Total
803 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-8177 | 4 Debian, Fujitsu, Haxx and 1 more | 15 Debian Linux, M10-1, M10-1 Firmware and 12 more | 2022-06-17 | 4.6 MEDIUM | 7.8 HIGH |
| curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used. | |||||
| CVE-2022-29631 | 1 Jodd | 1 Http | 2022-06-14 | 5.0 MEDIUM | 7.5 HIGH |
| Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers to execute Server-Side Request Forgery (SSRF) via a crafted TCP payload. | |||||
| CVE-2018-1000193 | 2 Jenkins, Oracle | 2 Jenkins, Communications Cloud Native Core Automated Test Suite | 2022-06-13 | 4.0 MEDIUM | 4.3 MEDIUM |
| A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign up using user names containing control characters that can then appear to have the same name as other users, and cannot be deleted via the UI. | |||||
| CVE-2022-32269 | 1 Realnetworks | 1 Realplayer | 2022-06-11 | 7.5 HIGH | 9.8 CRITICAL |
| In Real Player 20.0.8.310, the G2 Control allows injection of unsafe javascript: URIs in local HTTP error pages (displayed by Internet Explorer core). This leads to arbitrary code execution. | |||||
| CVE-2021-26084 | 1 Atlassian | 2 Confluence Data Center, Confluence Server | 2022-06-10 | 7.5 HIGH | 9.8 CRITICAL |
| In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5. | |||||
| CVE-2020-28246 | 1 Form | 1 Form.io | 2022-06-09 | 7.5 HIGH | 9.8 CRITICAL |
| A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL. | |||||
| CVE-2022-30991 | 3 Acronis, Linux, Microsoft | 3 Cyber Protect, Linux Kernel, Windows | 2022-06-01 | 4.3 MEDIUM | 6.1 MEDIUM |
| HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240 | |||||
| CVE-2021-22191 | 3 Debian, Oracle, Wireshark | 3 Debian Linux, Zfs Storage Appliance, Wireshark | 2022-05-27 | 6.8 MEDIUM | 8.8 HIGH |
| Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allow remote code execution via via packet injection or crafted capture file. | |||||
| CVE-2022-23068 | 1 Tooljet | 1 Tooljet | 2022-05-26 | 3.5 LOW | 5.4 MEDIUM |
| ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitational e-mail. | |||||
| CVE-2022-22975 | 1 Vmware | 1 Pinniped | 2022-05-19 | 6.0 MEDIUM | 6.6 MEDIUM |
| An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack would involve the malicious user changing the common name (CN) of their user entry on the LDAP or AD server to include special characters, which could be used to perform LDAP query injection on the Supervisor's LDAP query which determines their Kubernetes group membership. | |||||
| CVE-2022-29171 | 1 Sourcegraph | 1 Sourcegraph | 2022-05-17 | 6.0 MEDIUM | 7.2 HIGH |
| Sourcegraph is a fast and featureful code search and navigation engine. Versions before 3.38.0 are vulnerable to Remote Code Execution in the gitserver service. The Gitolite code host integration with Phabricator allows Sourcegraph site admins to specify a `callsignCommand`, which is used to obtain the Phabricator metadata for a Gitolite repository. An administrator who is able to edit or add a Gitolite code host and has administrative access to Sourcegraph’s bundled Grafana instance can change this command arbitrarily and run it remotely. This grants direct access to the infrastructure underlying the Sourcegraph installation. The attack requires: site-admin privileges on the instance of Sourcegraph, Administrative privileges on the bundled Grafana monitoring instance, Knowledge of the gitserver IP address or DNS name (if running in Kubernetes). This can be found through Grafana. The issue is patched in version 3.38.0. You may disable Gitolite code hosts. We still highly encourage upgrading regardless of workarounds. | |||||
| CVE-2022-29166 | 1 Matrix | 1 Matrix Irc Bridge | 2022-05-16 | 6.8 MEDIUM | 8.8 HIGH |
| matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. Refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms. There are no known workarounds for this issue. | |||||
| CVE-2020-5245 | 2 Dropwizard, Oracle | 2 Dropwizard Validation, Blockchain Platform | 2022-05-12 | 9.0 HIGH | 8.8 HIGH |
| Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2. | |||||
| CVE-2022-23064 | 1 Snipeitapp | 1 Snipe-it | 2022-05-10 | 6.8 MEDIUM | 8.8 HIGH |
| In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over. | |||||
| CVE-2022-1509 | 1 Hestiacp | 1 Control Panel | 2022-05-06 | 9.0 HIGH | 8.8 HIGH |
| Sed Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context. | |||||
| CVE-2022-27336 | 1 Seacms | 1 Seacms | 2022-05-06 | 7.5 HIGH | 9.8 CRITICAL |
| Seacms v11.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/weixin.php. | |||||
| CVE-2022-29816 | 1 Jetbrains | 1 Intellij Idea | 2022-05-05 | 2.1 LOW | 3.3 LOW |
| In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible | |||||
| CVE-2021-28979 | 1 Thalesgroup | 1 Safenet Keysecure | 2022-05-03 | 4.3 MEDIUM | 6.5 MEDIUM |
| SafeNet KeySecure Management Console 8.12.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. | |||||
| CVE-2021-3027 | 1 Librit | 1 Passhport | 2022-05-03 | 4.0 MEDIUM | 6.5 MEDIUM |
| app/views_mod/user/user.py in LibrIT PaSSHport through 2.5 is affected by LDAP Injection. There is an information leak through the crafting of special queries, escaping the provided search filter because user input gets no sanitization. | |||||
| CVE-2022-27924 | 1 Zimbra | 1 Collaboration | 2022-05-03 | 5.0 MEDIUM | 7.5 HIGH |
| Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries. | |||||