Archive
21 May 2022
Vulnerabilities first published on this day (UTC), newest first.
8 results · Feed
-
High 7.4
Access of Uninitialized Pointer in radareorg/radare2
Access of Uninitialized Pointer in GitHub repository radareorg/radare2 prior to 5.7.0.
-
Critical 9.8CVE-2022-31267 EPSS 18%
Unescaped control characters in Gitblit
Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an emailAddress%3Atext 'attacker@example.com\n\trole = "#admin"' value.
-
High 7.5
Path traversal in Gitblit
A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname).
-
High 7.5
Integer overflow in solana_rbpf
Solana solana_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program headers. elf.rs has a panic via a malformed eBPF program.
-
Critical 9.0
Unrestricted Upload of File with Dangerous Type in polonel/trudesk
Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.2.
-
High 7.5
Argument Injection in RegionProtect
RegionProtect is a plugin that allows users to manage certain events in certain regions of the world. Versions prior to 1.1.0 contain a YAML injection vulnerability that can cause an instant server crash if the passed arguments are not matched. Version 1.1.0 …
-
Medium 5.9
Improper Certificate Validation in Pion DTLS
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Clien…
-
Critical 9.8CVE-2022-31259 EPSS 22%
Access control bypass in beego
The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).