Archive
August 2022
Vulnerabilities first published in this month (UTC), newest first.
2,333 results · Feed
-
High 8.8
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 be…
KEV Sep 30, 2022 -
Unscored —
The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic link…
-
Unscored —
PrinterLogic Windows Client through 25.0.0.676 allows attackers to execute directory traversal. Authenticated users wit…
-
Unscored —
An out-of-bounds write issue was found in the VirGL virtual OpenGL renderer (virglrenderer). This flaw allows a malicio…
-
Unscored —
In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the stri…
-
Unscored —
A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kp…
-
Medium 4.3
A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enou…
-
Unscored —
A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify …
-
Unscored —
A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values fr…
-
Unscored —
A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account an…
-
High 7.6
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0260.
-
Medium 6.3
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0259.
-
Unscored —
A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific …
-
Unscored —
libapreq2 multipart form parse memory corruption
A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A remote attacker could send a request causing a process crash which could lead to a denial of service attack.
-
Unscored —
A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installin…
-
Unscored —
A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks tha…
-
Unscored —
A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectl…
-
High 8.8CVE-2021-25642 Public exploit
Apache Hadoop YARN remote code execution in ZKConfigurationStore of capacity scheduler
ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attacker having access to ZooKeeper can run arbitrary commands as YARN user by exploiting this. Users sho…
-
High 7.5
VTK NULL pointer dereference vulnerability
There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value …
-
Unscored —
An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum() function in MagickCore/quantum-export.c.…
-
Medium 4.3
This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in macOS Montere…
-
Medium 5.5
A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 1…
-
High 7.8
This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5, watchOS 8.7, iOS 15.6 and iP…
-
High 7.8
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8…
-
High 7.8
This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5, tvOS 15.6, iOS 15.6 and iPad…
-
Medium 5.5
An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Monterey 12.5, macOS Big S…
-
High 7.8
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Monterey 12.5, macO…
-
Critical 9.8
The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, …
-
High 7.8
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8…
-
High 7.8
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5, watchOS 8.7, iOS 15.…
-
Medium 4.3
Kirby CMS 2.5.12 Cross-site Request Forgery
An issue was discovered in Kirby 2.5.12. The delete page functionality suffers from a CSRF flaw. A remote attacker can craft a malicious CSRF page and force the user to delete a page.
-
Medium 5.4
Kirby CMS 2.5.12 Cross-site Scripting
An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages.
-
Unscored —
This module enables you to accept payments from the Elavon payment provider. The module doesn't sufficiently verify tha…
-
Unscored —
An issue was discovered in 72crm 9.0. There is a SQL Injection vulnerability in View the task calendar.
-
Unscored —
72crm 9.0 has an Arbitrary file upload vulnerability.
-
Medium 5.9
ReDoS in uri-template-lite URI.expand function
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method
-
Medium 5.5
ARC Informatique PcVue
The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users
-
Critical 9.9CVE-2022-2234 EPSS 42%
mySCADA myPRO Command Injection
An authenticated mySCADA myPRO 8.26.0 user may be able to modify parameters to run commands directly in the operating system.
-
High 8.1
ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control
Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add or alter data points and corresponding attributes. Once such engineering data is used the data visualization will b…
-
Medium 5.9
ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control
Relative Path Traversal vulnerability in ABB Zenon 8.20 allows the user to access files on the Zenon system and user also can add own log messages and e.g., flood the log entries. An attacker who successfully exploit the vulnerability could access the Zenon r…