Total
277 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-26877 | 1 Asana | 1 Desktop | 2022-04-14 | 4.3 MEDIUM | 6.5 MEDIUM |
| Asana Desktop before 1.6.0 allows remote attackers to exfiltrate local files if they can trick the Asana desktop app into loading a malicious web page. | |||||
| CVE-2022-28002 | 1 Movie Seat Reservation Project | 1 Movie Seat Reservation | 2022-04-14 | 5.0 MEDIUM | 7.5 HIGH |
| Movie Seat Reservation v1 was discovered to contain an unauthenticated file disclosure vulnerability via /index.php?page=home. | |||||
| CVE-2019-13140 | 1 Intenogroup | 2 Eg200, Eg200 Firmware | 2022-03-31 | 4.0 MEDIUM | 6.5 MEDIUM |
| Inteno EG200 EG200-WU7P1U_ADAMO3.16.4-190226_1650 routers have a JUCI ACL misconfiguration that allows the "user" account to extract the 3DES key via JSON commands to ubus. The 3DES key is used to decrypt the provisioning file provided by Adamo Telecom on a public URL via cleartext HTTP. | |||||
| CVE-2022-26271 | 1 74cms | 1 74cms | 2022-03-31 | 5.0 MEDIUM | 7.5 HIGH |
| 74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php. | |||||
| CVE-2022-24075 | 1 Navercorp | 1 Whale | 2022-03-23 | 4.3 MEDIUM | 6.5 MEDIUM |
| Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files. | |||||
| CVE-2022-25497 | 1 Cuppacms | 1 Cuppacms | 2022-03-23 | 5.0 MEDIUM | 5.3 MEDIUM |
| CuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function. | |||||
| CVE-2021-32008 | 1 Secomea | 1 Gatemanager | 2022-03-12 | 8.5 HIGH | 8.7 HIGH |
| This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Improper Limitation of a Pathname to restricted directory, allows logged in GateManager admin to delete system Files or Directories. | |||||
| CVE-2022-23377 | 1 Keep | 1 Archeevo | 2022-03-08 | 5.0 MEDIUM | 7.5 HIGH |
| Archeevo below 5.0 is affected by local file inclusion through file=~/web.config to allow an attacker to retrieve local files. | |||||
| CVE-2022-25104 | 1 Horizontcms Project | 1 Horizontcms | 2022-03-03 | 5.0 MEDIUM | 7.5 HIGH |
| HorizontCMS v1.0.0-beta.2 was discovered to contain an arbitrary file download vulnerability via the component /admin/file-manager/. | |||||
| CVE-2022-25297 | 1 Drogon | 1 Drogon | 2022-02-28 | 6.5 MEDIUM | 8.8 HIGH |
| This affects the package drogonframework/drogon before 1.7.5. The unsafe handling of file names during upload using HttpFile::save() method may enable attackers to write files to arbitrary locations outside the designated target folder. | |||||
| CVE-2022-25299 | 1 Cesanta | 1 Mongoose | 2022-02-28 | 5.0 MEDIUM | 7.5 HIGH |
| This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enable attackers to write files to arbitrary locations outside the designated target folder. | |||||
| CVE-2022-24694 | 1 Mahara | 1 Mahara | 2022-02-11 | 4.0 MEDIUM | 4.3 MEDIUM |
| In Mahara 20.10 before 20.10.4, 21.04 before 21.04.3, and 21.10 before 21.10.1, the names of folders in the Files area can be seen by a person not owning the folders. (Only folder names are affected. Neither file names nor file contents are affected.) | |||||
| CVE-2021-25004 | 1 Seur Oficial Project | 1 Seur Oficial | 2022-02-11 | 4.0 MEDIUM | 4.9 MEDIUM |
| The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server without restriction after knowing the URL and a password than an administrator can see in the plugin settings page. | |||||
| CVE-2021-44983 | 1 Taogogo | 1 Taocms | 2022-02-08 | 4.0 MEDIUM | 4.9 MEDIUM |
| In taocms 3.0.1 after logging in to the background, there is an Arbitrary file download vulnerability at the File Management column. | |||||
| CVE-2022-23316 | 1 Taogogo | 1 Taocms | 2022-02-08 | 4.0 MEDIUM | 4.9 MEDIUM |
| An issue was discovered in taoCMS v3.0.2. There is an arbitrary file read vulnerability that can read any files via admin.php?action=file&ctrl=download&path=../../1.txt. | |||||
| CVE-2022-0244 | 1 Gitlab | 1 Gitlab | 2022-01-25 | 5.0 MEDIUM | 7.5 HIGH |
| An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possible by importing a group was due to incorrect handling of file. | |||||
| CVE-2022-22269 | 1 Google | 1 Android | 2022-01-15 | 2.1 LOW | 3.3 LOW |
| Keeping sensitive data in unprotected BluetoothSettingsProvider prior to SMR Jan-2022 Release 1 allows untrusted applications to get a local Bluetooth MAC address. | |||||
| CVE-2022-22268 | 1 Google | 1 Android | 2022-01-14 | 3.6 LOW | 6.1 MEDIUM |
| Incorrect implementation of Knox Guard prior to SMR Jan-2022 Release 1 allows physically proximate attackers to temporary unlock the Knox Guard via Samsung DeX mode. | |||||
| CVE-2022-22270 | 1 Google | 1 Android | 2022-01-14 | 4.3 MEDIUM | 3.3 LOW |
| An implicit Intent hijacking vulnerability in Dialer prior to SMR Jan-2022 Release 1 allows unprivileged applications to access contact information. | |||||
| CVE-2022-22267 | 1 Google | 1 Android | 2022-01-14 | 2.1 LOW | 3.3 LOW |
| Implicit Intent hijacking vulnerability in ActivityMetricsLogger prior to SMR Jan-2022 Release 1 allows attackers to get running application information. | |||||