Search
Total
21119 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-0109 | 1 Google | 1 Chrome | 2022-02-18 | 4.3 MEDIUM | 6.5 MEDIUM |
| Inappropriate implementation in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page. | |||||
| CVE-2022-21988 | 1 Microsoft | 3 365 Apps, Office, Office Long Term Servicing Channel | 2022-02-18 | 6.8 MEDIUM | 7.8 HIGH |
| Microsoft Office Visio Remote Code Execution Vulnerability. | |||||
| CVE-2021-39672 | 1 Google | 1 Android | 2022-02-17 | 7.2 HIGH | 7.8 HIGH |
| In fastboot, there is a possible secure boot bypass due to a configuration error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android SoC Android ID: A-202018701 | |||||
| CVE-2022-24961 | 1 Portainer | 1 Portainer | 2022-02-17 | 7.5 HIGH | 9.8 CRITICAL |
| In Portainer Agent before 2.11.1, an API server can continue running even if not associated with a Portainer instance in the past few days. | |||||
| CVE-2021-29632 | 1 Freebsd | 1 Freebsd | 2022-02-17 | 5.0 MEDIUM | 7.5 HIGH |
| In FreeBSD 13.0-STABLE before n247428-9352de39c3dc, 12.2-STABLE before r370674, 13.0-RELEASE before p6, and 12.2-RELEASE before p12, certain conditions involving use of the highlight buffer while text is scrolling on the console, console data may overwrite data structures associated with the system console or other kernel memory. | |||||
| CVE-2021-43803 | 2 Nodejs, Vercel | 2 Node.js, Next.js | 2022-02-17 | 4.3 MEDIUM | 7.5 HIGH |
| Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue. | |||||
| CVE-2021-37613 | 1 Stormshield | 1 Stormshield Network Security | 2022-02-17 | 2.9 LOW | 6.5 MEDIUM |
| Stormshield Network Security (SNS) 1.0.0 through 4.2.3 allows a Denial of Service. | |||||
| CVE-2021-0117 | 2 Intel, Netapp | 1360 Atom C3308, Atom C3308 Firmware, Atom C3336 and 1357 more | 2022-02-16 | 4.6 MEDIUM | 7.8 HIGH |
| Pointer issues in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access. | |||||
| CVE-2022-22544 | 1 Sap | 1 Solution Manager | 2022-02-16 | 6.5 MEDIUM | 9.1 CRITICAL |
| Solution Manager (Diagnostics Root Cause Analysis Tools) - version 720, allows an administrator to execute code on all connected Diagnostics Agents and browse files on their systems. An attacker could thereby control the managed systems. It is considered that this is a missing segregation of duty for the SAP Solution Manager administrator. Impacts of unauthorized execution of commands can lead to sensitive information disclosure, loss of system integrity and denial of service. | |||||
| CVE-2022-22005 | 1 Microsoft | 3 Sharepoint Enterprise Server, Sharepoint Foundation, Sharepoint Server | 2022-02-15 | 6.5 MEDIUM | 8.8 HIGH |
| Microsoft SharePoint Server Remote Code Execution Vulnerability. | |||||
| CVE-2021-39616 | 1 Google | 1 Android | 2022-02-15 | 10.0 HIGH | 9.8 CRITICAL |
| Summary:Product: AndroidVersions: Android SoCAndroid ID: A-204686438 | |||||
| CVE-2022-22994 | 1 Westerndigital | 11 My Cloud, My Cloud Dl2100, My Cloud Dl4100 and 8 more | 2022-02-15 | 7.5 HIGH | 9.8 CRITICAL |
| A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unsecured HTTP call. This was a result insufficient verification of calls to the device. The vulnerability was addressed by disabling checks for internet connectivity using HTTP. | |||||
| CVE-2022-22003 | 1 Microsoft | 3 365 Apps, Office, Office Long Term Servicing Channel | 2022-02-14 | 6.8 MEDIUM | 7.8 HIGH |
| Microsoft Office Graphics Remote Code Execution Vulnerability. | |||||
| CVE-2022-22709 | 1 Microsoft | 1 Vp9 Video Extensions | 2022-02-14 | 6.8 MEDIUM | 7.8 HIGH |
| VP9 Video Extensions Remote Code Execution Vulnerability. | |||||
| CVE-2022-22004 | 1 Microsoft | 2 365 Apps, Office | 2022-02-14 | 6.8 MEDIUM | 7.8 HIGH |
| Microsoft Office ClickToRun Remote Code Execution Vulnerability. | |||||
| CVE-2022-23280 | 1 Microsoft | 1 Outlook 2016 | 2022-02-14 | 5.0 MEDIUM | 5.3 MEDIUM |
| Microsoft Outlook for Mac Security Feature Bypass Vulnerability. | |||||
| CVE-2022-23274 | 1 Microsoft | 1 Dynamics Gp | 2022-02-14 | 6.5 MEDIUM | 8.8 HIGH |
| Microsoft Dynamics GP Remote Code Execution Vulnerability. | |||||
| CVE-2022-21987 | 1 Microsoft | 3 Sharepoint Enterprise Server, Sharepoint Foundation, Sharepoint Server | 2022-02-14 | 6.0 MEDIUM | 8.0 HIGH |
| Microsoft SharePoint Server Spoofing Vulnerability. | |||||
| CVE-2021-37989 | 2 Debian, Google | 2 Debian Linux, Chrome | 2022-02-12 | 4.3 MEDIUM | 6.5 MEDIUM |
| Inappropriate implementation in Blink in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to abuse content security policy via a crafted HTML page. | |||||
| CVE-2021-37990 | 2 Debian, Google | 2 Debian Linux, Chrome | 2022-02-12 | 4.3 MEDIUM | 5.5 MEDIUM |
| Inappropriate implementation in WebView in Google Chrome on Android prior to 95.0.4638.54 allowed a remote attacker to leak cross-origin data via a crafted app. | |||||
| CVE-2022-23261 | 1 Microsoft | 1 Edge Chromium | 2022-02-12 | 5.0 MEDIUM | 5.3 MEDIUM |
| Microsoft Edge (Chromium-based) Tampering Vulnerability. | |||||
| CVE-2021-38010 | 3 Debian, Fedoraproject, Google | 3 Debian Linux, Fedora, Chrome | 2022-02-11 | 4.3 MEDIUM | 6.5 MEDIUM |
| Inappropriate implementation in service workers in Google Chrome prior to 96.0.4664.45 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. | |||||
| CVE-2021-40837 | 3 Apple, F-secure, Microsoft | 8 Macos, Atlant, Elements Endpoint Detection And Response and 5 more | 2022-02-11 | 5.0 MEDIUM | 5.3 MEDIUM |
| A vulnerability affecting F-Secure antivirus engine before Capricorn update 2022-02-01_01 was discovered whereby decompression of ACE file causes the scanner service to stop. The vulnerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the antivirus engine. | |||||
| CVE-2022-24677 | 1 Hyphp | 1 Hybbs2 | 2022-02-11 | 7.5 HIGH | 9.8 CRITICAL |
| Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php. | |||||
| CVE-2022-23340 | 1 Joplin Project | 1 Joplin | 2022-02-11 | 7.5 HIGH | 9.8 CRITICAL |
| Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results. | |||||
| CVE-2021-30838 | 1 Apple | 3 Ipados, Iphone Os, Macos | 2022-02-11 | 9.3 HIGH | 7.8 HIGH |
| A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15 and iPadOS 15. A malicious application may be able to execute arbitrary code with system privileges on devices with an Apple Neural Engine. | |||||
| CVE-2021-30784 | 1 Apple | 2 Mac Os X, Macos | 2022-02-11 | 4.6 MEDIUM | 7.8 HIGH |
| Multiple issues were addressed with improved logic. This issue is fixed in macOS Big Sur 11.5. A local attacker may be able to execute code on the Apple T2 Security Chip. | |||||
| CVE-2021-30774 | 1 Apple | 6 Ipados, Iphone Os, Mac Os X and 3 more | 2022-02-11 | 9.3 HIGH | 7.8 HIGH |
| A logic issue was addressed with improved validation. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7. A malicious application may be able to gain root privileges. | |||||
| CVE-2021-30834 | 1 Apple | 6 Ipad Os, Iphone Os, Mac Os X and 3 more | 2022-02-11 | 6.8 MEDIUM | 7.8 HIGH |
| A logic issue was addressed with improved state management. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, watchOS 8, Security Update 2021-007 Catalina. Processing a malicious audio file may result in unexpected application termination or arbitrary code execution. | |||||
| CVE-2021-30924 | 1 Apple | 5 Ipad Os, Iphone Os, Macos and 2 more | 2022-02-11 | 7.8 HIGH | 7.5 HIGH |
| A denial of service issue was addressed with improved state handling. This issue is fixed in macOS Monterey 12.0.1. A remote attacker can cause a device to unexpectedly restart. | |||||
| CVE-2021-30897 | 1 Apple | 4 Ipad Os, Iphone Os, Macos and 1 more | 2022-02-11 | 4.3 MEDIUM | 6.5 MEDIUM |
| An issue existed in the specification for the resource timing API. The specification was updated and the updated specification was implemented. This issue is fixed in macOS Monterey 12.0.1. A malicious website may exfiltrate data cross-origin. | |||||
| CVE-2021-30864 | 1 Apple | 1 Macos | 2022-02-11 | 5.0 MEDIUM | 8.6 HIGH |
| A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1. A sandboxed process may be able to circumvent sandbox restrictions. | |||||
| CVE-2021-30811 | 1 Apple | 5 Ipados, Iphone Os, Mac Os X and 2 more | 2022-02-11 | 2.1 LOW | 5.5 MEDIUM |
| This issue was addressed with improved checks. This issue is fixed in iOS 15 and iPadOS 15, watchOS 8. A local attacker may be able to read sensitive information. | |||||
| CVE-2021-30835 | 1 Apple | 7 Ipados, Iphone Os, Itunes and 4 more | 2022-02-11 | 6.8 MEDIUM | 7.8 HIGH |
| This issue was addressed with improved checks. This issue is fixed in Security Update 2021-005 Catalina, iTunes 12.12 for Windows, tvOS 15, iOS 15 and iPadOS 15, watchOS 8. Processing a maliciously crafted image may lead to arbitrary code execution. | |||||
| CVE-2021-39280 | 1 Korenix | 12 Jetwave 2212g, Jetwave 2212g Firmware, Jetwave 2212s and 9 more | 2022-02-11 | 9.0 HIGH | 8.8 HIGH |
| Certain Korenix JetWave devices allow authenticated users to execute arbitrary code as root via /syscmd.asp. This affects 2212X before 1.9.1, 2212S before 1.9.1, 2212G before 1.8, 3220 V3 before 1.5.1, 3420 V3 before 1.5.1, and 2311 through 2022-01-31. | |||||
| CVE-2021-46359 | 1 Fisco-bcos | 1 Fisco-bcos | 2022-02-10 | 5.0 MEDIUM | 7.5 HIGH |
| FISCO-BCOS release-3.0.0-rc2 contains a denial of service vulnerability. Some transactions may not be committed successfully, and malicious users may use this to achieve double-spending attacks. | |||||
| CVE-2022-21392 | 1 Oracle | 1 Enterprise Manager Base Platform | 2022-02-10 | 7.2 HIGH | 8.8 HIGH |
| Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework). Supported versions that are affected are 13.4.0.0 and 13.5.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Enterprise Manager Base Platform accessible data as well as unauthorized update, insert or delete access to some of Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 8.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). | |||||
| CVE-2022-22680 | 1 Synology | 1 Diskstation Manager | 2022-02-10 | 5.0 MEDIUM | 7.5 HIGH |
| Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to obtain sensitive information via unspecified vectors. | |||||
| CVE-2021-38148 | 1 Obsidian | 1 Obsidian | 2022-02-10 | 7.5 HIGH | 9.8 CRITICAL |
| Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs. | |||||
| CVE-2022-22833 | 1 Servisnet | 1 Tessa | 2022-02-10 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Servisnet Tessa 0.0.2. An attacker can obtain sensitive information via a /js/app.js request. | |||||
| CVE-2020-12988 | 1 Amd | 122 Epyc 7001, Epyc 7001 Firmware, Epyc 7002 and 119 more | 2022-02-10 | 7.8 HIGH | 7.5 HIGH |
| A potential denial of service (DoS) vulnerability exists in the integrated chipset that may allow a malicious attacker to hang the system when it is rebooted. | |||||
| CVE-2019-15363 | 1 Leagoo | 2 Power 5, Power 5 Firmware | 2022-02-10 | 2.1 LOW | 5.5 MEDIUM |
| The Leagoo Power 5 Android device with a build fingerprint of LEAGOO/Power_5/Power_5:8.1.0/O11019/1532686195:user/release-keys contains a pre-installed app with a package name of com.mediatek.wfo.impl app (versionCode=27, versionName=8.1.0) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization. | |||||
| CVE-2021-45897 | 1 Salesagility | 1 Suitecrm | 2022-02-10 | 6.5 MEDIUM | 8.8 HIGH |
| SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows remote code execution. | |||||
| CVE-2021-2175 | 1 Oracle | 1 Database Server | 2022-02-10 | 4.0 MEDIUM | 2.7 LOW |
| Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any View, Select Any View privilege with network access via Oracle Net to compromise Database Vault. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Database Vault accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N). | |||||
| CVE-2021-30887 | 3 Apple, Debian, Fedoraproject | 7 Ipad Os, Iphone Os, Macos and 4 more | 2022-02-09 | 4.3 MEDIUM | 6.5 MEDIUM |
| A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to unexpectedly unenforced Content Security Policy. | |||||
| CVE-2020-8781 | 1 Sierrawireless | 14 Airlink Es440, Airlink Es450, Airlink Gx400 and 11 more | 2022-02-09 | 7.2 HIGH | 7.8 HIGH |
| Lack of input sanitization in UpdateRebootMgr service of ALEOS 4.11 and later allow an escalation to root from a low-privilege process. | |||||
| CVE-2020-8782 | 1 Sierrawireless | 14 Airlink Es440, Airlink Es450, Airlink Gx400 and 11 more | 2022-02-09 | 7.5 HIGH | 9.8 CRITICAL |
| Unauthenticated RPC server on ALEOS before 4.4.9, 4.9.5, and 4.14.0 allows remote code execution. | |||||
| CVE-2019-11855 | 1 Sierrawireless | 13 Airlink Es440, Airlink Es450, Airlink Gx400 and 10 more | 2022-02-09 | 7.5 HIGH | 9.8 CRITICAL |
| An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9. | |||||
| CVE-2017-8036 | 1 Cloudfoundry | 1 Capi-release | 2022-02-09 | 6.8 MEDIUM | 7.8 HIGH |
| An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release version 1.33.0 (only). The original fix for CVE-2017-8033 included in CAPI-release 1.33.0 introduces a regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushing a specially crafted application. | |||||
| CVE-2020-13364 | 1 Zyxel | 8 Nas326, Nas326 Firmware, Nas520 and 5 more | 2022-02-09 | 9.0 HIGH | 8.8 HIGH |
| A backdoor in certain Zyxel products allows remote TELNET access via a CGI script. This affects NAS520 V5.21(AASZ.4)C0, V5.21(AASZ.0)C0, V5.11(AASZ.3)C0, and V5.11(AASZ.0)C0; NAS542 V5.11(ABAG.0)C0, V5.20(ABAG.1)C0, and V5.21(ABAG.3)C0; NSA325 v2_V4.81(AALS.0)C0 and V4.81(AAAJ.1)C0; NSA310 4.22(AFK.0)C0 and 4.22(AFK.1)C0; NAS326 V5.21(AAZF.8)C0, V5.11(AAZF.4)C0, V5.11(AAZF.2)C0, and V5.11(AAZF.3)C0; NSA310S V4.75(AALH.2)C0; NSA320S V4.75(AANV.2)C0 and V4.75(AANV.1)C0; NSA221 V4.41(AFM.1)C0; and NAS540 V5.21(AATB.5)C0 and V5.21(AATB.3)C0. | |||||