Total
2747 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-24672 | 1 Abb | 1 Base Software | 2022-07-08 | 6.8 MEDIUM | 9.8 CRITICAL |
| A vulnerability in Base Software for SoftControl allows an attacker to insert and run arbitrary code in a computer running the affected product. This issue affects: . | |||||
| CVE-2022-1903 | 1 Armemberplugin | 1 Armember | 2022-07-06 | 6.8 MEDIUM | 8.1 HIGH |
| The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username | |||||
| CVE-2021-32477 | 1 Moodle | 1 Moodle | 2022-07-02 | 4.0 MEDIUM | 4.3 MEDIUM |
| The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administrators by default). Moodle versions 3.10 to 3.10.3 are affected. | |||||
| CVE-2021-0672 | 2 Google, Mediatek | 64 Android, Mt6731, Mt6732 and 61 more | 2022-06-28 | 2.1 LOW | 5.5 MEDIUM |
| In Browser app, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-199678035 | |||||
| CVE-2021-25344 | 1 Google | 1 Android | 2022-06-28 | 2.1 LOW | 5.5 MEDIUM |
| Missing permission check in knox_custom service prior to SMR Mar-2021 Release 1 allows attackers to gain access to device's serial number without permission. | |||||
| CVE-2021-21984 | 1 Vmware | 1 Vrealize Business For Cloud | 2022-06-28 | 7.5 HIGH | 9.8 CRITICAL |
| VMware vRealize Business for Cloud 7.x prior to 7.6.0 contains a remote code execution vulnerability due to an unauthorised end point. A malicious actor with network access may exploit this issue causing unauthorised remote code execution on vRealize Business for Cloud Virtual Appliance. | |||||
| CVE-2021-37764 | 1 Xos-shop | 1 Xos Shop System | 2022-06-28 | 5.5 MEDIUM | 8.1 HIGH |
| Arbitrary File Deletion vulnerability in XOS-Shop xos_shop_system 1.0.9 via current_manufacturer_image parameter to /shop/admin/manufacturers.php. | |||||
| CVE-2021-46820 | 1 Xos-shop | 1 Xos Shop System | 2022-06-28 | 5.5 MEDIUM | 8.1 HIGH |
| Arbitrary File Deletion vulnerability in XOS-Shop xos_shop_system 1.0.9 via current_manufacturer_image parameter to /shop/admin/categories.php | |||||
| CVE-2022-1777 | 1 Filr Project | 1 Filr | 2022-06-21 | 6.5 MEDIUM | 8.8 HIGH |
| The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard. This could allow them to upload arbitrary HTML files as well as delete all files or arbitrary ones. | |||||
| CVE-2022-31752 | 1 Huawei | 2 Emui, Magic Ui | 2022-06-18 | 2.1 LOW | 5.5 MEDIUM |
| Missing authorization vulnerability in the system components. Successful exploitation of this vulnerability will affect confidentiality. | |||||
| CVE-2022-0745 | 1 Likebtn | 1 Like Button Rating | 2022-06-18 | 4.0 MEDIUM | 6.5 MEDIUM |
| The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipient, with any subject and body | |||||
| CVE-2022-24896 | 1 Enalean | 1 Tuleap | 2022-06-15 | 4.0 MEDIUM | 4.3 MEDIUM |
| Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retrieve the name of a tracker they cannot access as well as the name of the fields used in reports. | |||||
| CVE-2020-13523 | 1 Softperfect | 1 Ram Disk | 2022-06-07 | 2.1 LOW | 3.3 LOW |
| An exploitable information disclosure vulnerability exists in SoftPerfect’s RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet (IRP) can cause the disclosure of sensitive information. An attacker can send a malicious IRP to trigger this vulnerability. | |||||
| CVE-2019-14822 | 4 Canonical, Ibus Project, Oracle and 1 more | 4 Ubuntu Linux, Ibus, Zfs Storage Appliance Kit and 1 more | 2022-06-07 | 3.6 LOW | 7.1 HIGH |
| A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is using the graphical interface, change the input method engine, or modify other input related configurations of the victim user. | |||||
| CVE-2018-4059 | 1 Coturn Project | 1 Coturn | 2022-06-07 | 10.0 HIGH | 9.8 CRITICAL |
| An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN server runs an unauthenticated telnet admin portal on the loopback interface. This can provide administrator access to the TURN server configuration, which can lead to additional attacks. An attacker who can get access to the telnet port can gain administrator access to the TURN server. | |||||
| CVE-2020-4926 | 2 Ibm, Linux | 3 Elastic Storage System, Spectrum Scale, Linux Kernel | 2022-06-07 | 6.4 MEDIUM | 9.1 CRITICAL |
| A vulnerability in the Spectrum Scale 5.1 core component and IBM Elastic Storage System 6.1 could allow unauthorized access to user data or injection of arbitrary data in the communication protocol. IBM X-Force ID: 191600. | |||||
| CVE-2019-18610 | 2 Debian, Digium | 3 Debian Linux, Asterisk, Certified Asterisk | 2022-06-03 | 9.0 HIGH | 8.8 HIGH |
| An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands. | |||||
| CVE-2021-42848 | 1 Lenovo | 10 A1, A1 Firmware, T1 and 7 more | 2022-06-01 | 5.0 MEDIUM | 5.3 MEDIUM |
| An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to retrieve device and networking details. | |||||
| CVE-2021-23975 | 1 Mozilla | 1 Firefox | 2022-05-27 | 4.3 MEDIUM | 6.5 MEDIUM |
| The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes. When this function was invoked we incorrectly called the sizeof function, instead of using the API method that checks for invalid pointers. This vulnerability affects Firefox < 86. | |||||
| CVE-2021-39738 | 1 Google | 1 Android | 2022-05-17 | 7.2 HIGH | 7.8 HIGH |
| In CarSetings, there is a possible to pair BT device bypassing user's consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-216190509 | |||||