Archive
11 April 2022
Vulnerabilities first published on this day (UTC), newest first.
52 results · Clear filters · Feed
-
Medium 6.5
XML Injection in Xerces Java affects Nokogiri
## Summary Nokogiri v1.13.4 updates the vendored `xerces:xercesImpl` from 2.12.0 to 2.12.2, which addresses [CVE-2022-23437](https://nvd.nist.gov/vuln/detail/CVE-2022-23437). That CVE is scored as CVSS 6.5 "Medium" on the NVD record. Please note that this adv…
-
Medium 5.3CVE-2022-24838 EPSS 33%
Command Injection in Appointment Emails for Nextcloud Calendar
Nextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointment Emails via Newlines: as newlines and special characters are not sanitized in the email value in the JSON request, a malicious attacker can inject n…
-
Medium 5.3
Enumerable upload file names in hedgedoc
HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable filename after the upload, resulting in potential information leakage of uploaded documents. This is es…
-
Medium 4.3
WordPress eRoom plugin <= 1.3.7 - Cross-Site Request Forgery (CSRF) leading to Sync with Zoom Meetings vulnerability
Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.7 allows an attacker to Sync with Zoom Meetings.
-
Medium 4.3
WordPress eRoom plugin <= 1.3.8 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cache Deletion
Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.8 allows cache deletion.
-
Medium 4.3
Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 a…
-
Medium 4.8
WordPress Plausible Analytics plugin <= 1.2.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) in PlausibleHQ Plausible Analytics (WordPress plugin) <= 1.2.2
-
Medium 6.5
ICSMA-22-095-01 LifePoint Informatics Patient Portal
Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and rate limiting.
-
Medium 4.8
WordPress Responsive Tabs plugin <= 4.0.5 - Cross-Site Scripting (XSS) vulnerability
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Responsive Tabs (WordPress plugin) <= 4.0.5
-
Medium 5.3
Uncontrolled search path element vulnerability in Samsung Android USB Driver windows installer program prior to version…
-
Medium 4.4
Improper access control vulnerability in Samsung Security Supporter prior to version 1.2.40.0 allows attacker to set th…
-
Medium 4.3
Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute ca…
-
Medium 5.9
Improper access control vulnerability in Galaxy Store prior to version 4.5.36.4 allows attacker to install applications…
-
Medium 5.1
Improper access control vulnerability in Samsung Flow prior to version 4.8.06.5 allows attacker to write the file witho…
-
Medium 4.8
WordPress Chaty plugin <= 2.8.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Premio Chaty (WordPress plugin) <= 2.8.3
-
Medium 5.3
Improper one time password handling in devise-two-factor
As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/…
-
Medium 6.2
Path traversal vulnerability in unzip method of InstallAgentCommonHelper in Galaxy store prior to version 4.5.40.5 allo…
-
Medium 6.8
Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.40.5 allows local attackers to access pri…
-
Medium 4.0
Path traversal vulnerability in Samsung Flow prior to version 4.8.07.4 allows local attackers to read arbitrary files a…
-
Medium 5.9
Uncontrolled search path element vulnerability in Samsung Update prior to version 3.0.77.0 allows attackers to execute …
-
Medium 6.2
DLL hijacking vulnerability in Kies prior to version 2.6.4.22014_2 allows attacker to execute abitrary code.
-
Medium 6.2
DLL hijacking vulnerability in Smart Switch PC prior to version 4.2.22022_4 allows attacker to execute abitrary code.
-
Medium 4.3
Improper exception handling in Samsung Pass prior to version 3.7.07.5 allows physical attacker to view the screen that …
-
Medium 4.4
Improper access control vulnerability in SamsungRecovery prior to version 8.1.43.0 allows local attckers to delete arbi…
-
Medium 4.4
A vulnerability using PendingIntent in Accessibility prior to version 12.5.3.2 in Android R(11.0) and 13.0.1.1 in Andro…
-
Medium 4.4
Improper input validation in DSP driver prior to SMR Apr-2022 Release 1 allows out-of-bounds write by integer overflow.
-
Medium 4.0
Improper boundary check in media.extractor library prior to SMR Apr-2022 Release 1 allows attackers to cause denial of …
-
Medium 4.0
Improper size check in sapefd_parse_meta_HEADER function of libsapeextractor library prior to SMR Apr-2022 Release 1 al…
-
Medium 4.0
Improper size check of in sapefd_parse_meta_DESCRIPTION function of libsapeextractor library prior to SMR Apr-2022 Rele…
-
Medium 6.6
Information exposure vulnerability in ril property setting prior to SMR April-2022 Release 1 allows access to EF_RUIMID…
-
Medium 4.0
Improper size check in sapefd_parse_meta_HEADER_old function of libsapeextractor library prior to SMR Apr-2022 Release …
-
Medium 4.0
Improper boundary check in Quram Agif library prior to SMR Apr-2022 Release 1 allows attackers to cause denial of servi…
-
Medium 4.4
Improper input validation vulnerability in parser_infe and sheifd_find_itemIndexin fuctions of libsimba library prior t…
-
Medium 4.4
Improper input validation vulnerability in parser_iloc and sheifd_find_itemIndexin fuctions of libsimba library prior t…
-
Medium 5.9
Null pointer dereference vulnerability in parser_hvcC function of libsimba library prior to SMR Apr-2022 Release 1 allo…
-
Medium 5.9
Null pointer dereference vulnerability in parser_infe function of libsimba library prior to SMR Apr-2022 Release 1 allo…
-
Medium 5.9
Null pointer dereference vulnerability in parser_unknown_property function in libsimba library prior to SMR Apr-2022 Re…
-
Medium 5.9
Null pointer dereference vulnerability in parser_ispe function in libsimba library prior to SMR Apr-2022 Release 1 allo…
-
Medium 5.9
Null pointer dereference vulnerability in parser_colr function in libsimba library prior to SMR Apr-2022 Release 1 allo…
-
Medium 5.9
Null pointer dereference vulnerability in parser_auxC function in libsimba library prior to SMR Apr-2022 Release 1 allo…