Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-25014 | 1 Vowelweb | 1 Ibtana | 2022-02-22 | 3.5 LOW | 3.5 LOW |
| The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue. | |||||
| CVE-2021-24904 | 1 Lenderd | 1 Mortgage Calculators Wp | 2022-02-22 | 3.5 LOW | 4.8 MEDIUM |
| The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | |||||
| CVE-2021-24874 | 1 Sendinblue | 1 Newsletter\, Smtp\, Email Marketing And Subscribe | 2022-02-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues | |||||
| CVE-2022-0311 | 1 Google | 1 Chrome | 2022-02-22 | 6.8 MEDIUM | 8.8 HIGH |
| Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page. | |||||
| CVE-2022-0310 | 1 Google | 1 Chrome | 2022-02-22 | 6.8 MEDIUM | 8.8 HIGH |
| Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via specific user interactions. | |||||
| CVE-2022-0309 | 1 Google | 1 Chrome | 2022-02-22 | 4.3 MEDIUM | 6.5 MEDIUM |
| Inappropriate implementation in Autofill in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. | |||||
| CVE-2022-0305 | 1 Google | 1 Chrome | 2022-02-22 | 4.3 MEDIUM | 6.5 MEDIUM |
| Inappropriate implementation in Service Worker API in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. | |||||
| CVE-2022-24968 | 1 Mellium | 1 Xmpp | 2022-02-22 | 4.3 MEDIUM | 5.9 MEDIUM |
| In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification. | |||||
| CVE-2021-25992 | 1 If-me | 1 Ifme | 2022-02-22 | 7.5 HIGH | 9.8 CRITICAL |
| In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical attacks. | |||||
| CVE-2021-45901 | 1 Servicenow | 1 Servicenow | 2022-02-22 | 5.0 MEDIUM | 5.3 MEDIUM |
| The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists. | |||||
| CVE-2022-0588 | 1 Librenms | 1 Librenms | 2022-02-22 | 4.0 MEDIUM | 6.5 MEDIUM |
| Exposure of Sensitive Information to an Unauthorized Actor in Packagist librenms/librenms prior to 22.2.0. | |||||
| CVE-2022-24110 | 1 Accellion | 1 Managed File Transfer | 2022-02-22 | 4.0 MEDIUM | 6.5 MEDIUM |
| Kiteworks MFT 7.5 may allow an unauthorized user to reset other users' passwords. This is fixed in version 7.6 and later. | |||||
| CVE-2022-0587 | 1 Librenms | 1 Librenms | 2022-02-22 | 4.0 MEDIUM | 6.5 MEDIUM |
| Improper Authorization in Packagist librenms/librenms prior to 22.2.0. | |||||
| CVE-2022-0589 | 1 Librenms | 1 Librenms | 2022-02-22 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0. | |||||
| CVE-2022-0570 | 1 Mruby | 1 Mruby | 2022-02-22 | 7.5 HIGH | 9.8 CRITICAL |
| Heap-based Buffer Overflow in Homebrew mruby prior to 3.2. | |||||
| CVE-2022-0569 | 1 Snipeitapp | 1 Snipe-it | 2022-02-22 | 4.3 MEDIUM | 4.3 MEDIUM |
| Exposure of Sensitive Information to an Unauthorized Actor in Packagist snipe/snipe-it prior to v5.3.9. | |||||
| CVE-2022-23638 | 1 Svg-sanitizer Project | 1 Svg-sanitizer | 2022-02-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available. | |||||
| CVE-2022-0565 | 1 Pimcore | 1 Pimcore | 2022-02-22 | 5.0 MEDIUM | 7.5 HIGH |
| Exposure of Sensitive Information to an Unauthorized Actor in Packagist pimcore/pimcore prior to 10.3.1. | |||||
| CVE-2022-0532 | 2 Kubernetes, Redhat | 2 Cri-o, Openshift Container Platform | 2022-02-22 | 4.9 MEDIUM | 4.2 MEDIUM |
| An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace. | |||||
| CVE-2022-23637 | 1 K-link | 1 K-box | 2022-02-22 | 3.5 LOW | 5.4 MEDIUM |
| K-Box is a web-based application to manage documents, images, videos and geodata. Prior to version 0.33.1, a stored Cross-Site-Scripting (XSS) vulnerability is present in the markdown editor used by the document abstract and markdown file preview. A specifically crafted anchor link can, if clicked, execute untrusted javascript actions, like retrieving user cookies. Version 0.33.1 includes a patch that allows discarding unsafe links. | |||||