Archive
May 2022
Vulnerabilities first published in this month (UTC), newest first.
118 results · Clear filters · Feed
-
Critical 9.1
Authentication bypass in Vartalap chat-server
Chat Server is the chat server for Vartalap, an open-source messaging application. Versions 2.3.2 until 2.6.0 suffer from a bug in validating the access token, resulting in authentication bypass. The function `this.authProvider.verifyAccessKey` is an async fu…
-
Critical 9.1
Use of Incorrect Operator in polonel/trudesk
Use of Incorrect Operator in GitHub repository polonel/trudesk prior to 1.2.3.
-
Critical —
OS Command Injection in gogs
Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an attacker to execute code remotely. An unprivileged attacker (registered user) can overwrite the Git configuration in his repository. This leads to Remote Command Execution,…
-
Critical 9.8CVE-2022-1660 EPSS 17%
Keysight N6854A Geolocation server and N6841A RF Sensor software
The affected products are vulnerable of untrusted data due to deserialization without prior authorization/authentication, which may allow an attacker to remotely execute arbitrary code.
-
Critical 9.1
Incorrect Synchronization in polonel/trudesk
Incorrect Synchronization in GitHub repository polonel/trudesk prior to 1.2.3.
-
Critical 9.8
Server-Side Template Injection in formio
A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL. NOTE: the email templating service was removed after 2020. Additionally, the vendor disputes this i…
-
Critical 9.1
Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP
Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = record + 2` will access the memory behind `\0` and cause an out-of-bounds write. An attacker can send a…
-
Critical 9.8
Denial of service in bottle
Bottle before 0.12.20 mishandles errors during early request binding.
-
Critical 9.8
Privilege escalation in Hashicorp Nomad
HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1.
-
Critical 9.8
Code injection in MCMS
An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file.
-
Critical 9.0
Cross-site Scripting (XSS) - Stored in causefx/organizr
Cross-site Scripting (XSS) - Stored in GitHub repository causefx/organizr prior to 2.1.2200.
-
Critical 9.8
This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6. An att…
-
Critical 9.8
An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2022-004 Catal…
-
Critical 9.6
Archer Platform 6.3 before 6.11 (6.11.0.0) contains an Improper Access Control Vulnerability within SSO ADFS functional…
-
Critical 9.8
KUKA KR C4 - Use of Hard-Coded Credentials
An attacker can gain full access (read/write/delete) to sensitive folders due to hard-coded credentials on KUKA KR C4 control software for versions prior to 8.7 or any product running KSS.
-
Critical 9.0
Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. A remote authentic…
-
Critical 9.6CVE-2022-24422 EPSS 59%
Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability. A …
-
Critical 9.8CVE-2022-21831 Public exploit
Possible code injection vulnerability in Rails / Active Storage
A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments.
-
Critical —
Malware in ctx
The `ctx` hosted project on [PyPI](https://pypi.org/project/ctx/) was taken over via user account compromise and replaced with a malicious project which contained runtime code that collected the content of `os.environ.items()` when instantiating `Ctx` objects…
-
Critical 9.4
An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform …
-
Critical 9.1CVE-2022-26082 EPSS 20%
A file write vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS P…
-
Critical 9.1
A Security Misconfiguration vulnerability affects HCL VersionVault Express
VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with the server.
-
Critical 9.3
LCDS LAquis SCADA - Cross-site Scripting
When a non-existent resource is requested, the LCDS LAquis SCADA application (version 4.3.1.1011 and prior) returns error messages which may allow reflected cross-site scripting.
-
Critical 9.6CVE-2022-1883 Scanner template
SQL Injection in camptocamp/terraboard
SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0.
-
Critical 9.8
Potential buffer overflow in function DFU upload in Azure RTOS USBX
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack. Prior to version 6.1.11, he USBX DFU UPLOAD functionality may be utilized to introduce a buffer overflow resulting in overwrite of memory contents. In particular cases this may allow a…
-
Critical 9.0
Business Logic Errors in erudika/para
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.
-
Critical 9.4CVE-2021-32941 EPSS 15%
Annke Network Video Recorder - Stack-based Buffer Overflow
Annke N48PBB (Network Video Recorder) products of version 3.4.106 build 200422 and prior are vulnerable to a stack-based buffer overflow, which allows an unauthorized remote attacker to execute arbitrary code with the same privileges as the server user (root).
-
Critical 9.1
Unrestricted Upload of File with Dangerous Type in publify/publify
Unrestricted Upload of File with Dangerous Type in GitHub repository publify/publify prior to 9.2.9.
-
Critical 9.8
Commandline class shell injection vulnerabilities
In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
-
Critical 9.9
Authorization Bypass Through User-Controlled Key in publify/publify
Authorization Bypass Through User-Controlled Key in GitHub repository publify/publify prior to 9.2.9.
-
Critical 9.8CVE-2022-31267 EPSS 18%
Unescaped control characters in Gitblit
Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an emailAddress%3Atext 'attacker@example.com\n\trole = "#admin"' value.
-
Critical 9.0
Unrestricted Upload of File with Dangerous Type in polonel/trudesk
Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.2.
-
Critical 9.8CVE-2022-31259 EPSS 22%
Access control bypass in beego
The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).
-
Critical 9.1
Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contained a pre-generated SSH keypair. If the id_rsa.pub public key of the keypair was copied to authorize…
-
Critical 9.9
Improper Privilege Management in polonel/trudesk
Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2.
-
Critical 10.0
Argo CD will blindly trust JWT claims if anonymous access is enabled
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with version 1.4.0 and prior to versions 2.1.15, 2.2.9, and 2.3.4 which would allow unauthenticated users to impersonate…
-
Critical 9.1
ThroughTek P2P SDK - Cleartext Transmission of Sensitive Information
The affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module…
-
Critical 9.8
Fieldcomm Group HART-IP and hipserver - Stack-based Buffer Overflow
A malicious attacker could exploit the interface of the Fieldcomm Group HART-IP (release 1.0.0.0) by constructing messages with sufficiently large payloads to overflow the internal buffer and crash the device, or obtain control of the device.
-
Critical 9.8
Authorization bypass in Spring Security
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression …
-
Critical 9.8CVE-2022-30600 Public exploit
Incorrect Calculation in moodle
A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.