4020 matches found
CVE-2022-38130
CVE-2022-38130 affects Keysight SMS (com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip). An unauthenticated, remote attacker can supply an UNC path to a zipped HSQLDB database, causing the database content to be restored and potentially enabling remote code execution as described...
CVE-2022-0028
CVE-2022-0028 is a PAN-OS URL filtering misconfiguration that enables reflected and amplified TCP DoS (RDoS) against a target from Palo Alto Networks PA-Series/VM-Series/CN-Series firewalls. Affected component is the URL filtering configuration; root cause is a misconfigured URL filtering profile...
CVE-2022-36923
CVE-2022-36923 affects Zoho ManageEngine products (OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils) with an authentication bypass that allows an unauthenticated attacker to retrieve a user’s API key and use external APIs. T...
CVE-2022-34713
CVE-2022-34713 (DogWalk) is a remote code execution vulnerability in Microsoft Windows MSDT that is triggered when MSDT is invoked via the URL protocol from a calling application (e.g., Word). The CVSS 3.1 entry indicates a local attack vector with low attack complexity, no privileges required, b...
CVE-2022-36266
CVE-2022-36266 affects Airspan AirSpot 5410 (versions 0.3.4.1-4 and earlier). The issue is a stored XSS vulnerability in the login.cgi endpoint, which does not verify authentication. A malicious request can carry a base32-encoded XSS payload that is stored and later reflected on the user settings...
CVE-2022-36267
CVE-2022-36267 affects Airspan AirSpot 5410 (versions 0.3.4.1-4 and earlier). The vulnerability is an unauthenticated remote command injection in the diagnostics.cgi binary (/home/www/cgi-bin/diagnostics.cgi) that accepts unauthenticated, unsanitized data, enabling remote code execution via craft...
CVE-2022-31656
CVE-2022-31656 affects VMware Workspace ONE Access, Identity Manager, and vRealize Automation. The vulnerability is an authentication bypass that allows a remote attacker with network access to the UI to obtain administrative access without authentication. Base CVSS v3.1 score is 9.8 (CRITICAL) w...
CVE-2022-31793
CVE-2022-31793 affects muhttpd versions prior to 1.1.7 used in Arris NVG443/NVG599/NVG589/NVG510 and BGW210/BGW320 devices. Root cause: do_request in request.c skips the first character when serving files, enabling path traversal and reading arbitrary files on the device. Impact: unauthenticated ...
CVE-2022-31197
PgJDBC (PostgreSQL JDBC Driver) is affected by CVE-2022-31197 due to the java.sql.ResultRow.refreshRow() not escaping column names, enabling SQL injection when a column name contains a terminator like ;. Attack requires tricking a user into running SQL against a table with malicious column names ...
CVE-2022-29154
CVE-2022-29154 affects rsync prior to 3.2.5, enabling a malicious server (or MITM) to cause the rsync client to write arbitrary files in the client’s directory tree (including sensitive files such as .ssh/authorized_keys). The issue arises from insufficient validation of filenames returned by the...
CVE-2022-31181
PrestaShop versions 1.6.0.10 through 1.7.8.7 contain an SQL injection flaw caused by unsanitized user input, which can be chained to call PHP’s Eval function. The vulnerability can lead to remote code execution and is fixed in 1.7.8.7. Upgrading to 1.7.8.7 or later is the recommended remediation;...
CVE-2022-1950
CVE-2022-1950 affects the Youzify WordPress plugin for versions before 1.2.0. The root cause is a parameter that is not sanitized/escaped before being used in a SQL statement in an unauthenticated AJAX action, enabling unauthenticated SQL injection. Impact described across sources includes the ab...
CVE-2022-27255
CVE-2022-27255 affects Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1. The SIP ALG component that rewrites SDP data has a stack-based buffer overflow, enabling an attacker to remotely execute code without authentication by sending a crafted SIP packet containing malicious SDP data. The NVD metrics ra...
CVE-2022-2414
CVE-2022-2414 is an XXE vulnerability in Dogtag PKI (pki-core) where XML parsing allows reading arbitrary server files. The CVE description and multiple advisories confirm the issue originates from XML External Entity processing and can lead to sensitive data exposure. Public exploitation materia...
CVE-2022-2294
CVE-2022-2294 is a heap-buffer-overflow in WebRTC code within Google Chrome (Chromium-based) prior to 103.0.5060.114. Reported as enabling remote heap corruption via a crafted HTML page, potentially leading to code execution. Affected component: WebRTC in Chrome/Chromium. Remediation: upgrade to ...
CVE-2022-34121
Cuppa CMS v1.0 is vulnerable to a local file inclusion (LFI) through the component /templates/default/html/windows/right.php . The issue, described across sources, enables unauthorized access and disclosure of sensitive information, with potential remote code execution implied by some references....
CVE-2022-1364
CVE-2022-1364 is a type confusion in Google Chrome's V8 Turbofan engine, affecting Chrome/Chromium prior to version 100.0.4896.127. The root cause is a V8 Turbofan type confusion that could allow a remote attacker to trigger heap corruption via a crafted HTML page, leading to potential high-sever...
CVE-2022-35653
Moodle LTI module Reflected Cross-Site Scripting (CVE-2022-35653) stems from insufficient sanitization of user-supplied data. A remote attacker can lure a user into opening a crafted link and execute arbitrary HTML/JavaScript in the victim’s browser, potentially stealing data or altering the page...
CVE-2022-1096
CVE-2022-1096 — Chrome/Chromium-type confusion in V8 ; a type confusion in V8 prior to Chrome 99.0.4844.84 could allow a remote attacker to cause heap corruption on a crafted HTML page. Affected products are Chromium-based browsers (e.g., Google Chrome, Microsoft Edge). Root cause: type confusion...