Archive
March 2022
Vulnerabilities first published in this month (UTC), newest first.
2,085 results · Feed
-
Medium 5.6
Null Pointer Dereference Caused Segmentation Fault in gpac/gpac
Null Pointer Dereference Caused Segmentation Fault in GitHub repository gpac/gpac prior to 2.1.0-DEV.
-
High 7.5
Apache DolphinScheduler user registration is vulnerable to ReDoS attacks
Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
-
Medium 6.8CVE-2022-1163 Public exploit
Cross-site Scripting (XSS) - Stored in mineweb/minewebcms
Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next.
-
High 7.1
Data Loss/Denial of Service in SWHKD
SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. There can be data loss or a denial of service.
-
Unscored —CVE-2022-24693 Public exploit
Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily …
-
Unscored —
SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL command…
-
Unscored —
SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands v…
-
Unscored —
Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content.
-
Low 3.4
A flaw was found in the Linux kernels implementation of audit rules, where a syscall can unexpectedly not be correctly …
-
Unscored —
An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight…
-
Unscored —
An issue was discovered in MediaWiki through 1.37.1. ImportPlanValidator.php in the FileImporter extension mishandles t…
-
Unscored —
An issue was discovered in Mediawiki through 1.37.1. The check for the override-antispoof permission in the AntiSpoof e…
-
Unscored —
An issue was discovered in MediaWiki through 1.37.1. The CentralAuth extension mishandles a ttl issue for groups expiri…
-
High 7.3
heap buffer overflow in get_one_sourceline in vim/vim
heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.
-
High 7.8
Use after free in utf_ptr2char in vim/vim
Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.
-
High 7.5
Infinite Loop in PJSIP
PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps. Users are advised to update.…
-
Unscored —
In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by int…
-
Medium 6.5
Archer 6.x through 6.10 (6.10.0.0) contains a reflected XSS vulnerability. A remote SAML-unauthenticated malicious Arch…
-
Medium 5.4
Archer 6.x through 6.9 P2 (6.9.0.2) is affected by an open redirect vulnerability. A remote unprivileged attacker may p…
-
Medium 5.3
Archer 6.x through 6.9 SP2 P1 (6.9.2.1) contains an improper access control vulnerability on attachments. A remote auth…
-
Medium 5.8
The Archer RSS feed integration for Archer 6.x through 6.9 SP1 (6.9.1.0) is affected by an insecure credential storage …
-
Medium 6.3
Archer 6.x through 6.9 SP3 (6.9.3.0) contains a reflected XSS vulnerability. A remote authenticated malicious Archer us…
-
Unscored —
A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by e…
-
Critical 9.1
Insecure Temporary File in SWHKD
SWHKD 1.1.5 unsafely uses the /tmp/swhkd.pid pathname. There can be an information leak or denial of service.
-
Unscored —
Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used. When first powered up, a signature w…
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to…
-
Unscored —
textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body. A remote and unauthentic…
-
Critical 9.8
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to up…
KEV Mar 31, 2022 -
High 7.8
NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote…
-
Unscored —CVE-2021-43118 EPSS 35%
A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek …
-
Unscored —
A Format String vulnerability exists in DrayTek Vigor 2960 <= 1.5.1.3, DrayTek Vigor 3900 <= 1.5.1.3, and DrayTek Vigor…
-
Unscored —
An Access Conrol vulnerability exists in PuneethReddyHC online-shopping-system as of 11/01/2021 in add_products.
-
Unscored —
An SQL Injection vulnerability exits in PuneethReddyHC online-shopping-system as of 11/01/2021 via the p parameter in p…
-
Unscored —
A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a larg…
-
Medium 6.5
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious ac…
KEV Jul 17, 2024 -
Unscored —
Cross Site Scripting (XSS) vulnerability exists in cxuucms v3 via the imgurl of /feedback/post/ content parameter.
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection in GetCalcTagList
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetCalcTagList. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
-
High 7.8
Delta Electronics DIAEnergie Incorrect Default Permissions
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to an incorrect default permission in the DIAEnergie application, which may allow an attacker to plant new files (such as DLLs) or replace existing executable files.
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection in GetDemandAnalysisData
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetDemandAnalysisData. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system co…
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection in DIAE_hierarchyHandler.ashx
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerPageP_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system command…