Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-27331 | 1 Zammad | 1 Zammad | 2022-05-05 | 4.0 MEDIUM | 4.3 MEDIUM |
| An access control issue in Zammad v5.0.3 broadcasts administrative configuration changes to all users who have an active application instance, including settings that should only be visible to authenticated users. | |||||
| CVE-2022-27299 | 1 Hospital Management System Project | 1 Hospital Management System | 2022-05-05 | 7.5 HIGH | 9.8 CRITICAL |
| Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the component room.php. | |||||
| CVE-2021-41041 | 2 Eclipse, Oracle | 2 Openj9, Java Se | 2022-05-05 | 5.0 MEDIUM | 5.3 MEDIUM |
| In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles. | |||||
| CVE-2022-29419 | 1 3xsocializer Project | 1 3xsocializer | 2022-05-05 | 6.5 MEDIUM | 8.8 HIGH |
| SQL Injection (SQLi) vulnerability in Don Crowther's 3xSocializer plugin <= 0.98.22 at WordPress possible for users with a low role like a subscriber or higher. | |||||
| CVE-2022-27888 | 1 Palantir | 1 Foundry Issues | 2022-05-05 | 2.1 LOW | 5.5 MEDIUM |
| Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens). This issue was fixed in 2.249.1. | |||||
| CVE-2022-28290 | 1 Welaunch | 1 Wordpress Country Selector | 2022-05-05 | 4.3 MEDIUM | 6.1 MEDIUM |
| Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload executes whenever the user tries to access the country selector page with the specified payload as a part of the HTTP request | |||||
| CVE-2022-29418 | 1 Night Mode Project | 1 Night Mode | 2022-05-05 | 3.5 LOW | 4.8 MEDIUM |
| Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) in Mark Daniels Night Mode plugin <= 1.0.0 on WordPress via vulnerable parameters: &ntmode_page_setting[enable-me], &ntmode_page_setting[bg-color], &ntmode_page_setting[txt-color], &ntmode_page_setting[anc_color]. | |||||
| CVE-2022-27469 | 1 Monstaftp | 1 Monsta Ftp | 2022-05-05 | 7.5 HIGH | 9.8 CRITICAL |
| Monstaftp v2.10.3 was discovered to allow attackers to execute Server-Side Request Forgery (SSRF). | |||||
| CVE-2022-27468 | 1 Monstaftp | 1 Monsta Ftp | 2022-05-05 | 7.5 HIGH | 9.8 CRITICAL |
| Monstaftp v2.10.3 was discovered to contain an arbitrary file upload which allows attackers to execute arbitrary code via a crafted file uploaded to the web server. | |||||
| CVE-2022-29499 | 1 Mitel | 1 Mivoice Connect | 2022-05-05 | 10.0 HIGH | 9.8 CRITICAL |
| The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA. | |||||
| CVE-2022-24880 | 1 Flask-session-captcha Project | 1 Flask-session-captcha | 2022-05-05 | 5.0 MEDIUM | 5.3 MEDIUM |
| flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work. | |||||
| CVE-2021-45839 | 1 Terra-master | 3 F2-210, F4-210, Tos | 2022-05-05 | 4.0 MEDIUM | 6.5 MEDIUM |
| It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) as well as other information such as MAC address, internal IP address etc. by performing a request to the /module/api.php?mobile/webNasIPS endpoint. | |||||
| CVE-2021-45841 | 1 Terra-master | 3 F2-210, F4-210, Tos | 2022-05-05 | 6.8 MEDIUM | 8.1 HIGH |
| In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's password hash. Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker to login as guest. | |||||
| CVE-2022-27985 | 1 Cuppacms | 1 Cuppacms | 2022-05-05 | 7.5 HIGH | 9.8 CRITICAL |
| CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php. | |||||
| CVE-2022-27984 | 1 Cuppacms | 1 Cuppacms | 2022-05-05 | 7.5 HIGH | 9.8 CRITICAL |
| CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menu_filter parameter at /administrator/templates/default/html/windows/right.php. | |||||
| CVE-2021-45837 | 1 Terra-master | 3 F2-210, F4-210, Tos | 2022-05-05 | 10.0 HIGH | 9.8 CRITICAL |
| It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending a specifically crafted input to /tos/index.php?app/del. | |||||
| CVE-2021-45840 | 1 Terra-master | 3 F2-210, F4-210, Tos | 2022-05-05 | 10.0 HIGH | 9.8 CRITICAL |
| It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending specifically crafted input to /tos/index.php?app/app_start_stop. | |||||
| CVE-2022-1173 | 1 Getgrav | 1 Grav | 2022-05-05 | 3.5 LOW | 5.4 MEDIUM |
| stored xss in GitHub repository getgrav/grav prior to 1.7.33. | |||||
| CVE-2022-27311 | 1 Gibbon Project | 1 Gibbon | 2022-05-05 | 7.5 HIGH | 9.8 CRITICAL |
| Gibbon v3.4.4 and below allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL. | |||||
| CVE-2022-27429 | 1 Jizhicms | 1 Jizhicms | 2022-05-05 | 7.5 HIGH | 9.8 CRITICAL |
| Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html. | |||||