Archive
1 April 2022
Vulnerabilities first published on this day (UTC), newest first.
26 results · Clear filters · Feed
-
Medium 5.5CVE-2022-1068 Public exploit
Modbus Tools Modbus Slave Stack-Based Buffer Overflow
Modbus Tools Modbus Slave (versions 7.4.2 and prior) is vulnerable to a stack-based buffer overflow in the registration field. This may cause the program to crash when a long character string is used.
-
Medium 5.3
ICSA-20-147-01 Inductive Automation Ignition (Update B)
Sensitive information can be obtained through the handling of serialized data. The issue results from the lack of proper authentication required to query the server
-
Medium 5.8
Improper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed an attacker to steal en…
-
Medium 5.4
A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 al…
-
Medium 6.5
In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and a…
-
Medium 4.3
Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-…
-
Medium 4.3
Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project…
-
Medium 5.6
Security issues in Intelligent Power Protector
The vulnerability exists due to insufficient validation of input from certain resources by the IPP software. The attacker would need access to the local Subnet and an administrator interaction to compromise the system. This issue affects: Intelligent Power Pr…
-
Medium 5.6
Security issues in Intelligent Power Manager (IPM 1)
The vulnerability exists due to insufficient validation of input of certain resources within the IPM software. This issue affects: Intelligent Power Manager (IPM 1) versions prior to 1.70.
-
Medium 6.5CVE-2022-22950 EPSS 37%
Allocation of Resources Without Limits or Throttling in Spring Framework
n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
-
Medium 5.5
ICSA-22-088-01 Rockwell Automation ISaGRAF
When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remot…
-
Medium 6.5
ICSMA-22-088-01 Philips e-Alert
The software does not perform any authentication for critical system functionality.
-
Medium 6.5
Philips Vue PACS Protection Mechanism Failure
Philips Vue PACS versions 12.2.x.x and prior does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
-
Medium 6.1
Philips Vue PACS
Philips Vue PACS versions 12.2.x.x and prior does not ensure or incorrectly ensures structured messages or data are well formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
-
Medium 6.1
Cross-site Scripting in @rocket.chat/livechat
A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance.
-
Medium 6.0
Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A local authenticated use…
-
Medium 4.4
Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A authenticated malicious…
-
Medium 6.0
Wyse Device Agent version 14.6.1.4 and below contain an Improper Authentication vulnerability. A malicious user could p…
-
Medium 6.6
Out-of-bounds read in radareorg/radare2
Out-of-bounds read in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to read sensitive information from outside the allocated buffer boundary.
-
Medium 6.5
IBM App Connect Enterprise Certified Container Dashboard UI (IBM App Connect Enterprise Certified Container 1.5, 2.0, 2…
-
Medium 5.6
IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user due to missing revoca…
-
Medium 5.4
IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive informatio…
-
Medium 6.2
IBM SterlingPartner Engagement Manager 6.2.0 could allow a malicious user to elevate their privileges and perform unint…
-
Medium 5.9
IBM UrbanCode Deploy (UCD) 7.0.5, 7.1.0, 7.1.1, and 7.1.2 uses weaker than expected cryptographic algorithms that could…
-
Medium 5.3
Improper Certificate Validation in node-sass affects eZ Platform
Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. This affects eZ Platform v2.5 only. The maintainers resolved it by replacing node-sass 4.11 with sass 1.3…
-
Medium 5.5
Possible buffer overflow due to improper data validation of external commands sent via DIAG interface in Snapdragon Aut…