CVE-2022-24816

CVE-2022-24816 (JAI-EXT/Jai-EXT) affects GeoServer ecosystems where JAI-EXT allows a Jiffle script to be supplied over a network and then compiled to Java code via Janino, enabling Remote Code Execution. The GeoServer downstream is specifically noted. The known remediation is that version 1.2.22 ...

CVE-2022-22955

CVE-2022-22955 and CVE-2022-22956 affect VMware Workspace ONE Access via the OAuth2 ACS framework. The issues are authentication bypass vulnerabilities that allow a remote attacker to bypass authentication and perform operations due to exposed endpoints. Technical context in connected docs confir...

CVE-2022-22958

CVE-2022-22958 is part of a pair of remote code execution vulnerabilities affecting VMware Workspace ONE Access, Identity Manager and vRealize Automation. Public details in the connected docs confirm two RCE vulnerabilities (CVE-2022-22957 and CVE-2022-22958) that can be triggered by an attacker ...

CVE-2022-22956

CVE-2022-22956 affects VMware Workspace ONE Access. The vulnerability is an authentication bypass in the OAuth2 ACS/OAuth2TokenResourceController layer, created by exposed endpoints that let a remote attacker bypass authentication and perform operations. It is part of a duo with CVE-2022-22955. T...

CVE-2022-22960

CVE-2022-22960 is a VMware privilege-escalation vulnerability in Workspace ONE Access, Identity Manager, and vRealize Automation caused by improper permissions in support scripts. A local attacker can escalate to root on affected systems. Technical details indicate affected products include VMwar...

CVE-2022-22957

Summary (CVE-2022-22957 / CVE-2022-22958): VMware Workspace ONE Access, Identity Manager and vRealize Automation are affected by remote code execution vulnerabilities. The root cause is deserialization of untrusted data via a malicious JDBC URI in the DBConnectionCheckController (CVE-2022-22957) ...

CVE-2021-31805

The CVE-2021-31805 entry describes a Remote Code Execution risk in Apache Struts caused by forced OGNL evaluation in tag attributes. The issue arises when untrusted input is evaluated via %{...}, enabling double OGNL evaluation and potentially remote code execution. Affected products span Apache ...

CVE-2022-0142

The CVE-2022-0142 entry concerns the WordPress Visual Form Builder plugin, affected version(s) before 3.0.8. The vulnerability is a CSV injection flaw that allows a user with low or no privileges to inject a command into exported CSV data, with the potential for code execution. Concretely, the is...

CVE-2022-22954

CVE-2022-22954 is a server-side template injection (SSTI) leading to remote code execution in VMware Workspace ONE Access and VMware Identity Manager. The vulnerability allows an attacker with network access to trigger SSTI in Freemarker templates, potentially compromising the underlying system. ...

CVE-2021-37291

CVE-2021-37291 : KevinLAB BEMS 1.0.0 is affected by an SQL injection in the input_id POST parameter (in /http/index.php). The vulnerability arises from unsanitized input used in SQL queries, enabling unauthenticated attackers to read/modify data and potentially perform admin actions. The NUCLEI t...

CVE-2022-1006

CVE-2022-1006 affects the WordPress plugin Advanced Booking Calendar prior to version 1.7.1. The vulnerability stems from the plugin not sanitising or escaping the id parameter when editing calendars, enabling high-privilege users (e.g., admins) to perform SQL injection. The issue is documented a...

CVE-2022-27294

CVE-2022-27294 affects D-Link DIR-619 Ax v1.00, with a stack overflow in the function formWlanWizardSetup that allows a Denial of Service via a webpage parameter. Public data label the impact as high (CVSS 3.1: 7.5, NETWORK, no privileges required, Availability High). The issue is documented in m...

CVE-2022-27295

CVE-2022-27295 affects D-Link DIR-619 Ax v1.00. The vulnerability is a stack overflow in the function formAdvanceSetup, allowing a denial-of-service via a webpage parameter. Multiple sources (NVD, CNVD, Red Hat advisory, CVE list) confirm the affected product and the root cause; exploitation deta...

CVE-2022-28363

Reprise License Manager 14.2 is affected by a reflected cross-site scripting (XSS) vulnerability in the /goform/login_process endpoint, specifically the GET parameter username. No authentication is required. The issue allows arbitrary JavaScript execution in the victim’s browser, enabling potenti...

CVE-2022-28365

Affected software: Reprise License Manager 14.2. Vulnerability: Information disclosure via a GET request to /goforms/rlminfo without authentication. Impact (as stated): Disclosed data includes software versions, process IDs, network configuration, hostnames, system architecture, and file/director...

CVE-2021-46417

CVE-2021-46417 affects Franklin Fueling Systems Colibri Controller Module 1.8.19.8580. The Local File Inclusion vulnerability arises from insecure handling of a download function that allows path traversal (example: /cgi-bin/tsaupload.cgi?file_name=../../../../../..//etc/passwd). This can disclos...

CVE-2021-30497

Ivanti Avalanche 6.3.2 on Premise is affected by CVE-2021-30497: a Local/File Inclusion/Absolute Path Traversal flaw in the /AvalancheWeb/image endpoint allows remote, unauthenticated users to read arbitrary files (e.g., C:\Windows\system32\config\system.sav) due to imageFilePath not being valida...

CVE-2022-28219

Summary of CVE-2022-28219 findings (Zoho ManageEngine ADAudit Plus) : ADAudit Plus versions before build 7060 are vulnerable to an unauthenticated XML External Entity (XXE) injection and a path traversal in the /cewolf endpoint, enabling remote code execution. Public advisories (and multiple secu...

CVE-2020-19229

CVE-2020-19229 affects Jeesite 1.2.7 which bundles Apache Shiro 1.2.3. The issue arises from a Java deserialization vulnerability via the rememberMe parameter when a cipher key is not configured, enabling remote code execution. Public details indicate the root cause is CVE-2016-4437 (Apache Shiro...

CVE-2022-0609

CVE-2022-0609 is a Google Chrome vulnerability described as a use-after-free in the Animation component, leading to potential heap corruption and remote code execution via a crafted HTML page. Affected product: Google Chrome (Animation). Vulnerable condition: use-after-free in the Chrome animatio...