Archive
April 2022
Vulnerabilities first published in this month (UTC), newest first.
105 results · Clear filters · Feed
-
Medium 6.8
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary…
KEV Mar 7, 2023 -
Critical 9.8
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fil…
KEV Apr 25, 2022 -
Unscored —CVE-2022-29072 Public exploit
7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is …
-
High 7.0
Windows User Profile Service Elevation of Privilege Vulnerability
Windows User Profile Service Elevation of Privilege Vulnerability
KEV Apr 25, 2022 -
High 7.8CVE-2022-26810 Public exploit
Windows File Server Resource Management Service Elevation of Privilege Vulnerability
Windows File Server Resource Management Service Elevation of Privilege Vulnerability
-
Critical 9.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
Remote Procedure Call Runtime Remote Code Execution Vulnerability
-
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
KEV Apr 13, 2022 -
High 8.8
Windows SMB Remote Code Execution Vulnerability
Windows SMB Remote Code Execution Vulnerability
-
Critical 9.8
Windows Network File System Remote Code Execution Vulnerability
Windows Network File System Remote Code Execution Vulnerability
-
High 7.8CVE-2022-24494 Public exploit
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
-
Critical 9.8
Windows Network File System Remote Code Execution Vulnerability
Windows Network File System Remote Code Execution Vulnerability
-
Medium 5.5CVE-2022-24483 Public exploit
Windows Kernel Information Disclosure Vulnerability
Windows Kernel Information Disclosure Vulnerability
-
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
-
Unscored —CVE-2022-28113 Public exploit
An issue in upload.csp of FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows attackers to write files and reset the user …
-
Medium 5.9CVE-2022-24853 Public exploit
File system exposure in Metabase
Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a part…
-
High 7.5CVE-2022-22968 Public exploit
Improper handling of case sensitivity in Spring Framework
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower ca…
-
Medium 6.1CVE-2022-1257 Public exploit
Improper Verification of Cryptographic Signature by McAfee Agent
Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain access to sensitive information through storage in ma.db. The sensitive information has been moved to encrypted database fil…
-
Unscored —
An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default…
-
High 8.2CVE-2022-24818 Public exploit
Unchecked JNDI lookups in GeoTools
GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code…
-
Critical 10.0
Improper Control of Generation of Code in jai-ext
JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and …
KEV Jun 26, 2024 -
Unscored —CVE-2021-42136 Public exploit
A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allow…
-
High 7.8CVE-2015-20107 Public exploit
In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the…
-
High 7.8
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due …
KEV Apr 15, 2022 -
Unscored —
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities…
-
Unscored —
VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAut…
-
Unscored —
When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does …
-
Critical 9.8
Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.
The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluatio…
-
Critical 9.8
SQL Injection in Django
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the pass…
-
Medium 6.0CVE-2022-24765 Public exploit
Uncontrolled search for the Git directory in Git for Windows
Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\.git`, …
-
Critical 9.8
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templ…
KEV Apr 14, 2022 -
Unscored —CVE-2021-32162 Public exploit
A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature.
-
Unscored —CVE-2021-32161 Public exploit
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature.
-
Unscored —CVE-2021-32160 Public exploit
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature.
-
Unscored —CVE-2021-32159 Public exploit
A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and Download feature.
-
Unscored —CVE-2021-32158 Public exploit
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature.
-
Unscored —CVE-2021-32157 Public exploit
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
-
Unscored —CVE-2021-32156 Public exploit
A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
-
Unscored —CVE-2022-26180 Public exploit
qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI.
-
Unscored —CVE-2021-43009 Public exploit
A Cross Site Scripting (XSS) vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the requ…
-
High 7.3CVE-2022-26671 Public exploit
TAIWAN SECOM CO., LTD., a xDoor Access Control and Personnel Attendance Management system - Hard-coded Credentials
Taiwan Secom Dr.ID Access Control system’s login page has a hard-coded credential in the source code. An unauthenticated remote attacker can use the hard-coded credential to acquire partial system information and modify system setting to cause partial disrupt…