CVE-2022-4874

CVE-2022-4874 affects Netcomm NF20MESH, NF20 and NL1902 router models. An authentication bypass exists where the app serves static content by checking the URL for specific characters (e.g., .css, .png) and performing a “fake login” to grant a active session, allowing unauthenticated access to con...

CVE-2023-22952

SugarCRM is affected by CVE-2023-22952, a remote code execution in the EmailTemplates flow before 12.0, hotfix 91155. An attacker can upload a crafted PNG with embedded PHP to /index.php?module=EmailTemplates&action=AttachFiles (no input validation) and execute code on the server. Some sources in...

CVE-2023-0129

CVE-2023-0129 is a heap buffer overflow in Chrome/Chromium’s Network Service prior to version 109.0.5414.74. The issue can be triggered when a user is persuaded to install a malicious extension and interacts with a crafted HTML page, potentially allowing heap corruption. Affected products include...

CVE-2023-21768

CVE-2023-21768 affects the Windows Ancillary Function Driver for WinSock (afd.sys). The vulnerability stems from a flaw in AfdNotifyRemoveIoCompletion, enabling a local privilege escalation to SYSTEM by manipulating I/O ring structures. Documented impact shows LPE on Windows 11 22H2 up to build 2...

CVE-2023-21674

CVE-2023-21674 affects Windows Advanced Local Procedure Call (ALPC). The documented root cause is an Elevation of Privilege in ALPC that could enable browser sandbox escape and gain SYSTEM privileges. Public exploits exist (Kaspersky notes exploitation in the wild; a GitHub PoC is referenced), in...

CVE-2022-44149

CVE-2022-44149 affects Nexxt Amp300 ARN02304U8 devices (versions 42.103.1.5095 and 80.103.2.5045). The vulnerability stems from an authenticated remote command execution vector in the goform/sysTools component, enabling an attacker to place “&telnetd” in the JSON host field of the ping feature to...

CVE-2022-44877

CVE-2022-44877 affects CentOS Web Panel / Control Web Panel (CWP) 7 prior to 0.9.8.1147. The vendor’s login/index.php component is vulnerable to OS command injection via shell metacharacters in the login parameter, enabling remote code execution. Public templates and security feeds describe it as...

CVE-2023-22463

KubePi (Kubernetes dashboard) vulnerability CVE-2023-22463: The jwt authentication in versions up to 1.6.2 used hard-coded JwtSigKey in session.go, enabling forging of JWTs and unauthorized admin access across projects; attacker could escalate to K8s cluster control. The issue is fixed in 1.6.3, ...

CVE-2022-38627

Nortek Linear eMerge E3-Series firmware versions 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e are affected by a SQL injection via the idt parameter. The underlying issue is an input injection flaw in the application layer, enabling unauthenticated access to extract sen...

CVE-2022-4059

CVE-2022-4059 affects the Cryptocurrency Widgets Pack WordPress plugin prior to 2.0. The root cause is failure to sanitize/escape certain parameters before using them in a SQL statement via an AJAX action accessible to unauthenticated users, enabling a SQL injection. The Nuclei templates specify ...

CVE-2022-42475

Fortinet FortiOS SSL-VPN (and FortiProxy SSL-VPN) suffer a heap-based buffer overflow (CWE-122) leading to remote code execution. A remote unauthenticated attacker can trigger via crafted requests, affecting FortiOS/FortiProxy versions up to 7.2.2, 7.0.x, 6.4.x, 6.2.x, 6.0.x and earlier. CVSS v3....

CVE-2022-4117

The CVE-2022-4117 issue affects the WordPress IWS Geo Form Fields plugin (versions up to 1.0). The root cause is improper escaping of a parameter used in a SQL statement within an unauthenticated AJAX action, enabling unauthenticated SQL injection. The Nuclei/template and related sources describe...

CVE-2020-10650

CVE-2020-10650 is a deserialization vulnerability in FasterXML jackson-databind up to 2.9.10.4 that allowed unauthenticated code execution via Ignite-JTA or Quartz-core gadgets (e.g., CacheJndiTmLookup/CacheJndiTmFactory; JNDIConnectionProvider). Technical details across connected sources confirm...

CVE-2022-42953

CVE-2022-42953 affects ZKTeco ZEM500-510-560-760, ZEM600-800, ZEM720 (pre-8.88) and ZMM200-220-210 (pre-15.00). The underlying issue is a missing authentication vulnerability in the ZKTeco Web Interface, which could expose sensitive information via direct requests to form/DataApp?style=1 and form...

CVE-2022-47945

ThinkPHP Framework versions before 6.0.14 are vulnerable to local file inclusion via the lang parameter when lang_switch_on=true. An unauthenticated, remote attacker can exploit this to run arbitrary OS commands (illustrated by including pearcmd.php). Affected component: ThinkPHP language-pack/LF...

CVE-2022-34478

Summary: CVE-2022-34478 affects Thunderbird on Windows, where the ms-msdt, search, and search-ms protocols could deliver content to Microsoft apps via prompts opened by user interaction. The underlying risk is exploitation of a prompt-based handling in these protocols that bypasses the browser. T...

CVE-2022-26485

CVE-2022-26485 is a Mozilla/firefox-family use-after-free vulnerability triggered by removing an XSLT parameter during processing. Affected products include Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus

CVE-2022-26486

CVE-2022-26486 describes a use-after-free in the WebGPU IPC framework leading to a sandbox escape. Affected products and versions (per connected docs): Firefox < 97.0.2; Firefox ESR < 91.6.1; Firefox for Android < 97.3.0; Thunderbird < 91.6.2; Focus

CVE-2022-4050

CVE-2022-4050 affects the WordPress JoomSport plugin prior to 5.2.8. The issue is a SQL injection caused by improper sanitization/escaping of a parameter before it is used in a SQL statement, allowing unauthenticated users to issue arbitrary queries. Documented impacts include potential exposure ...

CVE-2022-4063

The CVE-2022-4063 issue affects WordPress InPost Gallery plugin versions before 2.1.4.1. The root cause is insecure use of PHP’s extract() when rendering HTML views, which can force inclusion of arbitrary files/URLs and may enable code execution on the server via Local File Inclusion (LFI) or rem...