CVE-2021-45837

TerraMaster F4-210/F2-210 devices running TOS 4.2.x (4.2.15-2107141517) are affected by CVE-2021-45837, which allows executing arbitrary commands as root via a specially crafted input to /tos/index.php?app/del. The vulnerability is part of an RCE chain described across multiple sources (including...

CVE-2022-1439

CVE-2022-1439 is a documented reflected cross-site scripting vulnerability affecting Microweber prior to version 1.2.15, where an attacker could execute arbitrary JavaScript in the context of the victim’s browser on the vulnerable page (demo.microweber.org/demo/module/). Multiple connected source...

CVE-2022-27926

Zimbra Collaboration (ZCS) 9.0 is affected by a reflected XSS in /public/launchNewWindow.jsp that allows unauthenticated attackers to execute arbitrary script or HTML via request parameters. The issue is confirmed across multiple sources (NVD/Nuclei/CISA KEV/CNVD) with the impact described as cli...

CVE-2022-27925

CVE-2022-27925 affects Zimbra Collaboration Suite 8.8.15 and 9.0, where mboximport accepts a ZIP and extracts files. An authenticated administrator can upload arbitrary files, enabling directory traversal. Public PoCs/exploits in connected docs demonstrate path traversal behavior and indicate aff...

CVE-2022-27924

CVE-2022-27924 affects Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0, allowing an unauthenticated attacker to inject arbitrary memcache commands into a targeted ZCS instance, with those commands becoming unescaped and enabling overwriting of arbitrary cached entries and extraction of credential...

CVE-2020-11510

Technical details for CVE-2020-11510 are not publicly available in the provided documents. Monitor for updates.

CVE-2022-0540

CVE-2022-0540 is an authentication-bypass vulnerability in Atlassian Jira Seraph. It enables remote, unauthenticated access via a crafted HTTP request. Affected product ranges (per connected documents): Jira Server/Data Center: < 8.13.18; 8.14.x–8.19.x; 8.20.0–8.20.6; 8.21.x Jira Service Manag...

CVE-2022-21445

CVE-2022-21445 is a vulnerability in the Oracle Application Development Framework (ADF Faces) within Oracle Fusion Middleware. Affected are the JDeveloper-distributed ADF components for versions 12.2.1.3.0 and 12.2.1.4.0. The vulnerability allows unauthenticated, network-accessible attackers to e...

CVE-2022-1119

The CVE-2022-1119 issue affects WordPress Simple File List plugin versions up to 3.2.7. It is caused by missing input validation in ee-downloader.php (eeFile parameter), enabling unauthenticated arbitrary file download/read of server files. A local-file-download/LFI is the documented impact. Reme...

CVE-2022-27927

CVE-2022-27927 affects Microfinance Management System 1.0 in which SQL injection is possible when MySQL is used as the application database. The vulnerable inputs are the course_code and/or customer_number parameters, through which an attacker can issue arbitrary SQL commands to the backend datab...

CVE-2022-29153

CVE-2022-29153 (HashiCorp Consul/Consul Enterprise SSRF) is triggered by a server-side request forgery when the Consul client follows HTTP health-check redirects. Affected versions include Consul and Consul Enterprise prior to fixes: 1.9.16 and earlier, 1.10.9 and earlier, 1.11.4 and earlier. The...

CVE-2022-1020

CVE-2022-1020 affects the WordPress WooCommerce Product Table plugin prior to 3.1.2. The wpt_admin_update_notice_option AJAX action lacks proper authorization and CSRF checks and does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with none or ...

CVE-2022-0785

The CVE-2022-0785 vulnerability affects the WordPress Daily Prayer Time plugin prior to 2022.03.01. The issue arises because the plugin does not sanitize or escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action, which is accessible to unauthentica...

CVE-2011-1762

WordPress vulnerability CVE-2011-1762 involves the wp-admin/press-this.php script failing to properly check permissions, potentially allowing a user with Contributor-level rights to publish posts as if they had publish_posts. The issue is documented across multiple sources (NVD entry and related ...

CVE-2022-28810

Affected product and version: Zoho ManageEngine ADSelfService Plus (pre-build 6122). Vulnerability type and impact: command injection via the policy custom script feature that allows a remote authenticated administrator to execute arbitrary OS commands as SYSTEM; exploitation could be facilitated...

CVE-2022-29464

CVE-2022-29464 is an unauthenticated, pre-auth arbitrary file upload in WSO2 products that enables remote code execution via a crafted POST to /fileupload. The vulnerability arises from directory traversal during upload, allowing JSPs to be placed under the webroot (e.g., repository/deployment/se...

CVE-2022-26904

CVE-2022-26904 is a Windows User Profile Service Elevation of Privilege vulnerability. The issue is a race-condition–driven LPE in the User Profile Service, with attacker-controlled code execution at SYSTEM granted by bypasses and PoCs described in public sources. A Metasploit module exists for t...

CVE-2022-24521

CVE-2022-24521 is a Windows Windows Common Log File System Driver Privilege Escalation vulnerability. The CVE entry reports an elevation-of-privilege flaw in the CLFS driver; CVSS scores shown include a 2.0/2.0 base (MEDIUM) on NVD and a 3.1-based HIGH score from Microsoft, both indicating local ...

CVE-2022-24481

CVE-2022-24481 is a Windows Common Log File System Driver elevation-of-privilege vulnerability. The connected exploit reports describe a memory/counterpart corruption involving CLFS_CONTAINER_CONTEXT.pContainer that can be triggered from CClfsContainer::Close by modifying CLFS_BASE_RECORD_HEADER....

CVE-2021-43287

CVE-2021-43287 affects ThoughtWorks GoCD prior to 21.3.0. The vulnerability is an information-disclosure flaw in the default-enabled business-continuity add-on, allowing unauthenticated attackers to leak all secrets known to the GoCD server (e.g., build secrets, encryption keys). The linked sourc...