Archive
March 2022
Vulnerabilities first published in this month (UTC), newest first.
2,085 results · Feed
-
High 7.2
Certain Tesla vehicles through 2022-03-26 allow attackers to open the charging port via a 315 MHz RF signal containing …
-
Unscored —
Marky commit 3686565726c65756e was discovered to contain a remote code execution (RCE) vulnerability via the Display te…
-
Critical 9.8
D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set…
KEV Sep 8, 2022 -
Unscored —
Notable v1.8.4 does not filter text editing, allowing attackers to execute arbitrary code via a crafted payload injecte…
-
Unscored —
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via sh…
-
Unscored —
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via sh…
-
Unscored —
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via sh…
-
Unscored —
stb_image.h (aka the stb image loader) 2.19, as used in libsixel and other products, has a reachable assertion in stbi_…
-
High 7.7
User after free in mrb_vm_exec in mruby/mruby
User after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.
-
High —
Arbitrary shell execution
A properly crafted filename would allow for arbitrary code execution when using the --filter=gitmodified command line option
-
High —
Arbitrary shell execution
Uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases
-
Medium 5.5
libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
-
Unscored —
tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in get_l2len_protocol in common/get.c.
-
Unscored —
tcprewrite in Tcpreplay 4.4.1 has a reachable assertion in get_layer4_v6 in common/get.c.
-
Unscored —
tcpprep in Tcpreplay 4.4.1 has a heap-based buffer over-read in parse_mpls in common/get.c.
-
Unscored —
tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in get_ipv6_next in common/get.c.
-
Unscored —
A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to…
-
Unscored —CVE-2021-40906 Public exploit
CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is i…
-
High 8.8CVE-2021-40905 Public exploit
The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the upl…
-
Unscored —CVE-2021-40904 Public exploit
The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Do…
-
Low 3.7
Discoverability of user password hash in Statamic CMS
Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's password hash using a specially crafted regular expression filter in the users endpoint of the REST API. Multiple such reques…
-
Critical 10.0
Sandbox bypass leading to arbitrary code execution in Deno
Deno is a runtime for JavaScript and TypeScript. The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are vulnerable to an attack where a malicious actor controlling the code executed in a Deno runtime could bypass all permission checks and exec…
-
Unscored —
The DuckDuckGo browser 7.64.4 on iOS allows Address Bar Spoofing due to mishandling of the JavaScript window.open funct…
-
Unscored —
Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any administrator writable…
-
Unscored —
TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which is exploited via a crafted POST …
-
Unscored —
Incorrect permissions in the Bluetooth Services in the Fortessa FTBTLD Smart Lock as of 12-13-2022 allows a remote atta…
-
Unscored —
A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version …
-
Unscored —
Joget DX 7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Datalist table.
-
Unscored —
libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter.…
-
Unscored —
Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial con…
-
Unscored —
Mendelson OFTP2 before 1.1 b43 is affected by directory traversal. To access the vulnerable code path, the attacker has…
-
Unscored —
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/vod/data.…
-
Unscored —
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/ulog/inde…
-
Unscored —
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/plog/inde…
-
Unscored —
Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/…
-
Unscored —
Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/…
-
Unscored —
SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the syst…
-
High 8.1
Improper Certificate Validation in kubeclient
A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up acceptin…
-
High 7.8
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This…
KEV Aug 26, 2026 -
High 8.8
SQL Injection in Moodle
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.