SingCERT's Security Bulletin summarises the list of vulnerabilities collated from the National Institute of Standards and Technology [NIST]'s National Vulnerability Database [NVD] in the past week.
The vulnerabilities are tabled based on severity, in accordance to their CVSSv3 base scores:
For those vulnerabilities without assigned CVSS scores, please visit NVD for the updated CVSS vulnerability entries.
| CVE-2021-42321 | Microsoft Exchange Server Remote Code Execution Vulnerability | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2021-42321 |
| CVE-2022-0729 | Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-0729 |
| CVE-2022-23277 | Microsoft Exchange Server Remote Code Execution Vulnerability. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-23277 |
| CVE-2021-21944 | Two heap-based buffer overflow vulnerabilities exist in the TIFF parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger these vulnerabilities.This heap-based buffer oveflow takes place trying to copy the first 12 bits from local variable. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2021-21944 |
| CVE-2021-21945 | Two heap-based buffer overflow vulnerabilities exist in the TIFF parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger these vulnerabilities.This heap-based buffer oveflow takes place trying to copy the second 12 bits from local variable. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2021-21945 |
| CVE-2021-21946 | Two heap-based buffer overflow vulnerabilities exists in the JPEG-JFIF lossless Huffman image parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger these vulnerabilities.This heap-based buffer overflow takes place when the `SOF3` precision is lower than 9. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2021-21946 |
| CVE-2021-21947 | Two heap-based buffer overflow vulnerabilities exists in the JPEG-JFIF lossless Huffman image parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger these vulnerabilities.This heap-based buffer overflow takes place when the `SOF3` precision is greater or equal than 9. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2021-21947 |
| CVE-2022-30670 | RoboHelp Server earlier versions than RHS 11 Update 3 are affected by an Improper Authorization vulnerability which could lead to privilege escalation. An authenticated attacker could leverage this vulnerability to achieve full administrator privileges. Exploitation of this issue does not require user interaction. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-30670 |
| CVE-2022-2162 | Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 103.0.5060.53 allowed a remote attacker to bypass file system access via a crafted HTML page. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2162 |
| CVE-2022-2163 | Use after free in Cast UI and Toolbar in Google Chrome prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via UI interaction. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2163 |
| CVE-2022-2294 | Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2294 |
| CVE-2022-2295 | Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2295 |
| CVE-2022-2296 | Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 103.0.5060.114 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via direct UI interactions. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2296 |
| CVE-2022-2477 | Use after free in Guest View in Google Chrome prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2477 |
| CVE-2022-2480 | Use after free in Service Worker API in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2480 |
| CVE-2022-2481 | Use after free in Views in Google Chrome prior to 103.0.5060.134 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via UI interaction. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2481 |
| CVE-2022-2603 | Use after free in Omnibox in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2603 |
| CVE-2022-2604 | Use after free in Safe Browsing in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2604 |
| CVE-2022-2606 | Use after free in Managed devices API in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enable a specific Enterprise policy to potentially exploit heap corruption via a crafted HTML page. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2606 |
| CVE-2022-2608 | Use after free in Overview Mode in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2608 |
| CVE-2022-2609 | Use after free in Nearby Share in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2609 |
| CVE-2022-2613 | Use after free in Input in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enage in specific user interactions to potentially exploit heap corruption via specific UI interactions. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2613 |
| CVE-2022-2614 | Use after free in Sign-In Flow in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2614 |
| CVE-2022-2617 | Use after free in Extensions API in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific UI interactions. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2617 |
| CVE-2022-2620 | Use after free in WebUI in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2620 |
| CVE-2022-2621 | Use after free in Extensions in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific UI interactions. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2621 |
| CVE-2022-2623 | Use after free in Offline in Google Chrome on Android prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2623 |
| CVE-2022-2624 | Heap buffer overflow in PDF in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted PDF file. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2624 |
| CVE-2022-35624 | In Nordic nRF5 SDK for Mesh 5.0, a heap overflow vulnerability can be triggered by sending a series of segmented packets with SegO > SegN | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-35624 |
| CVE-2022-38359 | Cross-site request forgery attacks can be carried out against the Eyes of Network web application, due to an absence of adequate protections. An attacker can, for instance, delete the admin user by directing an authenticated user to the URL ///module/admin_user/index.php?DataTables_Table_0_length=10&user_selected%5B%5D=1&user_mgt_list=delete_user&action=submit by means of a crafted link. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-38359 |
| CVE-2022-36309 | Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of the recoverySubmit.cgi script running on the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-36309 |
| CVE-2022-36310 | Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write abilities to execute commands as root on the eNodeB. This issue may affect other AirVelocity and AirSpeed models. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-36310 |
| CVE-2022-36312 | Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-36312 |
| CVE-2022-35239 | The image file management page of SolarView Compact SV-CPT-MC310 Ver.7.23 and earlier, and SV-CPT-MC310F Ver.7.23 and earlier contains an insufficient verification vulnerability when uploading files. If this vulnerability is exploited, arbitrary PHP code may be executed if a remote authenticated attacker uploads a specially crafted PHP file. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-35239 |
| CVE-2022-38362 | Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to [authenticated] remote code exploit of code on the Airflow worker host. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-38362 |
| CVE-2022-2846 | A vulnerability classified as problematic was found in Calendar Event Multi View Plugin. This vulnerability affects unknown code of the file /wp/?cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=1&method=adddetails&id=2. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The identifier of this vulnerability is VDB-206488. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2846 |
| CVE-2020-14321 | In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2020-14321 |
| CVE-2022-2661 | Sequi PortBloque S has an improper authorization vulnerability, which may allow a low-privileged user to perform administrative functions using specifically crafted requests. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2661 |
| CVE-2022-34254 | Adobe Commerce versions 2.4.3-p2 [and earlier], 2.3.7-p3 [and earlier] and 2.4.4 [and earlier] are affected by an Improper Limitation of a Pathname to a Restricted Directory ['Path Traversal'] vulnerability that could be abused by an attacker to inject malicious scripts into the vulnerable endpoint. A low privileged attacker could leverage this vulnerability to read local files and to perform Stored XSS. Exploitation of this issue does not require user interaction. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-34254 |
| CVE-2022-34255 | Adobe Commerce versions 2.4.3-p2 [and earlier], 2.3.7-p3 [and earlier] and 2.4.4 [and earlier] are affected by an Improper Access Control vulnerability that could result in Privilege escalation. An attacker with a low privilege account could leverage this vulnerability to perform an account takeover for a victim. Exploitation of this issue does not require user interaction. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-34255 |
| CVE-2022-35011 | PNGDec commit 8abf6be was discovered to contain a global buffer overflow via inflate_fast at /src/inffast.c. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-35011 |
| CVE-2022-1410 | OS Command Injection vulnerability in the db_optimize component of Device42 Asset Management Appliance allows an authenticated attacker to execute remote code on the device. This issue affects: Device42 CMDB version 18.01.00 and prior versions. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-1410 |
| CVE-2022-23765 | This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS. Remote attackers can steal root privileges by changing the password of the root through a POST request. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-23765 |
| CVE-2022-2867 | libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop [likely via tricking a user to run tiffcrop on it with certain parameters] could cause a crash or in some cases, further exploitation. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2867 |
| CVE-2022-2869 | libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw could cause a crash or potentially further exploitation. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2869 |
| CVE-2022-21139 | Inadequate encryption strength for some Intel[R] PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-21139 |
| CVE-2022-23182 | Improper access control in the Intel[R] Data Center Manager software before version 4.1 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-23182 |
| CVE-2022-35167 | Printix Cloud Print Management v1.3.1149.0 for Windows was discovered to contain insecure permissions. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-35167 |
| CVE-2022-2886 | A vulnerability, which was classified as critical, was found in Laravel 5.1. Affected is an unknown function. The manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-206688. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2886 |
| CVE-2022-35909 | In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-35909 |
| CVE-2022-36224 | XunRuiCMS V4.5.6 is vulnerable to Cross Site Request Forgery [CSRF]. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-36224 |
| CVE-2022-36225 | EyouCMS V1.5.8-UTF8-SP1 is vulnerable to Cross Site Request Forgery [CSRF] via the background, column management function and add. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-36225 |
| CVE-2022-36577 | An issue was discovered in jizhicms v2.3.1. There is a CSRF vulnerability that can add a admin. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-36577 |
| CVE-2022-36579 | Wellcms 2.2.0 is vulnerable to Cross Site Request Forgery [CSRF]. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-36579 |
| CVE-2022-36170 | MapGIS 10.5 Pro IGServer has hardcoded credentials in the front-end and can lead to escalation of privileges and arbitrary file deletion. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-36170 |
| CVE-2022-36157 | XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-36157 |
| CVE-2022-2909 | A vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /mkshop/Men/profile.php. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206845 was assigned to this vulnerability. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2909 |
| CVE-2022-2921 | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update languages, install/activate extensions, install/activate themes and other permissive actions. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2921 |
| CVE-2022-2557 | The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the user | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2557 |
| CVE-2022-2594 | The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration [so PHP is not possible] if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release. | 8.8 | //nvd.nist.gov/vuln/detail/CVE-2022-2594 |
| CVE-2022-34347 | Cross-Site Request Forgery [CSRF] vulnerability in W3 Eden Download Manager plugin RAnalFunction *fcn = r_anal_get_fcn_in [core->anal, core->offset, -1]; returns null pointer for fcn causing segmentation fault later in ensure_fcn_range [fcn]. | 7.5 | //nvd.nist.gov/vuln/detail/CVE-2020-27795 |
| CVE-2022-38493 | Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption. This allows attackers to cause a Denial of Service via a crafted JWE [JSON Web Encryption] token. | 7.5 | //nvd.nist.gov/vuln/detail/CVE-2022-38493 |
| CVE-2021-3513 | A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message displayed when wrong credentials are entered. The highest threat from this vulnerability is to confidentiality. | 7.5 | //nvd.nist.gov/vuln/detail/CVE-2021-3513 |
| CVE-2022-2544 | The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes. | 7.5 | //nvd.nist.gov/vuln/detail/CVE-2022-2544 |
| CVE-2022-2551 | The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating. | 7.5 | //nvd.nist.gov/vuln/detail/CVE-2022-2551 |
| CVE-2022-29154 | An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server [or Man-in-The-Middle attacker] can overwrite arbitrary files in the rsync client target directory and subdirectories [for example, overwrite the .ssh/authorized_keys file]. | 7.4 | //nvd.nist.gov/vuln/detail/CVE-2022-29154 |
| CVE-2021-3796 | vim is vulnerable to Use After Free | 7.3 | //nvd.nist.gov/vuln/detail/CVE-2021-3796 |
| CVE-2022-36263 | StreamLabs Desktop Application 1.9.0 is vulnerable to Incorrect Access Control via obs64.exe. An attacker can execute arbitrary code via a crafted .exe file. | 7.3 | //nvd.nist.gov/vuln/detail/CVE-2022-36263 |
| CVE-2020-10390 | OS Command Injection in export.php [vulnerable function called from include/functions-article.php] in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by saving the code to be executed as the wkhtmltopdf path via admin/save-settings.php. | 7.2 | //nvd.nist.gov/vuln/detail/CVE-2020-10390 |
| CVE-2022-36323 | A vulnerability has been identified in SCALANCE M-800 / S615 [All versions], SCALANCE SC-600 family [All versions < V2.3.1], SCALANCE W-1700 IEEE 802.11ac family [All versions], SCALANCE W-700 IEEE 802.11ax family [All versions], SCALANCE W-700 IEEE 802.11n family [All versions], SCALANCE XB-200 switch family [All versions], SCALANCE XC-200 switch family [All versions], SCALANCE XF-200BA switch family [All versions], SCALANCE XM-400 Family [All versions], SCALANCE XP-200 switch family [All versions], SCALANCE XR-300WG switch family [All versions], SCALANCE XR-500 Family [All versions]. Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell. | 7.2 | //nvd.nist.gov/vuln/detail/CVE-2022-36323 |
| CVE-2022-36293 | Buffer overflow vulnerability in Nintendo Wi-Fi Network Adaptor WAP-001 All versions allows an attacker with an administrative privilege to execute arbitrary code via unspecified vectors. | 7.2 | //nvd.nist.gov/vuln/detail/CVE-2022-36293 |
| CVE-2022-36381 | OS command injection vulnerability in Nintendo Wi-Fi Network Adaptor WAP-001 All versions allows an attacker with an administrative privilege to execute arbitrary OS commands via unspecified vectors. | 7.2 | //nvd.nist.gov/vuln/detail/CVE-2022-36381 |
| CVE-2020-1756 | In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, insufficient input escaping was applied to the PHP unit webrunner admin tool. | 7.2 | //nvd.nist.gov/vuln/detail/CVE-2020-1756 |
| CVE-2022-34253 | Adobe Commerce versions 2.4.3-p2 [and earlier], 2.3.7-p3 [and earlier] and 2.4.4 [and earlier] are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does not require user interaction. | 7.2 | //nvd.nist.gov/vuln/detail/CVE-2022-34253 |
| CVE-2022-36215 | DedeBIZ v6 was discovered to contain a remote code execution vulnerability in sys_info.php. | 7.2 | //nvd.nist.gov/vuln/detail/CVE-2022-36215 |
| CVE-2022-36216 | DedeCMS v5.7.94 - v5.7.97 was discovered to contain a remote code execution vulnerability in member_toadmin.php. | 7.2 | //nvd.nist.gov/vuln/detail/CVE-2022-36216 |
| CVE-2022-1373 | The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files. An attacker can craft a zip file to load an arbitrary dll and execute code. Using the "restore configuration" feature to upload a zip file containing a path traversal file may cause a file to be created and executed upon touching the disk. | 7.2 | //nvd.nist.gov/vuln/detail/CVE-2022-1373 |
| CVE-2022-2334 | The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbitrary code on the targeted Softing Secure Integration Server V1.22. | 7.2 | //nvd.nist.gov/vuln/detail/CVE-2022-2334 |
| CVE-2021-37289 | Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system command as root via etc_ro/web/syscmd.asp. | 7.2 | //nvd.nist.gov/vuln/detail/CVE-2021-37289 |
| CVE-2022-2593 | The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before inserting it into a SQL query, which could allow high privilege users to perform SQL Injection attacks | 7.2 | //nvd.nist.gov/vuln/detail/CVE-2022-2593 |
| CVE-2022-33900 | PHP Object Injection vulnerability in Easy Digital Downloads plugin System - > system function - > configuration management. | 5.4 | //nvd.nist.gov/vuln/detail/CVE-2022-37254 |
| CVE-2022-1340 | Cross-site Scripting [XSS] - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. | 5.4 | //nvd.nist.gov/vuln/detail/CVE-2022-1340 |
| CVE-2022-2890 | Cross-site Scripting [XSS] - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. | 5.4 | //nvd.nist.gov/vuln/detail/CVE-2022-2890 |
| CVE-2021-36857 | Authenticated [editor+] Stored Cross-Site Scripting [XSS] vulnerability in wpshopmart Testimonial Builder plugin payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability. | – | //nvd.nist.gov/vuln/detail/CVE-2021-3839 |
| CVE-2021-3905 | A memory leak was found in Open vSwitch [OVS] during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments. | – | //nvd.nist.gov/vuln/detail/CVE-2021-3905 |
| CVE-2022-28882 | A Denial-of-Service [DoS] vulnerability was discovered in F-Secure & WithSecure products whereby the aegen.dll will go into an infinite loop when unpacking PE files. This eventually leads to scanning engine crash. The exploit can be triggered remotely by an attacker. | – | //nvd.nist.gov/vuln/detail/CVE-2022-28882 |
| CVE-2022-28883 | A Denial-of-Service [DoS] vulnerability was discovered in F-Secure & WithSecure products whereby the aerdl unpack function crashes. This can lead to a possible scanning engine crash. The exploit can be triggered remotely by an attacker. | – | //nvd.nist.gov/vuln/detail/CVE-2022-28883 |
| CVE-2022-29476 | Unauthenticated Stored Cross-Site Scripting [XSS] vulnerability in 8 Degree Themes otification Bar for WordPress plugin
Chủ Đề |