Archive
4 May 2022
Vulnerabilities first published on this day (UTC), newest first.
80 results · Feed
-
Unscored —CVE-2022-30292 Public exploit
Heap-based buffer overflow in sqbaselib.cpp in SQUIRREL 3.2 due to lack of a certain sq_reservestack call.
-
High 7.5
Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: th…
-
Critical 9.0
Argument injection in python-libnmap
In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not validate arguments). NOTE: the vendor believes it would be unrealistic for an application to call NmapProcess with argume…
-
Unscored —CVE-2022-29155 EPSS 64%
In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql…
-
Medium 6.1
Cross-site Scripting in jquery.json-viewer
The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as < in a JSON object, as demonstrated by a SCRIPT element.
-
Unscored —
Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity (XXE) pro…
-
Unscored —
Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' fu…
-
Medium 4.9
GateManager debug interface is included in production builds
Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. This issue affects: GateManager all versions prior to 9.7.
-
Medium 4.7
Cisco Small Business RV Series Routers Command Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. The…
-
Medium 4.7
Cisco Small Business RV Series Routers Command Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. The…
-
Medium 6.5
ClamAV Truncated File Denial of Service Vulnerability Affecting Cisco Products: April 2022
On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in Clam AntiVirus (ClamAV) versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2 could allow an authentica…
-
Medium 6.5
Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities
Multiple vulnerabilities in the web engine of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow a remote attacker to cause a denial of service (DoS) condition, view sensitive data on an affected device, or redirect …
-
High 7.5
ClamAV HTML Scanning Memory Leak Vulnerability Affecting Cisco Products: April 2022
On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in HTML file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0…
-
Critical 9.9CVE-2022-20780 EPSS 11%
Cisco Enterprise NFV Infrastructure Software Vulnerabilities
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to th…
-
Critical 9.9CVE-2022-20779 EPSS 10%
Cisco Enterprise NFV Infrastructure Software Vulnerabilities
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to th…
-
Critical 9.9CVE-2022-20777 EPSS 11%
Cisco Enterprise NFV Infrastructure Software Vulnerabilities
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to th…
-
High 7.5
ClamAV TIFF File Parsing Denial of Service Vulnerability Affecting Cisco Products: April 2022
On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in the TIFF file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS versi…
-
High 8.6
ClamAV CHM File Parsing Denial of Service Vulnerability Affecting Cisco Products: April 2022
On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.…
-
Medium 6.5
Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities
Multiple vulnerabilities in the web engine of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow a remote attacker to cause a denial of service (DoS) condition, view sensitive data on an affected device, or redirect …
-
Medium 4.7
Cisco Small Business RV Series Routers Remote Code Execution Vulnerability
A vulnerability in web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of user-suppl…
-
Medium 4.4
Cisco SD-WAN vManage Software Information Disclosure Vulnerability
A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, local attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin priv…
-
Medium 6.3
Reflected XSS in microweber/microweber
Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim
-
Unscored —
SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTi…
-
Medium 6.4
PingID Integration for Windows Login MFA Bypass
Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user cred…
-
Unscored —
The module adds a "Clone" tab to a node. When clicked, a new node is created and fields from the previous node are popu…
-
Unscored —
Image Field Caption (`image_field_caption`) adds an extra text area for captions on image fields. The module doesn't sa…
-
Unscored —
Doubleclick for Publishers (DFP) module enables a site to place ads from Doubleclick For Publishers. The module doesn't…
-
Unscored —
In H3C MagicR100 <=V100R005, the / Ajax / ajaxget interface can be accessed without authorization. It sends a large amo…
-
Medium 4.3
A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 throug…
-
High 7.5
An improper access control in Fortinet FortiSOAR before 7.2.0 allows unauthenticated attackers to access gateway API da…
-
Medium 6.3
An improper access control vulnerability [CWE-284] in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an…
-
High 8.8
An improper access control vulnerability [CWE-284] in FortiIsolator versions 2.3.2 and below may allow an authenticated…
-
Unscored —
SonicWall Global VPN Client 4.10.7.1117 installer (32-bit and 64-bit) and earlier versions have a DLL Search Order Hija…
-
Unscored —CVE-2022-28557 EPSS 23%
There is a command injection vulnerability at the /goform/setsambacfg interface of Tenda AC15 US_AC15V1.0BR_V15.03.05.2…
-
Unscored —
Tenda AC15 US_AC15V1.0BR_V15.03.05.20_multi_TDE01.bin is vulnerable to Buffer Overflow. The stack overflow vulnerabilit…
-
Unscored —
Cscms 4.1 is vulnerable to SQL Injection. Log into the background, open the song module, create a new song, delete it t…
-
Unscored —
Sourcecodester Doctor's Appointment System 1.0 is vulnerable to File Upload to RCE via Image upload from the administra…
-
Unscored —
An arbitrary file upload vulnerability in Web@rchiv 1.0 allows attackers to execute arbitrary commands via a crafted PH…
-
Unscored —
A SQL injection vulnerability exists in Sourcecodester Fantastic Blog CMS 1.0 . An attacker can inject query in "/fanta…
-
Unscored —
Experian Hunter 1.16 allows remote authenticated users to modify assumed-immutable elements via the (1) rule name param…