Archive
5 April 2022
Vulnerabilities first published on this day (UTC), newest first.
122 results · Feed
-
High 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
High 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
High 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
High 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
High 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
High 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
High 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
Medium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Microsoft Edge (Chromium-based) Spoofing Vulnerability
-
High 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
High 7.5
Pinot segment push endpoint has a vulnerability in unprotected environments
In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disr…
-
Unscored —
Payroll Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter.
-
Unscored —
Online Student Admission v1.0 was discovered to contain a SQL injection vulnerability via the txtapplicationID paramete…
-
Unscored —
Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.
-
Unscored —
Online Sports Complex Booking v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.
-
Unscored —
Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via the user parameter.
-
Unscored —
Insurance Management System 1.0 was discovered to contain a SQL injection vulnerability via the username parameter.
-
Unscored —
Employee Performance Evaluation v1.0 was discovered to contain a SQL injection vulnerability via the email parameter.
-
Unscored —
Matrimony v1.0 was discovered to contain a SQL injection vulnerability via the Password parameter.
-
Medium 5.4
Cross-site Scripting in Combodo iTop
Combodi iTop is a web based IT Service Management tool. Prior to versions 2.7.6 and 3.0.0, cross-site scripting is possible for scripts outside of script tags when displaying HTML attachments. This issue is fixed in versions 2.7.6 and 3.0.0. There are current…
-
Unscored —
Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remot…
-
Low —
XSS Injection Vulnerability
### Impact Under some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied. ### Patches This has been patched in Craft 3.7.29. ### References * https://github.com/craftcms/cms/blob/develop/CHANGELOG…
-
High 8.8CVE-2022-24780 Public exploit
Code Injection in Combodo iTop
Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user priv…
-
Unscored —
Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history.
-
Unscored —
Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name.
-
Unscored —
Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occur…
-
Unscored —
Jellycms v3.8.1 and below was discovered to contain an arbitrary file upload vulnerability via \app.\admin\Controllers\…
-
High 8.4
In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields
-
High 7.3
In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI
-
Medium 4.6
In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue d…
-
Medium 5.7
In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered
-
High 7.5
heap-buffer-overflow in radareorg/radare2
heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.
-
High 7.5
Buffer length underflow in LoginPacket causing unchecked exceptions to be thrown
### Impact `LoginPacket` uses `BinaryStream->getLInt()` to read the lengths of JSON payloads it wants to decode. Unfortunately, `BinaryStream->getLInt()` returns a signed integer, meaning that a malicious client can craft a packet with a large uint32 value fo…
-
Unscored —CVE-2022-26635 EPSS 21%
PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injection. …
-
Medium 5.3
IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an attacker to enumerate account credentials due to an observable discr…
-
Medium 5.3
IBM MQ Appliance 9.2 CD and 9.2 LTS are vulnerable to a denial of service in the Login component of the application whi…
-
High 7.4
Cross-site Scripting (XSS) - DOM in tastyigniter/tastyigniter
Cross-site Scripting (XSS) - DOM in GitHub repository tastyigniter/tastyigniter prior to 3.3.0.
-
Unscored —
Stack overflow vulnerability in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021 due …
-
Medium 6.1
Open redirect in wwbn/avideo
Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page.
-
Unscored —
Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437. Because of this version of the java deseri…
-
Unscored —
File upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and *.hello files using the Medi…