Archive
1 April 2022
Vulnerabilities first published on this day (UTC), newest first.
104 results · Feed
-
Unscored —
Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all vers…
-
Unscored —
Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all vers…
-
Unscored —
Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all version…
-
Unscored —
Use of Password Hash Instead of Password for Authentication vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5…
-
Unscored —
Use of Password Hash Instead of Password for Authentication vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5…
-
Unscored —
Use of Weak Hash vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric …
-
Medium 5.5CVE-2022-1068 Public exploit
Modbus Tools Modbus Slave Stack-Based Buffer Overflow
Modbus Tools Modbus Slave (versions 7.4.2 and prior) is vulnerable to a stack-based buffer overflow in the registration field. This may cause the program to crash when a long character string is used.
-
High 7.8
Rockwell Automation Studio 5000 Logix Designer Code Injection
Omron CX-Position (versions 2.5.3 and prior) is vulnerable to multiple stack-based buffer overflow conditions while parsing a specific project file, which may allow an attacker to locally execute arbitrary code.
-
High 7.8
Rockwell Automation Studio 5000 Logix Designer Out-of-Bounds Write
Omron CX-Position (versions 2.5.3 and prior) is vulnerable to an out-of-bounds write while processing a specific project file, which may allow an attacker to execute arbitrary code.
-
High 7.8
Rockwell Automation Studio 5000 Logix Designer Improper Restriction of Operations within the Bounds of a Memory Buffer
Omron CX-Position (versions 2.5.3 and prior) is vulnerable to memory corruption while processing a specific project file, which may allow an attacker to execute arbitrary code.
-
High 7.8
Rockwell Automation Studio 5000 Logix Designer Use After Free
Omron CX-Position (versions 2.5.3 and prior) is vulnerable to a use after free memory condition while processing a specific project file, which may allow an attacker to execute arbitrary code.
-
Medium 5.3
ICSA-20-147-01 Inductive Automation Ignition (Update B)
Sensitive information can be obtained through the handling of serialized data. The issue results from the lack of proper authentication required to query the server
-
High 7.7
Rockwell Automation Studio 5000 Logix Designer Code Injection
Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a workstation running Studio 5000 Logix Designer could inject controller code undetectable to a user.
-
High 7.5
On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol fi ...
On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol field as e…
-
Unscored —
Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 Marc…
-
Unscored —
A denial-of-service issue existed in one of modules that was incorporated in Kaspersky Anti-Virus products for home and…
-
Unscored —
It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 (https://access.redhat.com/errata/RHSA…
-
High 7.1
Keycloak insufficient session expiration
A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name].
-
Unscored —
Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance user…
-
High 7.5
AC 800M MMS - Denial of Service vulnerability in MMS communication
Improper Input Validation vulnerability in ABB 800xA, Control Software for AC 800M, Control Builder Safe, Compact Product Suite - Control and I/O, ABB Base Software for SoftControl allows an attacker to cause the denial of service.
-
High 7.8
eScan Anti-Virus Local privilege escalation Vulnerability
An local privilege escalation vulnerability due to a "runasroot" command in eScan Anti-Virus. This vulnerability is due to invalid arguments and insufficient execution conditions related to "runasroot" command. This vulnerability can induce remote attackers t…
-
High 7.8
Bandisoft ARK Library Out-of-bound Vulnerability
A remote code execution vulnerability due to incomplete check for 'xheader_decode_path_record' function's parameter length value in the ark library. Remote attackers can induce exploit malicious code using this function.
-
Medium 5.8
Improper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed an attacker to steal en…
-
Medium 5.4
A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 al…
-
Medium 6.5
In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and a…
-
Medium 4.3
Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-…
-
Medium 4.3
Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project…
-
Low 3.5
An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 . It was possible to trigger a D…
-
Medium 5.6
Security issues in Intelligent Power Protector
The vulnerability exists due to insufficient validation of input from certain resources by the IPP software. The attacker would need access to the local Subnet and an administrator interaction to compromise the system. This issue affects: Intelligent Power Pr…
-
Medium 5.6
Security issues in Intelligent Power Manager (IPM 1)
The vulnerability exists due to insufficient validation of input of certain resources within the IPM software. This issue affects: Intelligent Power Manager (IPM 1) versions prior to 1.70.
-
Medium 6.5CVE-2022-22950 EPSS 37%
Allocation of Resources Without Limits or Throttling in Spring Framework
n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
-
Critical 9.8
Remote Code Execution in Spring Framework
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot…
KEV Apr 4, 2022 -
Unscored —
An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsyst…
-
Unscored —
It was observed that while login into Business-central console, HTTP request discloses sensitive information like usern…
-
Unscored —
A command injection vulerability found in quick game engine allows arbitrary remote code in quick app. Allows remote at…
-
Unscored —
It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be access…
-
Medium 5.5
ICSA-22-088-01 Rockwell Automation ISaGRAF
When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remot…
-
Medium 6.5
ICSMA-22-088-01 Philips e-Alert
The software does not perform any authentication for critical system functionality.
-
High 7.8
Delta Electronics DIAEnergie Uncontrolledly Search Path Element
Delta Electronics DIAEnergie (all versions prior to 1.8.02.004) are vulnerable to a DLL hijacking condition. When combined with the Incorrect Default Permissions vulnerability of 4.2.2 above, this makes it possible for an attacker to escalate privileges
-
High 7.5
Philips Vue PACS Use of a Broken or Risky Cryptographic Algorithm
The use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and prior is an unnecessary risk that may result in the exposure of sensitive information.