Archive
8 April 2022
Vulnerabilities first published on this day (UTC), newest first.
59 results · Feed
-
High —
Daemon panics when processing certain blocks
### Impact go-ipfs nodes with versions 0.10.0, 0.11.0, 0.12.0, or 0.12.1 can crash when trying to traverse certain malformed graphs due to an issue in the go-codec-dagpb dependency. Vulnerable nodes that work with these malformed graphs may crash leading to d…
-
Unscored —
A Cross-Site Request Forgery (CSRF) in IceHrm 31.0.0.OS allows attackers to delete arbitrary users or achieve account t…
-
Unscored —CVE-2022-26180 Public exploit
qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI.
-
Unscored —CVE-2021-43009 Public exploit
A Cross Site Scripting (XSS) vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the requ…
-
Medium 5.5
Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contains an incorrect default permissions vulnerability. A local malicio…
-
High 8.1
Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain risky cryptographic algorithms. A remote unprivileged malicious at…
-
High 8.1
Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random number generator. A remote una…
-
Critical 9.1
Dell PowerScale OneFS, 8.2.2-9.3.x, contains a predictable file name from observable state vulnerability. An unprivileg…
-
Medium 6.3
Dell PowerScale OneFS, versions 8.2.x, 9.0.0.x, 9.1.0.x, 9.2.0.x, 9.2.1.x, and 9.3.0.x, contain an improper preservatio…
-
Medium 4.4
Dell EMC Powerscale OneFS 8.2.x - 9.2.x omit security-relevant information in /etc/master.passwd. A high-privileged use…
-
Medium 6.4
Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. A local malicious admi…
-
Medium 6.4
Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. A local malicious admi…
-
High 8.6
Dell VNX2 for File version 8.1.21.266 and earlier, contain a path traversal vulnerability which may lead unauthenticate…
-
High 7.3
Dell VNX2 for file version 8.1.21.266 and earlier, contain an unauthenticated remote code execution vulnerability which…
-
Medium 5.3
Unauthenticated user can list hidden document from multiple velocity templates
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents. The problem has been patched in XW…
-
Medium 5.3CVE-2022-24819 Scanner template
Unauthenticated user can retrieve the list of users through uorgsuggest.vm
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki vers…
-
Medium 6.8
Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that a…
-
High 7.5
heap-use-after-free in radareorg/radare2
heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.
-
Unscored —
An Access Control vulnerability exists in ATutor 2.2.4 in password_reminder.php when the g, id, h, form_password_hidden…
-
Medium 6.6
NULL Pointer Dereference in r_bin_ne_get_entrypoints function in radareorg/radare2
NULL Pointer Dereference in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to cause a denial of service (application crash).
-
High 7.8
Improper Neutralization of Formula Elements in a CSV File in Kimai 2
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field with malicious payload, it will be mistreated while exporting to a CSV file.
-
Unscored —
FOSCAM Camera FI9805E with firmware V4.02.R12.00018510.10012.143900.00000 contains a backdoor that opens Telnet port wh…
-
Unscored —
A Buffer Overflow vulnerability exists in zlog 1.2.15 via zlog_conf_build_with_file in src/zlog/src/conf.c.
-
Unscored —
mogu_blog_cms 5.2 suffers from upload arbitrary files without any limitation.
-
Unscored —
GPAC mp4box 1.1.0-DEV-rev1663-g881c6a94a-master is vulnerable to Integer Overflow.
-
Unscored —
GPAC mp4box 1.1.0-DEV-rev1759-geb2d1e6dd-has a heap-buffer-overflow vulnerability in function gf_isom_apple_enum_tag.
-
Medium 6.5
IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacke…
-
Medium 4.3
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.3, and 6.1.1.0 is vulnerabl…
-
Unscored —
An Access Control vulnerability exists in CLARO KAON CG3000 1.00.67 in the router configuration, which could allow a ma…
-
Unscored —
libsixel before 1.10 is vulnerable to Buffer Overflow in libsixel/src/quant.c:867.
-
Unscored —
libsixel 1.8.6 is affected by Buffer Overflow in libsixel/src/quant.c:876.
-
Unscored —
libsixel 1.10.0 is vulnerable to Use after free in libsixel/src/dither.c:379.
-
Unscored —
libsixel 1.8.6 suffers from a Heap Use After Free vulnerability in in libsixel/src/dither.c:388.
-
Unscored —CVE-2021-46367 EPSS 30%
RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel. An authenticated…
-
Unscored —
A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers …
-
Unscored —
An issue was discovered in ZZCMS 2021. There is a cross-site scripting (XSS) vulnerability in ad_manage.php.
-
Unscored —
An issue was discovered in ZZCMS 2021. There is a SQL injection vulnerability in ad_manage.php.
-
High 7.2
SQL injection in RecyclebinController.php in pimcore/pimcore
SQL injection in RecyclebinController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data
-
Unscored —
Movie Seat Reservation v1 was discovered to contain an unauthenticated file disclosure vulnerability via /index.php?pag…
-
Unscored —
Movie Seat Reservation v1 was discovered to contain a SQL injection vulnerability at /index.php?page=reserve via the id…