Archive
August 2022
Vulnerabilities first published in this month (UTC), newest first.
2,333 results · Feed
-
Unscored —
A Stack-based Buffer Overflow Vulnerability in Autodesk 3ds Max 2022, 2021, and 2020 may lead to code execution through…
-
Medium 4.3
Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the aerdl.dll component used in certain WithSecure products unpacker function crashes which leads to scanning engine crash. The exploit can be triggered remotely by an attacker.
-
High 8.6CVE-2022-0028 Exploited
PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering
A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (vi…
KEV Aug 22, 2022 -
Low 3.2
In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases
-
High 7.1CVE-2022-2756 Scanner template
Server-Side Request Forgery (SSRF) in kareadita/kavita
Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1.
-
Unscored —
jQuery UI is a third-party library used by Drupal. The jQuery UI Checkboxradio module provides the jQuery UI Checkboxra…
-
Medium 5.4CVE-2022-36923 Scanner template
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall A…
-
Medium 6.8
Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow…
-
High 7.5
Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated re…
-
Critical 9.1
Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with admini…
-
Medium 6.5
A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V…
-
Medium 6.8
A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V…
-
Medium 5.3
A vulnerability has been identified in Simcenter STAR-CCM+ (All versions only if the Power-on-Demand public license ser…
-
Medium 5.3
A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions), CP-8000 MASTER MODULE W…
-
Critical 9.8
KUKA V/KSS WoV SH access control vulnerability
The KUKA SystemSoftware V/KSS in versions prior to 8.6.5 is prone to improper access control as an unauthorized attacker can directly read and write robot configurations when access control is not available or not enabled (default).
-
High 7.8
A vulnerability in the regex module used by the signature database load module of Clam AntiVirus (ClamAV) versions 0.10…
-
Critical 9.0
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device. For more information a…
-
Medium 5.4
Cisco Webex Meetings Web Interface Vulnerabilities
Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame hijacking attack against a user of the web interface. For more information about these vulnerabilitie…
-
Medium 6.5
Cisco Unified Communications Manager Arbitrary File Deletion Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to delete arbitrary f…
-
Medium 4.9
Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability
A vulnerability in the External RESTful Services (ERS) API of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to obtain sensitive information. This vulnerability is due to excessive verbosity in a specific REST API …
-
Medium 6.1
Cisco BroadWorks Application Delivery Platform Software Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting attack against a user of the interface. This vulnerability exist…
-
Medium 5.4
Cisco Webex Meetings Web Interface Vulnerabilities
Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame hijacking attack against a user of the web interface. For more information about these vulnerabilitie…
-
Critical 9.0
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device. For more information a…
-
Critical 9.0
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device. For more information a…
-
Unscored —
Improper HTTP/2 scheme and method validation
Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
-
Medium 6.8
Improper input validation on HTTP/2 headers
Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
-
High 7.8
Arbitrary Command Execution
All versions of package mc-kill-port are vulnerable to Arbitrary Command Execution via the kill function, due to missing sanitization of the port argument.
-
Medium 6.1CVE-2022-36801 EPSS 67%
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or…
-
Unscored —
Insufficient Validation of HTTP/1.x Headers
Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
-
Unscored —
Transfer-Encoding not treated as hop-by-hop
Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 8.0.0 to 9.0.2.
-
Unscored —
HTTP/2 framing vulnerabilities
Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
-
Medium 4.2
Protocol vs scheme mismatch
Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
-
Medium 6.5CVE-2022-20361 Public exploit
In btif_dm_auth_cmpl_evt of btif_dm.cc, there is a possible vulnerability in Cross-Transport Key Derivation due to Weak…
-
Medium 6.2CVE-2022-20360 Public exploit
In setChecked of SecureNfcPreferenceController.java, there is a missing permission check. This could lead to local esca…
-
High 7.1
In startSync of AbstractThreadedSyncAdapter.java, there is a possible way to access protected content of content provid…
-
Unscored —
In writeToParcel of SurfaceControl.cpp, there is a possible information disclosure due to uninitialized data. This coul…
-
Medium 4.0
In shouldAllowFgsWhileInUsePermissionLocked of ActiveServices.java, there is a possible way to start foreground service…
-
Unscored —
In get of PacProxyService.java, there is a possible system service crash due to improper input validation. This could l…
-
Unscored —
In onDefaultNetworkChanged of Vpn.java, there is a possible way to disable VPN due to a logic error in the code. This c…
-
Unscored —
In onSaveRingtone of DefaultRingtonePreference.java, there is a possible inappropriate file read due to improper input …