Archive
May 2022
Vulnerabilities first published in this month (UTC), newest first.
483 results · Clear filters · Feed
-
Medium 4.8
IBM DataPower Gateway 10.0.2.0 through 1.0.3.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 is vulner…
-
Medium 4.7
WordPress Code Snippets plugin <= 2.14.3 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting (XSS) vulnerability in Code Snippets plugin <= 2.14.3 at WordPress via &orderby vulnerable parameter.
-
Medium 4.3
Exposure of Sensitive Information in moodle
A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it.
-
Medium 5.3
External Control of Assumed-Immutable Web Parameter in moodle
A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.
-
Medium 6.1
TIBCO BusinessConnect Trading Community Management Reflected Cross Site Scripting Vulnerability
The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow an unauthenticated attacker with network access to execute scripts…
-
Medium 5.4
Cross-site Scripting in moodle
A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk.
-
Medium 6.8
WordPress Popup Box plugin <= 2.1.2 - Authenticated Local File Inclusion (LFI) vulnerability
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.
-
Medium 5.5
A buffer overflow vulnerability in Lenovo Smart Standby Driver prior to version 4.1.50.0 could allow a local attacker t…
-
Medium 6.3
A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to …
-
Medium 6.8
A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow…
-
Medium 4.3
An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an …
-
Medium 4.3
A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Contr…
-
Medium 5.9
Insufficient hostname validation during Clusterswitch message in Zoom Client for Meetings
The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack to trick an unsuspecting users cli…
-
Medium 5.9
Improperly constrained session cookies in Zoom Client for Meetings
The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated attack to send an unsuspecting users Zoom-sc…
-
Medium 5.4
ToolJet - HTML Injection in Invite New User
ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitational e-mail.
-
Medium 5.5
Uncontrolled Recursion in vim/vim
Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975.
-
Medium 5.0
Cambium Networks cnMaestro OS Command Injection
The affected On-Premise cnMaestro is vulnerable inside a specific route where a user can upload a crafted package to the system. An attacker could abuse this user-controlled data to execute arbitrary commands on the server.
-
Medium 5.7
Cambium Networks cnMaestro Path Traversal
The affected On-Premise cnMaestro is vulnerable to an arbitrary file-write through improper limitation of a pathname to a restricted directory inside a specific route. If an attacker supplied path traversal charters (../) as part of a filename, the server wil…
-
Medium 5.9
Cambium Networks cnMaestro SQL Injection
The affected On-Premise is vulnerable to data exfiltration through improper neutralization of special elements used in an SQL command. This could allow an attacker to exfiltrate and dump all data held in the cnMaestro database.
-
Medium 5.4
WordPress Code Snippets Extended plugin <= 1.4.7 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress allows an attacker to delete or to turn on/off snippets.
-
Medium 4.7
WordPress Code Snippets Extended plugin <= 1.4.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Persistent Cross-Site Scripting (XSS)
Persistent Cross-Site Scripting (XSS) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery (vulnerable parameters &title, &snippet_code).
-
Medium 4.3
Domain Admin Broken Access Control
This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should not have access to. Please note the admin is unable to modify the data (read only operation). This UAC…
-
Medium 4.4CVE-2022-0486 Public exploit
Privileged Command Injection Vulnerability in Fidelis Network and Deception
Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected files and enable escalation of privileges equivalent t…
-
Medium 4.1
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where it may lead to a use-after-…
-
Medium 5.5
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where uncontrolled resource consu…
-
Medium 5.5
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for Dxgk…
-
Medium 5.5
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for Dxgk…
-
Medium 5.5
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for Dxgk…
-
Medium 5.5
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where the memor…
-
Medium 6.1
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for Dxgk…
-
Medium 5.3
HashiCorp Vault improper configuration of multi factor authentication
HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0 and does not affect the separate Enterpri…
-
Medium 6.5
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow an authent…
-
Medium 5.0
IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable to identity spoofing…
-
Medium 5.3
IBM DataPower Gateway 10.0.2.0, 10.0.3.0, 10.0.1.0 through 10.0.1.4, and 2018.4.1.0 through 2018.4.1.17 could allow a r…
-
Medium 5.3
IBM Sterling Secure Proxy 6.0.3 and IBM Secure External Authentication Server 6.0.3 does not properly ensure that a cer…
-
Medium 5.3
IBM DataPower Gateway 10.0.1.0 through 10.0.1.4 and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a…
-
Medium 5.1
IBM Spectrum Protect Operations Center 8.1.12 and 8.1.13 could allow a local attacker to obtain sensitive information, …
-
Medium 5.3
IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information in URL parameters that cou…
-
Medium 5.4
Cross-site Scripting in Jenkins Random String Parameter Plugin
Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Confi…
-
Medium 4.3
Missing permission check in Jenkins SSH Plugin
A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.