Archive
March 2022
Vulnerabilities first published in this month (UTC), newest first.
2,085 results · Feed
-
Unscored —
DWSurvey v3.2.0 was discovered to contain an arbitrary file write vulnerability via the component /utils/ToHtmlServlet.…
-
Unscored —
The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into th…
-
Unscored —
DWSurvey v3.2.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /sysuser/Sys…
-
Unscored —
The PluginsUpload function in application/service/PluginsAdminService.php of ShopXO v1.9.0 contains an arbitrary file u…
-
Unscored —
An arbitrary file upload vulnerability in the upload payment plugin of ShopXO v1.9.0 allows attackers to execute arbitr…
-
Unscored —
Yafu v2.0 contains a segmentation fault via the component /factor/avx-ecm/vecarith52.c. This vulnerability allows attac…
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in the Add a Button function of Eova v1.6.0 allows attackers to execu…
-
Unscored —
TMS v2.28.0 contains an insecure permissions vulnerability via the component /TMS/admin/user/Update2. This vulnerabilit…
-
Unscored —
TMS v2.28.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /TMS/admin/setting/ma…
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in the component /admin/contenttemp of DoraCMS v2.1.8 allows attacker…
-
Unscored —
Beijing Wisdom Vision Technology Industry Co., Ltd One Card Integrated Management System 3.0 is vulnerable to SQL Injec…
-
Unscored —CVE-2022-24125 Public exploit
The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send a…
-
Medium 4.0CVE-2022-25481 Scanner template
Exposure of Resource to Wrong Sphere in ThinkPHP Framework
ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an inte…
-
Unscored —
A buffer overflow in the NRSessionSearchResult parser in Bandai Namco FromSoftware Dark Souls III through 2022-03-19 al…
-
High 8.2
Insufficient Session Expiration in admidio/admidio
Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9.
-
Unscored —
A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry i…
-
Medium —
Possibility for Denial of Service by overwriting PHP files with language exports
### Impact Laravel Translation Manager didn't check the locale name, which allowed directory traversal when exporting files. The content would be a PHP file returning an array of translations, but this could lead to unexpected results, like denial of service.…
-
Unscored —
Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenance_actions.php.
-
Unscored —
Piwigo v12.2.0 was discovered to contain a SQL injection vulnerability via pwg.users.php.
-
Critical 9.8
Remote Code Execution in Contao Managed Edition
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.
-
Unscored —CVE-2022-25581 Public exploit
Classcms v2.5 and below contains an arbitrary file upload via the component \class\classupload. This vulnerability allo…
-
Unscored —
taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file.
-
Unscored —
DCN Firewall DCME-520 was discovered to contain a remote command execution (RCE) vulnerability via the host parameter i…
-
Unscored —
DCN Firewall DCME-520 was discovered to contain an arbitrary file download vulnerability via the path parameter in the …
-
Unscored —
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the endip parameter in the SetPptpServerCfg…
-
Unscored —
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the startip parameter in the SetPptpServerC…
-
Unscored —
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the S1 parameter in the SetSysTimeCfg funct…
-
Unscored —
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the cmdinput parameter in the exeCommand fu…
-
Unscored —
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the ntpserver parameter in the SetSysTimeCf…
-
Unscored —
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the security_5g parameter in the WifiBasicS…
-
Unscored —
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the list parameter in the SetIpMacBind func…
-
Unscored —
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the loginpwd parameter in the SetFirewallCf…
-
Unscored —
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the URLs parameter in the saveParentControl…
-
Unscored —
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the time parameter in the saveParentControl…
-
Unscored —
Tenda AC6 V15.03.05.09_multi was discovered to contain a stack overflow via the list parameter in the setstaticroutecfg…
-
Unscored —
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the deviceId parameter in the saveParentCon…
-
Unscored —CVE-2022-25450 EPSS 12%
Tenda AC6 V15.03.05.09_multi was discovered to contain a stack overflow via the list parameter in the SetVirtualServerC…
-
Unscored —
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the day parameter in the openSchedWifi func…
-
Unscored —
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the schedendtime parameter in the openSched…
-
Unscored —
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the schedstarttime parameter in the openSch…