Archive
22 April 2022
Vulnerabilities first published on this day (UTC), newest first.
48 results · Feed
-
High 7.7
Out-of-bounds Read in mrb_obj_is_kind_of in in mruby/mruby
Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary code execution if being exploited.
-
Critical 9.8
An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2)…
-
Critical 9.8
An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) a…
-
Medium 6.7
A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X…
-
Medium 6.7
During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI …
-
Medium 5.0
A denial of service vulnerability was reported in Lenovo Thin Installer prior to version 1.3.0039 that could trigger a …
-
High 7.3
A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the a…
-
High 7.3
A DLL search path vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow privileg…
-
Medium 6.7
A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook mode…
-
Medium 6.7
A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, Thin…
-
Medium 6.7
A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, an…
-
Medium 6.7CVE-2021-3972 Public exploit
A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS …
-
Medium 6.7
A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook device…
-
Medium 6.7
A potential vulnerability in LenovoVariable SMI Handler due to insufficient validation in some Lenovo Notebook models B…
-
Medium 6.8
Versions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify…
-
Medium 5.0
A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow config…
-
Medium 5.5
A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.20.10282 that could allow an at…
-
Medium —
SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc
xml2rfc allows `script` elements in SVG sources. In HTML output having these script elements can lead to XSS attacks. Sample XML snippet: ``` <artwork type="svg" src="data:image/svg+xml,%3Csvg viewBox='0 0 10 10' xmlns='http://www.w3.org/2000/svg'%3E%3Cscript…
-
High —
Dep Group Remote Memory Exhaustion (Denial of Service) in ckb
### Impact A remote attacker could exploit this vulnerability to exhaust ckb process memory of an affected node. ### Patches Upgrade to 0.43.1 or later. ### References After resolving the outpoints of one dep group, we put the corresponding content into a vec…
-
High —
Relative Path Traversal in afire serve_static
### Impact This vulnerability effects the built-in afire serve_static extension allowing paths containing `//....` to bypass the previous path sanitation and request files in higher directories that should not be accessible. ### Patches The issue has been fix…
-
Unscored —
Link-Admin v0.0.1 was discovered to contain a SQL injection vulnerability via DictRest.ResponseResult().
-
Unscored —
JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function.
-
High 8.8
Cross Site Request Forgery in Mingsoft MCMS
MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify data.
-
Critical 9.8
Command Injection vulnerability in git-interface@2.1.1 in yarkeev/git-interface
Command Injection vulnerability in git-interface@2.1.1 in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the use of a `--upload-pack` command-line argument feature of git is also supported for `git clone`, whi…
-
Medium 5.4
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users …
-
Medium 4.3
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report pages that they should…
-
Medium 4.6
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain credentials from a user's brows…
-
Medium 5.4
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting, caused by improper validation of…
-
Medium 4.3
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attack…
-
Low 3.1
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower level user could h…
-
Medium 6.5
IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb att…
-
Medium 6.3CVE-2022-1439 Scanner template
Reflected XSS on demo.microweber.org/demo/module/ in microweber/microweber
Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a payla…
-
Unscored —
Crypt Server before 3.3.0 allows XSS in the index view. This is related to serial, computername, and username.
-
Unscored —
There is a pointer double free vulnerability in Some MIUI Services. When a function is called, the memory pointer is co…
-
High 7.1
Uffizio GPS Tracker Cross-site Scripting
An attacker may be able to inject client-side JavaScript code on multiple instances within all versions of Uffizio GPS Tracker.
-
Medium 4.3
Uffizio GPS Tracker Cross-site Request Forgery
All versions of Uffizio GPS Tracker may allow an attacker to perform unintended actions on behalf of a user.
-
Medium 5.3
Johnson Controls Metasys SCT Pro
The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request.
-
Medium 5.3
Heap-based Buffer Overflow in radareorg/radare2
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause…
-
Unscored —
Halo-1.5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via \admin\index.html#/system/to…
-
High 7.2CVE-2022-1429 EPSS 64%
SQL injection in GridHelperService.php in pimcore/pimcore
SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data