CVE-2022-20700

CVE-2022-20700 affects Cisco Small Business RV160/RV260/RV340/RV345 Series Routers. The Cisco advisory (KA9PK6D) documents a set of vulnerabilities in the management interface and SSL VPN/firmware image verification that can enable arbitrary code execution, privilege escalation, arbitrary command...

CVE-2022-20701

CVE-2022-20701 discusses multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers. Affected components include the SSL VPN module and the web-based management interface, with issues in image verification. Consequences stated across sources include remote code...

CVE-2022-20703

CVE-2022-20703 applies to Cisco Small Business RV160, RV260, RV340 and RV345 Series Routers. The issue is a trust/verification weakness in the software image loading process that can allow an unauthenticated attacker to install and boot a malicious or unsigned image, enabling possible arbitrary c...

CVE-2022-20705

CVE-2022-20705 affects Cisco Small Business RV160, RV260, RV340, and RV345 series routers. Connected docs confirm a session ID directory traversal authentication bypass (and related CVE-2022-20707) exploited by a Metasploit module to execute arbitrary commands with web server privileges, on firmw...

CVE-2022-20708

CVE-2022-20708 affects Cisco Small Business RV160/RV260/RV340/RV345 Series Routers. Vulnerabilities allow arbitrary code execution, privilege escalation, arbitrary command execution, bypass of authentication/authorization, installation of unsigned software, and DoS, via issues in the web-based ma...

CVE-2022-22536

CVE-2022-22536 affects SAP NetWeaver components (ABAP/Java stacks), ABAP Platform, SAP Content Server 7.53, and SAP Web Dispatcher. The issue is HTTP request smuggling/concatenation caused by how the SAP ICM front end parses requests, enabling an unauthenticated attacker to prepend arbitrary data...

CVE-2022-22718

CVE-2022-22718 is a Windows Print Spooler elevation of privilege vulnerability. Connected sources confirm an exploit exists (e.g., SpoolFool PoC) and that it has been tracked in exploit catalogs; Microsoft/MSRC guidance and CISA KEV catalog list it among known issues. Affected component: Windows ...

CVE-2022-22005

CVE-2022-22005 – Microsoft SharePoint Server RCE is an authenticated-execution flaw in SharePoint Server. The initial document states that an authenticated user with Manage Lists permissions could cause arbitrary .NET code to run on the SharePoint Web Application service account. Exploitation wou...

CVE-2022-21999

Technical details about CVE-2022-21999 are not publicly provided in the supplied connected documents. Based on the materials, we cannot specify affected software, root cause, or remediation. Monitor for updates from official advisories and vendor disclosures.

CVE-2022-21971

CVE-2022-21971 is a Windows Runtime Remote Code Execution vulnerability. The CVE entry references a Windows Runtime flaw with high severity, and connected sources corroborate that patches exist (MSRC/update guides and CISA-kev). Malwarebytes’ 2022 article notes Microsoft patches for CVE-2022-2197...

CVE-2022-24682

CVE-2022-24682 affects Zimbra Collaboration Suite 8.8.x (before 8.8.15 patch 30/update 1). A cross-site scripting (XSS) vulnerability in the Calendar/webmail UI allows an attacker to place HTML with executable JavaScript in element attributes, leading to unescaped markup and potential session coo...

CVE-2021-25114

CVE-2021-25114 affects WordPress plugin Paid Memberships Pro prior to 2.6.7. The root cause is failure to escape the discount_code in a REST route (accessible to unauthenticated users) before it is interpolated into a SQL statement, enabling a blind SQL injection. Exploitation could allow an atta...

CVE-2022-24260

Voipmonitor GUI contains a pre-auth SQL injection (CVE-2022-24260 ) in the API/utility paths (api.php and utilities.php) prior to v24.96 that allows an attacker to escalate to Administrator privileges and potentially extract data. The Nuclei template confirms the vulnerability class and affected ...

CVE-2021-4043

CVE-2021-4043 affects GPAC (gpac/gpac) prior to 1.1.0, caused by a NULL pointer dereference in the code. Findings across connected sources indicate potential for Denial of Service and, per some assessments, the possibility of arbitrary code execution. Remediation guidance varies by source; Debian...

CVE-2021-24762

CVE-2021-24762 affects WordPress Perfect Survey plugin versions before 1.5.2. The get_question AJAX action does not validate/escape the question_id parameter, enabling unauthenticated SQL injection. Consequences can include unauthorized access to data and potential compromise of the database. Rem...

CVE-2021-40407

CVE-2021-40407 affects Reolink RLC-410W IP Camera (v3.0.0.136_20121102). The vulnerability is an OS command injection in the device’s network settings via improper validation of the ddns->domain parameter in the SetDdns API, allowing an attacker to trigger commands through an HTTP request. Mul...

CVE-2021-4034

Polkit pkexec (setuid) contains a local privilege escalation flaw where pkexec fails to validate the calling parameter count and may treat crafted environment variables as commands, enabling unprivileged users to execute arbitrary code with root privileges. This has been reported across multiple ...

CVE-2021-22600

CVE-2021-22600 is a local kernel vulnerability in the Linux packet migration path. A double-free in packet_set_ring() within net/packet/af_packet.c can be exploited by a local user via crafted syscalls, enabling either denial of service or privilege escalation. Connected sources confirm the under...

CVE-2022-21371

CVE-2022-21371 affects Oracle WebLogic Server (Web Container). Affected versions are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. The issue is an easily exploitable vulnerability that, with network access over HTTP, can be triggered by an unauthenticated attacker to gain unauthorized access...

CVE-2021-35587

CVE-2021-35587 affects Oracle Access Manager (OpenSSO Agent) in Oracle Fusion Middleware. Affected versions: 11.1.2.3.0, 12.2.1.3.0, 12.2.1.4.0. The root cause is unauthenticated deserialization of untrusted data, enabling remote code execution and takeover of Oracle Access Manager. The connected...