Search
Total
21119 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-24974 | 1 Menlosecurity | 1 Email Isolation | 2022-05-11 | 5.0 MEDIUM | 5.3 MEDIUM |
| Links may not be rewritten according to policy in some specially formatted emails. | |||||
| CVE-2022-28118 | 1 Sscms | 1 Siteserver Cms | 2022-05-11 | 7.5 HIGH | 9.8 CRITICAL |
| SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in. | |||||
| CVE-2022-27983 | 1 Ruijienetworks | 2 Rg-nbr2100g-e, Rg-nbr2100g-e Firmware | 2022-05-10 | 5.0 MEDIUM | 7.5 HIGH |
| RG-NBR-E Enterprise Gateway RG-NBR2100G-E was discovered to contain an arbitrary file read vulnerability via the url parameter in check.php. | |||||
| CVE-2022-27982 | 1 Ruijienetworks | 2 Rg-nbr2100g-e, Rg-nbr2100g-e Firmware | 2022-05-10 | 7.5 HIGH | 9.8 CRITICAL |
| RG-NBR-E Enterprise Gateway RG-NBR2100G-E was discovered to contain a remote code execution (RCE) vulnerability via the fileName parameter at /guest_auth/cfg/upLoadCfg.php. | |||||
| CVE-2021-22569 | 2 Google, Oracle | 7 Google-protobuf, Protobuf-java, Protobuf-kotlin and 4 more | 2022-05-10 | 4.3 MEDIUM | 5.5 MEDIUM |
| An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions. | |||||
| CVE-2022-21490 | 2 Netapp, Oracle | 4 Active Iq Unified Manager, Oncommand Insight, Snapcenter and 1 more | 2022-05-10 | 4.0 MEDIUM | 6.3 MEDIUM |
| Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). | |||||
| CVE-2022-21489 | 2 Netapp, Oracle | 4 Active Iq Unified Manager, Oncommand Insight, Snapcenter and 1 more | 2022-05-10 | 4.0 MEDIUM | 6.3 MEDIUM |
| Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). | |||||
| CVE-2022-21457 | 2 Netapp, Oracle | 4 Active Iq Unified Manager, Oncommand Insight, Snapcenter and 1 more | 2022-05-10 | 4.3 MEDIUM | 5.9 MEDIUM |
| Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PAM Auth Plugin). Supported versions that are affected are 8.0.28 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). | |||||
| CVE-2022-21462 | 2 Netapp, Oracle | 4 Active Iq Unified Manager, Oncommand Insight, Snapcenter and 1 more | 2022-05-10 | 4.0 MEDIUM | 4.9 MEDIUM |
| Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). | |||||
| CVE-2022-21460 | 2 Netapp, Oracle | 4 Active Iq Unified Manager, Oncommand Insight, Snapcenter and 1 more | 2022-05-10 | 2.1 LOW | 4.4 MEDIUM |
| Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Logging). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N). | |||||
| CVE-2022-21459 | 2 Netapp, Oracle | 4 Active Iq Unified Manager, Oncommand Insight, Snapcenter and 1 more | 2022-05-10 | 5.5 MEDIUM | 5.5 MEDIUM |
| Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). | |||||
| CVE-2022-21444 | 2 Netapp, Oracle | 4 Active Iq Unified Manager, Oncommand Insight, Snapcenter and 1 more | 2022-05-10 | 2.1 LOW | 4.4 MEDIUM |
| Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). | |||||
| CVE-2022-21454 | 2 Netapp, Oracle | 4 Active Iq Unified Manager, Oncommand Insight, Snapcenter and 1 more | 2022-05-10 | 4.0 MEDIUM | 6.5 MEDIUM |
| Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). | |||||
| CVE-2022-21452 | 2 Netapp, Oracle | 4 Active Iq Unified Manager, Oncommand Insight, Snapcenter and 1 more | 2022-05-10 | 4.0 MEDIUM | 4.9 MEDIUM |
| Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). | |||||
| CVE-2022-21296 | 3 Debian, Netapp, Oracle | 15 Debian Linux, Cloud Insights, E-series Santricity Os Controller and 12 more | 2022-05-10 | 5.0 MEDIUM | 5.3 MEDIUM |
| Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). | |||||
| CVE-2022-28323 | 1 Mediawiki | 1 Mediawiki | 2022-05-10 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in MediaWiki through 1.37.2. The SecurePoll extension allows a leak because sorting by timestamp is supported, | |||||
| CVE-2022-28590 | 1 Pixelimity | 1 Pixelimity | 2022-05-09 | 6.5 MEDIUM | 7.2 HIGH |
| A Remote Code Execution (RCE) vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=install_theme. | |||||
| CVE-2022-21816 | 1 Nvidia | 1 Virtual Gpu | 2022-05-09 | 4.9 MEDIUM | 5.5 MEDIUM |
| NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where a user in the guest OS can cause a GPU interrupt storm on the hypervisor host, leading to a denial of service. | |||||
| CVE-2014-0464 | 1 Oracle | 2 Jdk, Jre | 2022-05-09 | 4.3 MEDIUM | N/A |
| Unspecified vulnerability in Oracle Java SE 8 allows remote attackers to affect confidentiality via unknown vectors related to Scripting, a different vulnerability than CVE-2014-0463. | |||||
| CVE-2014-0463 | 1 Oracle | 2 Jdk, Jre | 2022-05-09 | 4.3 MEDIUM | N/A |
| Unspecified vulnerability in Oracle Java SE 8 allows remote attackers to affect confidentiality via unknown vectors related to Scripting, a different vulnerability than CVE-2014-0464. | |||||
| CVE-2014-2410 | 1 Oracle | 2 Jdk, Jre | 2022-05-09 | 9.3 HIGH | N/A |
| Unspecified vulnerability in Oracle Java SE 8 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX. | |||||
| CVE-2021-46423 | 1 Telesquare | 2 Tlr-2005ksh, Tlr-2005ksh Firmware | 2022-05-09 | 5.0 MEDIUM | 5.3 MEDIUM |
| Telesquare TLR-2005KSH 1.0.0 is affected by an unauthenticated file download vulnerability that allows a remote attacker to download a full configuration file. | |||||
| CVE-2021-46665 | 1 Mariadb | 1 Mariadb | 2022-05-08 | 2.1 LOW | 5.5 MEDIUM |
| MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations. | |||||
| CVE-2021-46442 | 1 Dlink | 2 Dir-825, Dir-825 Firmware | 2022-05-07 | 7.5 HIGH | 9.8 CRITICAL |
| In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions such as downloading configuration files and updating firmware without authorization. | |||||
| CVE-2021-33436 | 2 Microsoft, Nomachine | 2 Windows, Nomachine | 2022-05-07 | 6.2 MEDIUM | 7.3 HIGH |
| NoMachine for Windows prior to version 6.15.1 and 7.5.2 suffer from local privilege escalation due to the lack of safe DLL loading. This vulnerability allows local non-privileged users to perform DLL Hijacking via any writable directory listed under the system path and ultimately execute code as NT AUTHORITY\SYSTEM. | |||||
| CVE-2022-28114 | 1 Dscms Project | 1 Dscms | 2022-05-07 | 6.4 MEDIUM | 9.1 CRITICAL |
| DSCMS v3.0 was discovered to contain an arbitrary file deletion vulnerability via /controller/Adv.php. | |||||
| CVE-2021-26676 | 3 Debian, Intel, Opensuse | 3 Debian Linux, Connman, Leap | 2022-05-06 | 3.3 LOW | 6.5 MEDIUM |
| gdhcp in ConnMan before 1.39 could be used by network-adjacent attackers to leak sensitive stack information, allowing further exploitation of bugs in gdhcp. | |||||
| CVE-2022-29505 | 1 Linecorp | 1 Line | 2022-05-06 | 4.4 MEDIUM | 7.8 HIGH |
| Due to build misconfiguration in openssl dependency, LINE for Windows before 7.8 is vulnerable to DLL injection that could lead to privilege escalation. | |||||
| CVE-2022-0477 | 1 Gitlab | 1 Gitlab | 2022-05-05 | 4.0 MEDIUM | 4.9 MEDIUM |
| An issue has been discovered in GitLab affecting all versions starting from 11.9 before 14.5.4, all versions starting from 14.6.0 before 14.6.4, all versions starting from 14.7.0 before 14.7.1. GitLab was not correctly handling bulk requests to delete existing packages from the package registries which could result in a Denial of Service under specific conditions. | |||||
| CVE-2021-45839 | 1 Terra-master | 3 F2-210, F4-210, Tos | 2022-05-05 | 4.0 MEDIUM | 6.5 MEDIUM |
| It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) as well as other information such as MAC address, internal IP address etc. by performing a request to the /module/api.php?mobile/webNasIPS endpoint. | |||||
| CVE-2021-45837 | 1 Terra-master | 3 F2-210, F4-210, Tos | 2022-05-05 | 10.0 HIGH | 9.8 CRITICAL |
| It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending a specifically crafted input to /tos/index.php?app/del. | |||||
| CVE-2021-45840 | 1 Terra-master | 3 F2-210, F4-210, Tos | 2022-05-05 | 10.0 HIGH | 9.8 CRITICAL |
| It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending specifically crafted input to /tos/index.php?app/app_start_stop. | |||||
| CVE-2021-45842 | 1 Terra-master | 3 F2-210, F4-210, Tos | 2022-05-05 | 5.0 MEDIUM | 7.5 HIGH |
| It is possible to obtain the first administrator's hash set up in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) on the system as well as other information such as MAC address, internal IP address etc. by performing a request to the /module/api.php?mobile/wapNasIPS endpoint. | |||||
| CVE-2021-45836 | 1 Terra-master | 3 F2-210, F4-210, Tos | 2022-05-05 | 9.0 HIGH | 8.8 HIGH |
| An authenticated attacker can execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by injecting a maliciously crafted input in the request through /tos/index.php?app/hand_app. | |||||
| CVE-2022-28918 | 1 Njtech | 1 Greencms | 2022-05-04 | 5.5 MEDIUM | 8.1 HIGH |
| GreenCMS v2.3.0603 was discovered to contain an arbitrary file deletion vulnerability via /index.php?m=admin&c=custom&a=plugindelhandle&plugin_name=. | |||||
| CVE-2022-28521 | 1 Zcms Project | 1 Zcms | 2022-05-04 | 7.5 HIGH | 9.8 CRITICAL |
| ZCMS v20170206 was discovered to contain a file inclusion vulnerability via index.php?m=home&c=home&a=sp_set_config. | |||||
| CVE-2022-29264 | 1 Coreboot | 1 Coreboot | 2022-05-04 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in coreboot 4.13 through 4.16. On APs, arbitrary code execution in SMM may occur. | |||||
| CVE-2022-20805 | 1 Cisco | 1 Umbrella Secure Web Gateway | 2022-05-04 | 2.7 LOW | 4.1 MEDIUM |
| A vulnerability in the automatic decryption process in Cisco Umbrella Secure Web Gateway (SWG) could allow an authenticated, adjacent attacker to bypass the SSL decryption and content filtering policies on an affected system. This vulnerability is due to how the decryption function uses the TLS Sever Name Indication (SNI) extension of an HTTP request to discover the destination domain and determine if the request needs to be decrypted. An attacker could exploit this vulnerability by sending a crafted request over TLS from a client to an unknown or controlled URL. A successful exploit could allow an attacker to bypass the decryption process of Cisco Umbrella SWG and allow malicious content to be downloaded to a host on a protected network. There are workarounds that address this vulnerability. | |||||
| CVE-2022-0567 | 1 Ovn | 1 Ovn-kubernetes | 2022-05-04 | 6.5 MEDIUM | 9.1 CRITICAL |
| A flaw was found in ovn-kubernetes. This flaw allows a system administrator or privileged attacker to create an egress network policy that bypasses existing ingress policies of other pods in a cluster, allowing network traffic to access pods that should not be reachable. This issue results in information disclosure and other attacks on other pods that should not be reachable. | |||||
| CVE-2019-25059 | 2 Artifex, Debian | 2 Ghostscript, Debian Linux | 2022-05-04 | 6.8 MEDIUM | 7.8 HIGH |
| Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839. | |||||
| CVE-2022-23711 | 1 Elastic | 1 Kibana | 2022-05-03 | 5.0 MEDIUM | 5.3 MEDIUM |
| A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features provide a way to keep a pulse on the health and performance of your Elasticsearch cluster. Authentication with a vulnerable Kibana instance is not required to view the exposed information. The Elastic Stack monitoring exposure only impacts users that have set any of the optional monitoring.ui.elasticsearch.* settings in order to configure Kibana as a remote UI for Elastic Stack Monitoring. The same vulnerability in Kibana could expose other non-sensitive application-internal information in the page source. | |||||
| CVE-2021-37740 | 1 Mdt | 4 Scn-ip000.03, Scn-ip000.03 Firmware, Scn-ip100.03 and 1 more | 2022-05-03 | 7.8 HIGH | 7.5 HIGH |
| A denial of service vulnerability exists in MDT's firmware for the KNXnet/IP Secure router SCN-IP100.03 and KNX IP interface SCN-IP000.03 before v3.0.4, that allows a remote attacker to turn the device unresponsive to all requests on the KNXnet/IP Secure layer, until the device is rebooted, via a SESSION_REQUEST frame with a modified total length field. | |||||
| CVE-2021-23243 | 2 Google, Oppo | 36 Android, Oppo A12, Oppo A15 and 33 more | 2022-05-03 | 4.6 MEDIUM | 7.8 HIGH |
| In Oppo's battery application, the third-party SDK provides the function of loading a third-party Provider, which can be used. | |||||
| CVE-2021-34801 | 1 Valine.js | 1 Valine | 2022-05-03 | 5.0 MEDIUM | 5.3 MEDIUM |
| Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the product and version. | |||||
| CVE-2021-30724 | 1 Apple | 5 Ipad Os, Iphone Os, Mac Os X and 2 more | 2022-05-03 | 4.6 MEDIUM | 7.8 HIGH |
| This issue was addressed with improved checks. This issue is fixed in tvOS 14.6, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6, Security Update 2021-003 Catalina, macOS Big Sur 11.4, watchOS 7.5. A local attacker may be able to elevate their privileges. | |||||
| CVE-2020-4979 | 1 Ibm | 1 Qradar Security Information And Event Manager | 2022-05-03 | 7.5 HIGH | 9.8 CRITICAL |
| IBM QRadar SIEM 7.3 and 7.4 is vulnerable to insecure inter-deployment communication. An attacker that is able to comprimise or spoof traffic between hosts may be able to execute arbitrary commands. IBM X-Force D: 192538. | |||||
| CVE-2021-25271 | 1 Sophos | 1 Hitmanpro | 2022-05-03 | 3.6 LOW | 6.0 MEDIUM |
| A local attacker could read or write arbitrary files with administrator privileges in HitmanPro before version Build 318. | |||||
| CVE-2020-35308 | 1 Conquest Dicom Server Project | 1 Conquest Dicom Server | 2022-05-03 | 7.5 HIGH | 9.8 CRITICAL |
| CONQUEST DICOM SERVER before 1.5.0 has a code execution vulnerability which can be exploited by attackers to execute malicious code. | |||||
| CVE-2021-25270 | 1 Sophos | 1 Hitmanpro.alert | 2022-05-03 | 7.2 HIGH | 6.7 MEDIUM |
| A local attacker could execute arbitrary code with administrator privileges in HitmanPro.Alert before version Build 901. | |||||
| CVE-2021-25154 | 1 Arubanetworks | 1 Airwave | 2022-05-03 | 6.0 MEDIUM | 7.5 HIGH |
| A remote escalation of privilege vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability. | |||||