5.3
PhpMyAdmin exposure of sensitive information
PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.
-
Medium 6.8
Signiant - Manager+Agents XML External Entity (XXE)
Signiant - Manager+Agents XML External Entity (XXE) - Extract internal files of the affected machine An attacker can read all the system files, the product is running with root on Linux systems and nt/authority on windows systems, which allows him to access a…
-
Medium 6.4
Arbitrary Code Execution
An arbitrary code execution vulnerability was found in the F-Secure Support Tool. A standard user can craft a special configuration file, which when run by administrator can execute any commands.
-
Medium 5.3
Veritas System Recovery (VSR) 18 and 21 stores a network destination password in the Windows registry during configurat…
-
Medium 6.5
Use after free vulnerability in PDFTron SDK
A use after free vulnerability was discovered in PDFTron SDK version 9.2.0. A crafted PDF can overwrite RIP with data previously allocated on the heap. This issue affects: PDFTron PDFTron SDK 9.2.0 on OSX; 9.2.0 on Linux; 9.2.0 on Windows.
-
Medium 6.1CVE-2022-0891 Public exploit
A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker t…
-
Medium 5.3
Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 2
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affected. If you use service custom variables in role restrictions, and you regularly decommission service…
-
Medium 4.3
Advanced permissions is not respected for subfolders in Nextcloud server
Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolders, for example, a u…
-
Medium 5.3
User enumeration setting not respected in Nextcloud server
Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumeration settings by the administrator. This allowed a user to enumerate other users on the instance, even…
-
Medium 4.7
Geolocation preview links can be set to arbitrary links in nextcloud talk
Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation preview in the Nextcloud Talk application due to a lack of validation on the link. This could result in an open-redirect, but…
-
Medium 6.2
Improper access control vulnerability in Samsung Account prior to version 13.1.0.1 allows attackers to access to the au…
-
Medium 4.0
Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applicat…
-
Medium 4.0
An use after free vulnerability in sdp driver prior to SMR Mar-2022 Release 1 allows kernel crash.
-
Medium 4.2
A vulnerable design in fingerprint matching algorithm prior to SMR Mar-2022 Release 1 allows physical attackers to perf…
-
Medium 5.3
OOB read vulnerability in hdcp2 device node prior to SMR Mar-2022 Release 1 allow an attacker to view Kernel stack memo…
-
Medium 6.5
Improper boundary check in UWB stack prior to SMR Mar-2022 Release 1 allows arbitrary code execution.
-
Medium 4.0
Improper authentication in One UI Home prior to SMR Mar-2022 Release 1 allows attacker to generate pinned-shortcut with…
-
Medium 4.1
Improper authentication in Samsung Lock and mask apps setting prior to SMR Mar-2022 Release 1 allows attacker to change…
-
Medium 5.5
PendingIntent hijacking vulnerability in Weather application prior to SMR Mar-2022 Release 1 allows local attackers to …
-
Medium 5.5
PendingIntent hijacking vulnerability in Wearable Manager Installer prior to SMR Mar-2022 Release 1 allows local attack…
-
Medium 4.2
Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows phys…
-
Medium 4.4
An Improper access control vulnerability in StRetailModeReceiver in Wear OS 3.0 prior to Firmware update MAR-2022 Relea…
-
Medium 4.1
Unprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app withou…
-
Medium 5.9
Security misconfiguration of RKP in kernel prior to SMR Mar-2022 Release 1 allows a system not to be protected by RKP.
-
Medium 6.8
A vulnerability has been identified in Mendix Runtime V7 (All versions < V7.23.29), Mendix Runtime V8 (All versions < V…
-
Medium 5.9
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i8…
-
Medium 5.9
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i8…
-
Medium 5.9
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100,…
-
Medium 6.7
A vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.8), RUGGEDCOM i801 (All versions < V4.3.8), …
-
Medium 6.1
A local attacker can overwrite arbitrary files on the system with VPN client logs using administrator privileges, poten…
-
Medium 6.5
Exposure of Sensitive Information to an Unauthorized Actor in httpie
HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. Before 3.1.0, HTTPie didn‘…
-
Medium 6.5
Improper Restriction of XML External Entity Reference in trytond and proteus
An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and…
-
Medium —
pgjdbc Arbitrary File Write Vulnerability
In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could crea…
-
Medium 6.1
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged trusted host user to exploit a vulnerability in the ni…
-
Medium 6.2
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kerne…