Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-22413 | 1 Ibm | 1 Robotic Process Automation | 2022-05-20 | 7.5 HIGH | 9.8 CRITICAL |
| IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 223022. | |||||
| CVE-2022-1682 | 1 Facturascripts | 1 Facturascripts | 2022-05-20 | 4.3 MEDIUM | 6.1 MEDIUM |
| Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07. Xss can use to steal user's cookies which lead to Account takeover or do any malicious activity in victim's browser | |||||
| CVE-2022-28920 | 1 Moecraft | 1 Tieba-cloud-sign | 2022-05-20 | 3.5 LOW | 4.8 MEDIUM |
| Tieba-Cloud-Sign v4.9 was discovered to contain a cross-site scripting (XSS) vulnerability via the function strip_tags. | |||||
| CVE-2022-29307 | 1 Ionizecms | 1 Ionize | 2022-05-20 | 7.5 HIGH | 9.8 CRITICAL |
| IonizeCMS v1.0.8.1 was discovered to contain a command injection vulnerability via the function copy_lang_content in application/models/lang_model.php. | |||||
| CVE-2022-30002 | 1 Insurance Management System Project | 1 Insurance Management System | 2022-05-20 | 6.5 MEDIUM | 7.2 HIGH |
| Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editNominee.php?nominee_id=. | |||||
| CVE-2021-0126 | 1 Intel | 1 Manageability Commander | 2022-05-20 | 5.2 MEDIUM | 8.0 HIGH |
| Improper input validation for the Intel(R) Manageability Commander before version 2.2 may allow an authenticated user to potentially enable escalation of privilege via adjacent access. | |||||
| CVE-2021-28831 | 3 Busybox, Debian, Fedoraproject | 3 Busybox, Debian Linux, Fedora | 2022-05-20 | 5.0 MEDIUM | 7.5 HIGH |
| decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data. | |||||
| CVE-2021-28794 | 1 Shellcheck Project | 1 Shellcheck | 2022-05-20 | 7.5 HIGH | 9.8 CRITICAL |
| The unofficial ShellCheck extension before 0.13.4 for Visual Studio Code mishandles shellcheck.executablePath. | |||||
| CVE-2021-28789 | 1 Apple-swift-format Project | 1 Apple-swift-format | 2022-05-20 | 6.8 MEDIUM | 7.8 HIGH |
| The unofficial apple/swift-format extension before 1.1.2 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted apple-swift-format.path configuration value that triggers execution upon opening the workspace. | |||||
| CVE-2021-28650 | 2 Fedoraproject, Gnome | 2 Fedora, Gnome-autoar | 2022-05-20 | 2.1 LOW | 5.5 MEDIUM |
| autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-36241. | |||||
| CVE-2021-28041 | 4 Fedoraproject, Netapp, Openbsd and 1 more | 11 Fedora, Cloud Backup, Hci Compute Node and 8 more | 2022-05-20 | 4.6 MEDIUM | 7.1 HIGH |
| ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host. | |||||
| CVE-2021-30145 | 1 Mpv | 1 Mpv | 2022-05-20 | 6.8 MEDIUM | 7.8 HIGH |
| A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file. | |||||
| CVE-2021-29096 | 1 Esri | 4 Arcgis Desktop, Arcgis Engine, Arcgis Pro and 1 more | 2022-05-20 | 6.8 MEDIUM | 7.8 HIGH |
| A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user. | |||||
| CVE-2021-28967 | 1 Microsoft | 1 Visual Studio Code | 2022-05-20 | 7.5 HIGH | 9.8 CRITICAL |
| The unofficial MATLAB extension before 2.0.1 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace because of lint configuration settings. | |||||
| CVE-2021-28147 | 1 Grafana | 1 Grafana | 2022-05-20 | 3.5 LOW | 6.5 MEDIUM |
| The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn't supposed to have. | |||||
| CVE-2021-28956 | 1 Sass Lint Project | 1 Sass Lint | 2022-05-20 | 6.8 MEDIUM | 8.8 HIGH |
| ** UNSUPPORTED WHEN ASSIGNED ** The unofficial vscode-sass-lint (aka Sass Lint) extension through 1.0.7 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted workspace. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | |||||
| CVE-2021-28955 | 1 Git-bug Project | 1 Git-bug | 2022-05-20 | 7.5 HIGH | 9.8 CRITICAL |
| git-bug before 0.7.2 has an Uncontrolled Search Path Element. It will execute git.bat from the current directory in certain PATH situations (most often seen on Windows). | |||||
| CVE-2021-28954 | 2 Bit Project, Microsoft | 2 Bit, Windows | 2022-05-20 | 6.8 MEDIUM | 7.8 HIGH |
| In Chris Walz bit before 1.0.5 on Windows, attackers can run arbitrary code via a .exe file in a crafted repository. | |||||
| CVE-2022-29104 | 1 Microsoft | 10 Windows 10, Windows 11, Windows 7 and 7 more | 2022-05-20 | 4.6 MEDIUM | 7.8 HIGH |
| Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-29132. | |||||
| CVE-2022-30279 | 1 Stormshield | 1 Network Security | 2022-05-20 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Stormshield Network Security (SNS) 4.3.x before 4.3.8. The event logging of the ASQ sofbus lacbus plugin triggers the dereferencing of a NULL pointer, leading to a crash of SNS. An attacker could exploit this vulnerability via forged sofbus lacbus traffic to cause a firmware crash. | |||||