Archive
19 April 2022
Vulnerabilities first published on this day (UTC), newest first.
131 results · Feed
-
Critical 9.8
Git LFS can execute a binary from the current directory on Windows
On Windows, if Git LFS operates on a malicious repository with a `..exe` file as well as a file named `git.exe`, and `git.exe` is not found in `PATH`, the `..exe` program will be executed, permitting the attacker to execute arbitrary code. This does not affec…
-
High 7.4
Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability.
Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An attacker can use hard coding to generate login credentials of any user and log in to the service back…
-
Medium 6.1
Default redirect callback vulnerable to open redirects
next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to …
-
High 8.8
Hotdog Container Escape
Incomplete fix for CVE-2021-3101. Hotdog, prior to v1.0.2, did not mimic the resource limits, device restrictions, or syscall filters of the target JVM process. This would allow a container to exhaust the resources of the host, modify devices, or make syscall…
-
High 8.8
Log4j hot patch package privilege escalation
Incomplete fix for CVE-2021-3100. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capabilities and cgroups of the target Java process that the hotpatch is applied to.
-
High 8.8
Hotdog Container Escape
Hotdog, prior to v1.0.1, did not mimic the capabilities or the SELinux label of the target JVM process. This would allow a container to gain full privileges on the host, bypassing restrictions set on the container.
-
High 8.8
Log4j hot patch package privilege escalation
The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges.
-
Medium 6.5
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 19…
-
High 8.1
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security)…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Sup…
-
Medium 4.0
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affect…
-
Medium 5.9
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affect…
-
Medium 6.1
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: An…
-
High 7.8
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
Medium 6.3CVE-2022-21490 EPSS 79%
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…
-
Medium 6.3CVE-2022-21489 EPSS 79%
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…
-
Low 3.8
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
Low 3.8
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
Low 2.9
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…
-
Low 2.9
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…
-
Low 2.9
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…
-
Medium 6.3
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…
-
Medium 6.3
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…
-
Medium 5.4
Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Financial Gatew…
-
Medium 6.1
Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: User Interface). Suppo…
-
Medium 5.2
Automated Logic WebCtrl Server Open Redirection Vulnerability
Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection. The vulnerability allows an attacker to send a maliciously crafted URL which could result in redirecting the user to a malicious webpage or downloading a malic…
-
Medium 5.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 5.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 5.4
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments, File Upl…
-
High 7.5
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…
-
Medium 5.9
Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Infrastructu…
-
Medium 5.9
Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrast…
-
Medium 5.9
Vulnerability in the Oracle Banking Treasury Management product of Oracle Financial Services Applications (component: I…
-
Medium 5.9
Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: In…
-
Medium 6.5
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
Medium 6.1
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Process Scheduler). Sup…
-
Medium 4.7
Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). S…
-
Medium 6.1
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Popups). Supported ve…
-
Medium 6.5
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Attachments). The supported version th…
-
High 7.5
Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Tools and Frameworks). The su…