Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-27791 | 3 Adobe, Apple, Microsoft | 6 Acrobat, Acrobat Dc, Acrobat Reader and 3 more | 2022-05-18 | 9.3 HIGH | 7.8 HIGH |
| Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) is affected by a stack-based buffer overflow vulnerability due to insecure processing of a font, potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted .pdf file | |||||
| CVE-2021-27762 | 1 Hcltech | 1 Bigfix Platform | 2022-05-18 | 7.5 HIGH | 9.8 CRITICAL |
| Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses | |||||
| CVE-2022-1476 | 1 Servmask | 1 All-in-one Wp Migration | 2022-05-18 | 5.5 MEDIUM | 6.5 MEDIUM |
| The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the ~/lib/model/class-ai1wm-backups.php file, in versions up to, and including, 7.58. This can be exploited by administrative users, and users who have access to the site's secret key. | |||||
| CVE-2022-1453 | 1 Rsvpmaker Project | 1 Rsvpmaker | 2022-05-18 | 5.0 MEDIUM | 7.5 HIGH |
| The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5. | |||||
| CVE-2022-1442 | 1 Wpmet | 1 Metform Elementor Contact Form Builder | 2022-05-18 | 5.0 MEDIUM | 7.5 HIGH |
| The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party APIs like that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more, in versions up to and including 2.1.3. | |||||
| CVE-2022-0947 | 1 Abb | 48 Arc600a2323na, Arc600a2323na Firmware, Arc600a2324na and 45 more | 2022-05-18 | 6.8 MEDIUM | 9.8 CRITICAL |
| A vulnerability in ABB ARG600 Wireless Gateway series that could allow an attacker to exploit the vulnerability by remotely connecting to the serial port gateway, and/or protocol converter, depending on the configuration. | |||||
| CVE-2022-29972 | 1 Insightsoftware | 1 Magnitude Simba Amazon Redshift Odbc Driver | 2022-05-18 | 7.2 HIGH | 7.8 HIGH |
| An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift ODBC Driver (1.4.14 through 1.4.21.1001 and 1.4.22 through 1.4.x before 1.4.52) may allow a local user to execute arbitrary code. | |||||
| CVE-2022-30239 | 1 Insightsoftware | 1 Magnitude Simba Amazon Athena Jdbc Driver | 2022-05-18 | 7.2 HIGH | 7.8 HIGH |
| An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena JDBC Driver 2.0.25 through 2.0.28 may allow a local user to execute code. NOTE: this is different from CVE-2022-29971. | |||||
| CVE-2022-29933 | 1 Craftcms | 1 Craft Cms | 2022-05-18 | 6.8 MEDIUM | 8.8 HIGH |
| Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration). | |||||
| CVE-2022-30240 | 1 Insightsoftware | 1 Magnitude Simba Amazon Redshift Jdbc Driver | 2022-05-18 | 7.2 HIGH | 7.8 HIGH |
| An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift JDBC Driver 1.2.40 through 1.2.55 may allow a local user to execute code. NOTE: this is different from CVE-2022-29972. | |||||
| CVE-2022-28005 | 1 3cx | 1 3cx | 2022-05-18 | 5.0 MEDIUM | 9.8 CRITICAL |
| An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticated attacker could abuse improperly secured access to arbitrary files on the server, leading to cleartext credential disclosure. Afterwards, the authenticated attacker is able to upload a file that overwrites a 3CX service binary, leading to Remote Code Execution as NT AUTHORITY\SYSTEM on Windows installations. Versions prior to version 18, Hotfix 1 Build 18.0.3.461 March 2022, are prone to an additional unauthenticated file system access to C:\Windows\System32. | |||||
| CVE-2022-28806 | 1 Fujitsu | 24 Lifebook A3510, Lifebook A3510 Firmware, Lifebook E449 and 21 more | 2022-05-18 | 7.2 HIGH | 7.8 HIGH |
| An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510, U9310, U7511/U7411/U7311, U9311, E5510/E5410, U7510/U7410/U7310, E459/E449) with BIOS versions before v1.09 (A3510), v2.17 (U9310), v2.30 (U7511/U7411/U7311), v2.33 (U9311), v2.23 (E5510), v2.19 (U7510/U7410), v2.13 (U7310), and v1.09 (E459/E449). The FjGabiFlashCoreAbstractionSmm driver registers a Software System Management Interrupt (SWSMI) handler that is not sufficiently validated to ensure that the CommBuffer (or any other communication buffer's nested contents) are not pointing to SMRAM contents. A potential attacker can therefore write fixed data to SMRAM, which could lead to data corruption inside this memory (e.g., change the SMI handler's code or modify SMRAM map structures to break input pointer validation for other SMI handlers). Thus, the attacker could elevate privileges from ring 0 to ring -2 and execute arbitrary code in SMM. | |||||
| CVE-2022-28986 | 1 Lmsdoctor | 1 2 Factor Authentication | 2022-05-18 | 5.0 MEDIUM | 7.5 HIGH |
| LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references (IDOR) vulnerability, which allows remote attackers to update sensitive records such as email, password and phone number of other user accounts. | |||||
| CVE-2021-27761 | 1 Hcltech | 1 Bigfix Platform | 2022-05-18 | 5.0 MEDIUM | 7.5 HIGH |
| Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks | |||||
| CVE-2022-22012 | 1 Microsoft | 9 Windows 10, Windows 11, Windows 7 and 6 more | 2022-05-17 | 9.3 HIGH | 9.8 CRITICAL |
| Windows LDAP Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-22013, CVE-2022-22014, CVE-2022-29128, CVE-2022-29129, CVE-2022-29130, CVE-2022-29131, CVE-2022-29137, CVE-2022-29139, CVE-2022-29141. | |||||
| CVE-2022-22013 | 1 Microsoft | 9 Windows 10, Windows 11, Windows 7 and 6 more | 2022-05-17 | 6.5 MEDIUM | 8.8 HIGH |
| Windows LDAP Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-22012, CVE-2022-22014, CVE-2022-29128, CVE-2022-29129, CVE-2022-29130, CVE-2022-29131, CVE-2022-29137, CVE-2022-29139, CVE-2022-29141. | |||||
| CVE-2022-22014 | 1 Microsoft | 9 Windows 10, Windows 11, Windows 7 and 6 more | 2022-05-17 | 6.5 MEDIUM | 8.8 HIGH |
| Windows LDAP Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-22012, CVE-2022-22013, CVE-2022-29128, CVE-2022-29129, CVE-2022-29130, CVE-2022-29131, CVE-2022-29137, CVE-2022-29139, CVE-2022-29141. | |||||
| CVE-2021-39670 | 1 Google | 1 Android | 2022-05-17 | 4.9 MEDIUM | 5.5 MEDIUM |
| In setStream of WallpaperManager.java, there is a possible way to cause a permanent DoS due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-204087139 | |||||
| CVE-2022-1463 | 1 Booking Calendar Project | 1 Booking Calendar | 2022-05-17 | 6.5 MEDIUM | 8.8 HIGH |
| The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above to call arbitrary PHP objects on a vulnerable site. | |||||
| CVE-2022-29318 | 1 Car Rental Management System Project | 1 Car Rental Management System | 2022-05-17 | 6.5 MEDIUM | 7.2 HIGH |
| An arbitrary file upload vulnerability in the New Entry module of Car Rental Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file. | |||||