По дате публикации
Эксплуатируемые и новые серьёзные CVE: март 2022 г.
123 записей · 16 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 1 из 2
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
60На этой неделе | CVE-2021-4039Proof of concept | A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS comzyxel · nwa1100-nh firmware · CWE-78 | Критическая9,8 | — | 71,0 % | 1 мар. 2022 г. |
30Наблюдать | CVE-2021-46387Proof of concept | ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS).zyxel · zywall 2 plus internet security appliance firmware · CWE-79 | Средняя6,1 | — | 20,9 % | 1 мар. 2022 г. |
61На этой неделе | CVE-2021-41282Готовый эксплойт | diag_routes.php in pfSense 2.5.2 allows sed data injection.pfsense · pfsense · CWE-74 | Высокая8,8 | — | 87,1 % | 1 мар. 2022 г. |
64На этой неделе | CVE-2022-0824Готовый эксплойт | Improper Access Control to Remote Code Execution in webmin/webminwebmin · webmin · CWE-284 | Высокая8,8 | — | 96,9 % | 2 мар. 2022 г. |
25Наблюдать | CVE-2022-23779Proof of concept | Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone.zohocorp · manageengine desktop central · CWE-200 | Средняя5,3 | — | 13,2 % | 2 мар. 2022 г. |
48В плане | CVE-2022-0819Эксплойта нет | Code Injection in dolibarr/dolibarrdolibarr · dolibarr erp\/crm · CWE-94 | Высокая8,8 | — | 42,6 % | 2 мар. 2022 г. |
35Наблюдать | CVE-2022-0711Эксплойта нет | A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header.haproxy · haproxy · CWE-835 | Высокая7,5 | — | 16,5 % | 2 мар. 2022 г. |
32Наблюдать | CVE-2021-3654Proof of concept | A vulnerability was found in openstack-nova's console proxy, noVNC.openstack · nova · CWE-601 | Средняя6,1 | — | 26,7 % | 2 мар. 2022 г. |
49В плане | CVE-2022-22909Proof of concept | HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a craftdigitaldruid · hoteldruid · CWE-94 | Высокая8,8 | — | 45,4 % | 2 мар. 2022 г. |
45В плане | CVE-2022-25089Proof of concept | Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITaskskofax · printix · CWE-269 | Критическая9,8 | — | 18,3 % | 2 мар. 2022 г. |
38Наблюдать | CVE-2022-23648Proof of concept | Insecure handling of image volumes in containerd CRI pluginlinuxfoundation · containerd · CWE-200 | Высокая7,5 | — | 27,3 % | 3 мар. 2022 г. |
61На этой неделе | CVE-2022-22706Готовый эксплойт | Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages.arm · bifrost gpu kernel driver · CWE-119 | Высокая7,8 | KEV | 1,0 % | 3 мар. 2022 г. |
63На этой неделе | CVE-2022-0492Готовый эксплойт | A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function.linux · linux kernel · CWE-287 | Высокая7,8 | KEV | 5,5 % | 3 мар. 2022 г. |
99Срочно | CVE-2022-22947Готовый эксплойт | In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuatvmware · spring cloud gateway · CWE-94 | Критическая10,0 | KEV | 98,2 % | 3 мар. 2022 г. |
50В плане | CVE-2022-0848Proof of concept | OS Command Injection in part-db/part-dbpart-db project · part-db · CWE-78 | Критическая9,8 | — | 35,4 % | 4 мар. 2022 г. |
44В плане | CVE-2021-46393Эксплойта нет | There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN.tenda · ax3 firmware · CWE-787 | Критическая9,8 | — | 15,9 % | 4 мар. 2022 г. |
41В плане | CVE-2022-0832Эксплойта нет | Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore · pimcore · CWE-79 | Средняя5,4 | — | 66,6 % | 4 мар. 2022 г. |
40В плане | CVE-2021-46378Proof of concept | DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration downlodlink · dir-850l firmware · CWE-425 | Высокая7,5 | — | 31,8 % | 4 мар. 2022 г. |
29Наблюдать | CVE-2021-46379Proof of concept | DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrusted site.dlink · dir-850l firmware · CWE-601 | Средняя6,1 | — | 15,7 % | 4 мар. 2022 г. |
48В плане | CVE-2021-46381Proof of concept | Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow].dlink · dap-1620 firmware · CWE-22 | Высокая7,5 | — | 58,8 % | 4 мар. 2022 г. |
92Срочно | CVE-2022-26318Готовый эксплойт | On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786.watchguard · fireware | Критическая9,8 | KEV | 78,1 % | 4 мар. 2022 г. |
51В плане | CVE-2021-44827Proof of concept | There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n devices vie the X_TP_Exttp-link · archer c20i firmware · CWE-78 | Высокая8,8 | — | 53,9 % | 4 мар. 2022 г. |
34Наблюдать | CVE-2021-3737Эксплойта нет | A flaw was found in python.python · python · CWE-835 | Высокая7,5 | — | 13,1 % | 4 мар. 2022 г. |
46В плане | CVE-2021-46704Proof of concept | In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ugenieacs · genieacs · CWE-78 | Критическая9,8 | — | 21,9 % | 6 мар. 2022 г. |
49В плане | CVE-2022-0349Proof of concept | NotificationX < 2.3.9 - Unauthenticated Blind SQL Injectionwpdeveloper · notificationx · CWE-89 | Критическая9,8 | — | 34,3 % | 7 мар. 2022 г. |
43В плане | CVE-2022-0434Proof of concept | Page Views Count < 2.4.15 - Unauthenticated SQL Injectiona3rev · page view count · CWE-89 | Критическая9,8 | — | 14,7 % | 7 мар. 2022 г. |
65На этой неделе | CVE-2022-0441Готовый эксплойт | MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creationstylemixthemes · masterstudy lms · CWE-269 | Критическая9,8 | — | 85,3 % | 7 мар. 2022 г. |
34Наблюдать | CVE-2022-24713Proof of concept | Regular expression denial of service in Rust's regex craterust-lang · regex · CWE-400 | Высокая7,5 | — | 14,4 % | 8 мар. 2022 г. |
39Наблюдать | CVE-2022-24715Proof of concept | Arbitrary code execution for authenticated users in Icinga Web 2icinga · icinga web 2 · CWE-22 | Высокая8,8 | — | 14,6 % | 8 мар. 2022 г. |
60На этой неделе | CVE-2022-24716Готовый эксплойт | Path traversal in Icinga Web 2icinga · icinga web 2 · CWE-22 | Высокая7,5 | — | 89,3 % | 8 мар. 2022 г. |
49В плане | CVE-2022-0482Proof of concept | Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointmentseasyappointments · easyappointments · CWE-359 | Критическая9,1 | — | 43,7 % | 9 мар. 2022 г. |
41В плане | CVE-2022-21990Эксплойта нет | Remote Desktop Client Remote Code Execution Vulnerabilitymicrosoft · windows 10 | Высокая8,8 | — | 18,8 % | 9 мар. 2022 г. |
43В плане | CVE-2022-23253Proof of concept | Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerabilitymicrosoft · windows 10 | Средняя6,5 | — | 56,3 % | 9 мар. 2022 г. |
47В плане | CVE-2022-23277Готовый эксплойт | Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange server | Высокая8,8 | — | 41,1 % | 9 мар. 2022 г. |
43В плане | CVE-2022-23285Эксплойта нет | Remote Desktop Client Remote Code Execution Vulnerabilitymicrosoft · windows 10 | Высокая8,8 | — | 25,6 % | 9 мар. 2022 г. |
36Наблюдать | CVE-2022-24463Эксплойта нет | Microsoft Exchange Server Spoofing Vulnerabilitymicrosoft · exchange server | Средняя6,5 | — | 31,7 % | 9 мар. 2022 г. |
27Наблюдать | CVE-2022-24502Эксплойта нет | Windows HTML Platforms Security Feature Bypass Vulnerabilitymicrosoft · windows 10 | Средняя4,3 | — | 33,0 % | 9 мар. 2022 г. |
43В плане | CVE-2022-22805Эксплойта нет | A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code executioschneider-electric · smt series 1015 ups firmware · CWE-120 | Критическая9,8 | — | 11,8 % | 9 мар. 2022 г. |
43В плане | CVE-2022-22806Эксплойта нет | A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malschneider-electric · smt series 1015 ups firmware · CWE-294 | Критическая9,8 | — | 12,4 % | 9 мар. 2022 г. |
51В плане | CVE-2022-24734Готовый эксплойт | Remote code execution in mybbmybb · mybb · CWE-94 | Высокая7,2 | — | 77,8 % | 9 мар. 2022 г. |
61На этой неделе | CVE-2021-4045Proof of concept | TP-LINK Tapo C200 remote code execution vulnerabilitytp-link · tapo c200 firmware · CWE-77 | Критическая9,8 | — | 72,3 % | 10 мар. 2022 г. |
89Срочно | CVE-2022-0847Готовый эксплойт | A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe linux · linux kernel · CWE-665 | Высокая7,8 | KEV | 92,7 % | 10 мар. 2022 г. |
30Наблюдать | CVE-2022-22835Эксплойта нет | An issue was discovered in OverIT Geocall before version 8.0.overit · geocall · CWE-611 | Средняя6,5 | — | 14,5 % | 10 мар. 2022 г. |
51В плане | CVE-2022-23940Proof of concept | SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution.salesagility · suitecrm · CWE-502 | Высокая8,8 | — | 53,2 % | 10 мар. 2022 г. |
43В плане | CVE-2022-24995Эксплойта нет | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetSysTime.tenda · ax3 firmware · CWE-787 | Критическая9,8 | — | 13,5 % | 10 мар. 2022 г. |
35Наблюдать | CVE-2022-25090Proof of concept | Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions, leadingkofax · printix · CWE-362 | Высокая8,1 | — | 11,1 % | 10 мар. 2022 г. |
34Наблюдать | CVE-2022-25546Эксплойта нет | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS.tenda · ax1806 firmware · CWE-787 | Высокая7,5 | — | 12,2 % | 10 мар. 2022 г. |
95Срочно | CVE-2022-26143Готовый эксплойт | The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers tomitel · micollab · CWE-306 | Критическая9,8 | KEV | 87,3 % | 10 мар. 2022 г. |
30Наблюдать | CVE-2018-25031Proof of concept | Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks.smartbear · swagger ui · CWE-20 | Средняя4,3 | — | 42,3 % | 11 мар. 2022 г. |
34Наблюдать | CVE-2022-25216Proof of concept | An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user accountdvdfab · 12 player · CWE-22 | Высокая7,5 | — | 13,4 % | 11 мар. 2022 г. |
55В плане | CVE-2022-24760Proof of concept | Command Injection in Parse serverparseplatform · parse-server · CWE-74 | Критическая10,0 | — | 49,0 % | 11 мар. 2022 г. |
51В плане | CVE-2022-22719Эксплойта нет | mod_lua Use of uninitialized value of in r:parsebodyapache · http server · CWE-665 | Высокая7,5 | — | 69,0 % | 14 мар. 2022 г. |
47В плане | CVE-2022-22720Proof of concept | HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlierapache · http server · CWE-444 | Критическая9,8 | — | 28,1 % | 14 мар. 2022 г. |
49В плане | CVE-2022-22721Эксплойта нет | core: Possible buffer overflow with very large or unlimited LimitXMLRequestBodyapache · http server · CWE-190 | Критическая9,1 | — | 41,7 % | 14 мар. 2022 г. |
54В плане | CVE-2022-23943Эксплойта нет | mod_sed: Read/write beyond boundsapache · http server · CWE-190 | Критическая9,8 | — | 50,4 % | 14 мар. 2022 г. |
56В плане | CVE-2021-25003Proof of concept | WPCargo < 6.9.0 - Unauthenticated RCEwptaskforce · wpcargo track \& trace · CWE-94 | Критическая9,8 | — | 56,1 % | 14 мар. 2022 г. |
61На этой неделе | CVE-2022-0169Готовый эксплойт | Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL Injection10web · photo gallery · CWE-89 | Критическая9,8 | — | 74,6 % | 14 мар. 2022 г. |
56В плане | CVE-2021-45010Proof of concept | A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attacprasathmani · tiny file manager · CWE-22 | Высокая8,8 | — | 70,0 % | 15 мар. 2022 г. |
55В плане | CVE-2022-25487Proof of concept | Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php.thedigitalcraft · atomcms · CWE-434 | Критическая9,8 | — | 53,8 % | 15 мар. 2022 г. |
52В плане | CVE-2022-0778Proof of concept | Infinite loop in BN_mod_sqrt() reachable when parsing certificatesopenssl · openssl · CWE-835 | Высокая7,5 | — | 73,1 % | 15 мар. 2022 г. |
47В плане | CVE-2022-26213Эксплойта нет | Totolink X5000R_Firmware v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via ttotolink · x5000r firmware · CWE-78 | Критическая9,8 | — | 25,5 % | 15 мар. 2022 г. |
61На этой неделе | CVE-2021-39793Готовый эксплойт | In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the code.google · android · CWE-787 | Высокая7,8 | KEV | 0,6 % | 16 мар. 2022 г. |
37Наблюдать | CVE-2021-41987Эксплойта нет | In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code mikrotik · routeros · CWE-787 | Высокая8,1 | — | 16,2 % | 16 мар. 2022 г. |
41В плане | CVE-2022-0811Proof of concept | A flaw was found in CRI-O in the way it set kernel options for a pod.kubernetes · cri-o · CWE-94 | Высокая8,8 | — | 19,0 % | 16 мар. 2022 г. |
27Наблюдать | CVE-2021-44261Эксплойта нет | A vulnerability is in the 'BRS_top.html' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access thinetgear · wac104 firmware · CWE-306 | Средняя5,3 | — | 20,3 % | 17 мар. 2022 г. |
67На этой неделе | CVE-2022-26500Готовый эксплойт | Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to inteveeam · veeam backup \& replication · CWE-22 | Высокая8,8 | KEV | 5,8 % | 17 мар. 2022 г. |
70На этой неделе | CVE-2022-26501Готовый эксплойт | Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).veeam · veeam backup \& replication · CWE-306 | Критическая9,8 | KEV | 4,1 % | 17 мар. 2022 г. |
45В плане | CVE-2021-45967Proof of concept | An issue was discovered in Pascom Cloud Phone System before 7.20.x.pascom · cloud phone system · CWE-22 | Критическая9,8 | — | 20,8 % | 18 мар. 2022 г. |
33Наблюдать | CVE-2021-45968Proof of concept | An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.2pascom · cloud phone system · CWE-918 | Высокая7,5 | — | 10,3 % | 18 мар. 2022 г. |
39Наблюдать | CVE-2022-26965Proof of concept | In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.pluck-cms · pluck · CWE-434 | Высокая7,2 | — | 36,2 % | 18 мар. 2022 г. |
69На этой неделе | CVE-2022-24637Готовый эксплойт | Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gopenwebanalytics · open web analytics · CWE-269 | Критическая9,8 | — | 99,0 % | 18 мар. 2022 г. |
41В плане | CVE-2020-25176Эксплойта нет | Rockwell Automation ISaGRAF5 Runtime Relative Path Traversalschneider-electric · easergy t300 firmware · CWE-23 | Критическая9,8 | — | 6,4 % | 18 мар. 2022 г. |
72На этой неделе | CVE-2022-22587Готовый эксплойт | A memory corruption issue was addressed with improved input validation.apple · ipados · CWE-787 | Критическая9,8 | KEV | 11,6 % | 18 мар. 2022 г. |
70На этой неделе | CVE-2022-22620Готовый эксплойт | A use after free issue was addressed with improved memory management.apple · safari · CWE-416 | Высокая8,8 | KEV | 16,3 % | 18 мар. 2022 г. |
42В плане | CVE-2022-25450Эксплойта нет | Tenda AC6 V15.03.05.09_multi was discovered to contain a stack overflow via the list parameter in the SetVirtualServerCfg function.tenda · ac6 firmware · CWE-787 | Критическая9,8 | — | 11,5 % | 18 мар. 2022 г. |
48В плане | CVE-2022-26265Proof of concept | Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.contao · contao · CWE-78 | Критическая9,8 | — | 30,3 % | 18 мар. 2022 г. |
45В плане | CVE-2022-27226Proof of concept | A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administirz · ru21 firmware · CWE-352 | Высокая8,8 | — | 33,7 % | 19 мар. 2022 г. |
55В плане | CVE-2022-0415Proof of concept | Remote Command Execution in uploading repository file in gogs/gogsgogs · gogs · CWE-20 | Высокая8,8 | — | 65,9 % | 21 мар. 2022 г. |
51В плане | CVE-2022-26960Proof of concept | connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal.std42 · elfinder · CWE-22 | Критическая9,1 | — | 50,9 % | 21 мар. 2022 г. |
43В плане | CVE-2022-24237Эксплойта нет | The snaptPowered2 component of Snapt Aria v12.8 was discovered to contain a command injection vulnerability.snapt · aria · CWE-78 | Высокая8,8 | — | 25,3 % | 21 мар. 2022 г. |
45В плане | CVE-2022-25766Эксплойта нет | Remote Code Execution (RCE)ungit project · ungit · CWE-88 | Высокая8,8 | — | 34,5 % | 21 мар. 2022 г. |
42В плане | CVE-2022-0364Эксплойта нет | Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site Scriptingwebnus · modern events calendar lite · CWE-79 | Средняя5,4 | — | 69,5 % | 21 мар. 2022 г. |
42В плане | CVE-2022-0591Proof of concept | Formcraft3 < 3.8.28 - Unauthenticated SSRFsubtlewebinc · formcraft3 · CWE-918 | Критическая9,1 | — | 20,2 % | 21 мар. 2022 г. |
60На этой неделе | CVE-2022-0739Готовый эксплойт | BookingPress < 1.0.11 - Unauthenticated SQL Injectionreputeinfosystems · bookingpress · CWE-89 | Критическая9,8 | — | 37,4 % | 21 мар. 2022 г. |
43В плане | CVE-2022-0747Proof of concept | Infographic Maker - iList < 4.3.8 - Unauthenticated SQL Injectionquantumcloud · infographic maker · CWE-89 | Критическая9,8 | — | 14,8 % | 21 мар. 2022 г. |
42В плане | CVE-2022-0760Proof of concept | Simple Link Directory < 7.7.2 - Unauthenticated SQL injectionquantumcloud · simple link directory · CWE-89 | Критическая9,8 | — | 10,8 % | 21 мар. 2022 г. |
34Наблюдать | CVE-2022-23347Proof of concept | BigAnt Software BigAnt Server v5.6.06 was discovered to be vulnerable to directory traversal attacks.bigantsoft · bigant server · CWE-22 | Высокая7,5 | — | 13,4 % | 21 мар. 2022 г. |
55В плане | CVE-2022-26148Proof of concept | An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix.grafana · grafana · CWE-312 | Критическая9,8 | — | 52,5 % | 21 мар. 2022 г. |
45В плане | CVE-2022-27228Proof of concept | In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary codebitrix24 · bitrix24 · CWE-20 | Критическая9,8 | — | 20,7 % | 22 мар. 2022 г. |
45В плане | CVE-2022-26187Эксплойта нет | TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.totolink · n600r firmware · CWE-77 | Критическая9,8 | — | 19,5 % | 22 мар. 2022 г. |
51В плане | CVE-2022-0888Эксплойта нет | Ninja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File Uploadninjaforms · ninja forms file uploads · CWE-434 | Критическая9,8 | — | 39,3 % | 23 мар. 2022 г. |
42В плане | CVE-2022-22951Эксплойта нет | VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS vmware · carbon black app control · CWE-78 | Критическая9,1 | — | 20,3 % | 23 мар. 2022 г. |
56В плане | CVE-2022-23881Proof of concept | ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.zzzcms · zzzphp | Критическая9,8 | — | 56,5 % | 23 мар. 2022 г. |
45В плане | CVE-2022-24934Proof of concept | wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER in the registry.wps · wps office | Критическая9,8 | — | 20,4 % | 23 мар. 2022 г. |
40В плане | CVE-2022-1058Proof of concept | Open Redirect on login in go-gitea/giteagitea · gitea · CWE-601 | Средняя6,1 | — | 53,1 % | 24 мар. 2022 г. |
30Наблюдать | CVE-2022-21820Эксплойта нет | NVIDIA DCGM contains a vulnerability in nvhostengine, where a network user can cause detection of error conditions without action, which maynvidia · data center gpu manager · CWE-20 | Средняя6,3 | — | 16,5 % | 24 мар. 2022 г. |
46В плане | CVE-2022-26272Эксплойта нет | A remote code execution (RCE) vulnerability in Ionize v1.0.8.1 allows attackers to execute arbitrary code via a crafted string written to thionizecms · ionize | Критическая9,8 | — | 22,4 % | 24 мар. 2022 г. |
99Срочно | CVE-2022-1040Готовый эксплойт | An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version vsophos · sfos | Критическая9,8 | KEV | 99,7 % | 25 мар. 2022 г. |
46В плане | CVE-2018-25032Proof of concept | zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.zlib · zlib · CWE-787 | Высокая7,5 | — | 51,7 % | 25 мар. 2022 г. |
37Наблюдать | CVE-2022-26263Proof of concept | Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/WebHelp.yonyou · u8\+ · CWE-79 | Средняя6,1 | — | 41,7 % | 25 мар. 2022 г. |
- CVE-2021-403960На этой неделе
A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS com
КритическаяCVSS 9,8Proof of conceptEPSS 71 %zyxel · nwa1100-nh firmware1 мар. 2022 г.
- CVE-2021-4638730Наблюдать
ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS).
СредняяCVSS 6,1Proof of conceptEPSS 20 %zyxel · zywall 2 plus internet security appliance firmware1 мар. 2022 г.
- CVE-2021-4128261На этой неделе
diag_routes.php in pfSense 2.5.2 allows sed data injection.
ВысокаяCVSS 8,8Готовый эксплойтEPSS 87 %pfsense · pfsense1 мар. 2022 г.
- CVE-2022-082464На этой неделе
Improper Access Control to Remote Code Execution in webmin/webmin
ВысокаяCVSS 8,8Готовый эксплойтEPSS 96 %webmin · webmin2 мар. 2022 г.
- CVE-2022-2377925Наблюдать
Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone.
СредняяCVSS 5,3Proof of conceptEPSS 13 %zohocorp · manageengine desktop central2 мар. 2022 г.
- CVE-2022-081948В плане
Code Injection in dolibarr/dolibarr
ВысокаяCVSS 8,8Эксплойта нетEPSS 42 %dolibarr · dolibarr erp\/crm2 мар. 2022 г.
- CVE-2022-071135Наблюдать
A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header.
ВысокаяCVSS 7,5Эксплойта нетEPSS 16 %haproxy · haproxy2 мар. 2022 г.
- CVE-2021-365432Наблюдать
A vulnerability was found in openstack-nova's console proxy, noVNC.
СредняяCVSS 6,1Proof of conceptEPSS 26 %openstack · nova2 мар. 2022 г.
- CVE-2022-2290949В плане
HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a craft
ВысокаяCVSS 8,8Proof of conceptEPSS 45 %digitaldruid · hoteldruid2 мар. 2022 г.
- CVE-2022-2508945В плане
Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks
КритическаяCVSS 9,8Proof of conceptEPSS 18 %kofax · printix2 мар. 2022 г.
- CVE-2022-2364838Наблюдать
Insecure handling of image volumes in containerd CRI plugin
ВысокаяCVSS 7,5Proof of conceptEPSS 27 %linuxfoundation · containerd3 мар. 2022 г.
- CVE-2022-2270661На этой неделе
Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages.
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 1 %arm · bifrost gpu kernel driver3 мар. 2022 г.
- CVE-2022-049263На этой неделе
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function.
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 5 %linux · linux kernel3 мар. 2022 г.
- CVE-2022-2294799Срочно
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuat
КритическаяCVSS 10,0KEVГотовый эксплойтEPSS 98 %vmware · spring cloud gateway3 мар. 2022 г.
- CVE-2022-084850В плане
OS Command Injection in part-db/part-db
КритическаяCVSS 9,8Proof of conceptEPSS 35 %part-db project · part-db4 мар. 2022 г.
- CVE-2021-4639344В плане
There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN.
КритическаяCVSS 9,8Эксплойта нетEPSS 15 %tenda · ax3 firmware4 мар. 2022 г.
- CVE-2022-083241В плане
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
СредняяCVSS 5,4Эксплойта нетEPSS 66 %pimcore · pimcore4 мар. 2022 г.
- CVE-2021-4637840В плане
DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration downlo
ВысокаяCVSS 7,5Proof of conceptEPSS 31 %dlink · dir-850l firmware4 мар. 2022 г.
- CVE-2021-4637929Наблюдать
DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrusted site.
СредняяCVSS 6,1Proof of conceptEPSS 15 %dlink · dir-850l firmware4 мар. 2022 г.
- CVE-2021-4638148В плане
Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow].
ВысокаяCVSS 7,5Proof of conceptEPSS 58 %dlink · dap-1620 firmware4 мар. 2022 г.
- CVE-2022-2631892Срочно
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786.
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 78 %watchguard · fireware4 мар. 2022 г.
- CVE-2021-4482751В плане
There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n devices vie the X_TP_Ext
ВысокаяCVSS 8,8Proof of conceptEPSS 53 %tp-link · archer c20i firmware4 мар. 2022 г.
- CVE-2021-373734Наблюдать
A flaw was found in python.
ВысокаяCVSS 7,5Эксплойта нетEPSS 13 %python · python4 мар. 2022 г.
- CVE-2021-4670446В плане
In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/u
КритическаяCVSS 9,8Proof of conceptEPSS 21 %genieacs · genieacs6 мар. 2022 г.
- CVE-2022-034949В плане
NotificationX < 2.3.9 - Unauthenticated Blind SQL Injection
КритическаяCVSS 9,8Proof of conceptEPSS 34 %wpdeveloper · notificationx7 мар. 2022 г.
- CVE-2022-043443В плане
Page Views Count < 2.4.15 - Unauthenticated SQL Injection
КритическаяCVSS 9,8Proof of conceptEPSS 14 %a3rev · page view count7 мар. 2022 г.
- CVE-2022-044165На этой неделе
MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation
КритическаяCVSS 9,8Готовый эксплойтEPSS 85 %stylemixthemes · masterstudy lms7 мар. 2022 г.
- CVE-2022-2471334Наблюдать
Regular expression denial of service in Rust's regex crate
ВысокаяCVSS 7,5Proof of conceptEPSS 14 %rust-lang · regex8 мар. 2022 г.
- CVE-2022-2471539Наблюдать
Arbitrary code execution for authenticated users in Icinga Web 2
ВысокаяCVSS 8,8Proof of conceptEPSS 14 %icinga · icinga web 28 мар. 2022 г.
- CVE-2022-2471660На этой неделе
Path traversal in Icinga Web 2
ВысокаяCVSS 7,5Готовый эксплойтEPSS 89 %icinga · icinga web 28 мар. 2022 г.
- CVE-2022-048249В плане
Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments
КритическаяCVSS 9,1Proof of conceptEPSS 43 %easyappointments · easyappointments9 мар. 2022 г.
- CVE-2022-2199041В плане
Remote Desktop Client Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Эксплойта нетEPSS 18 %microsoft · windows 109 мар. 2022 г.
- CVE-2022-2325343В плане
Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability
СредняяCVSS 6,5Proof of conceptEPSS 56 %microsoft · windows 109 мар. 2022 г.
- CVE-2022-2327747В плане
Microsoft Exchange Server Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Готовый эксплойтEPSS 41 %microsoft · exchange server9 мар. 2022 г.
- CVE-2022-2328543В плане
Remote Desktop Client Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Эксплойта нетEPSS 25 %microsoft · windows 109 мар. 2022 г.
- CVE-2022-2446336Наблюдать
Microsoft Exchange Server Spoofing Vulnerability
СредняяCVSS 6,5Эксплойта нетEPSS 31 %microsoft · exchange server9 мар. 2022 г.
- CVE-2022-2450227Наблюдать
Windows HTML Platforms Security Feature Bypass Vulnerability
СредняяCVSS 4,3Эксплойта нетEPSS 33 %microsoft · windows 109 мар. 2022 г.
- CVE-2022-2280543В плане
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code executio
КритическаяCVSS 9,8Эксплойта нетEPSS 11 %schneider-electric · smt series 1015 ups firmware9 мар. 2022 г.
- CVE-2022-2280643В плане
A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a mal
КритическаяCVSS 9,8Эксплойта нетEPSS 12 %schneider-electric · smt series 1015 ups firmware9 мар. 2022 г.
- CVE-2022-2473451В плане
Remote code execution in mybb
ВысокаяCVSS 7,2Готовый эксплойтEPSS 77 %mybb · mybb9 мар. 2022 г.
- CVE-2021-404561На этой неделе
TP-LINK Tapo C200 remote code execution vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 72 %tp-link · tapo c200 firmware10 мар. 2022 г.
- CVE-2022-084789Срочно
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 92 %linux · linux kernel10 мар. 2022 г.
- CVE-2022-2283530Наблюдать
An issue was discovered in OverIT Geocall before version 8.0.
СредняяCVSS 6,5Эксплойта нетEPSS 14 %overit · geocall10 мар. 2022 г.
- CVE-2022-2394051В плане
SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution.
ВысокаяCVSS 8,8Proof of conceptEPSS 53 %salesagility · suitecrm10 мар. 2022 г.
- CVE-2022-2499543В плане
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetSysTime.
КритическаяCVSS 9,8Эксплойта нетEPSS 13 %tenda · ax3 firmware10 мар. 2022 г.
- CVE-2022-2509035Наблюдать
Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions, leading
ВысокаяCVSS 8,1Proof of conceptEPSS 11 %kofax · printix10 мар. 2022 г.
- CVE-2022-2554634Наблюдать
Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS.
ВысокаяCVSS 7,5Эксплойта нетEPSS 12 %tenda · ax1806 firmware10 мар. 2022 г.
- CVE-2022-2614395Срочно
The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 87 %mitel · micollab10 мар. 2022 г.
- CVE-2018-2503130Наблюдать
Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks.
СредняяCVSS 4,3Proof of conceptEPSS 42 %smartbear · swagger ui11 мар. 2022 г.
- CVE-2022-2521634Наблюдать
An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account
ВысокаяCVSS 7,5Proof of conceptEPSS 13 %dvdfab · 12 player11 мар. 2022 г.
- CVE-2022-2476055В плане
Command Injection in Parse server
КритическаяCVSS 10,0Proof of conceptEPSS 49 %parseplatform · parse-server11 мар. 2022 г.
- CVE-2022-2271951В плане
mod_lua Use of uninitialized value of in r:parsebody
ВысокаяCVSS 7,5Эксплойта нетEPSS 69 %apache · http server14 мар. 2022 г.
- CVE-2022-2272047В плане
HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier
КритическаяCVSS 9,8Proof of conceptEPSS 28 %apache · http server14 мар. 2022 г.
- CVE-2022-2272149В плане
core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody
КритическаяCVSS 9,1Эксплойта нетEPSS 41 %apache · http server14 мар. 2022 г.
- CVE-2022-2394354В плане
mod_sed: Read/write beyond bounds
КритическаяCVSS 9,8Эксплойта нетEPSS 50 %apache · http server14 мар. 2022 г.
- CVE-2021-2500356В плане
WPCargo < 6.9.0 - Unauthenticated RCE
КритическаяCVSS 9,8Proof of conceptEPSS 56 %wptaskforce · wpcargo track \& trace14 мар. 2022 г.
- CVE-2022-016961На этой неделе
Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL Injection
КритическаяCVSS 9,8Готовый эксплойтEPSS 74 %10web · photo gallery14 мар. 2022 г.
- CVE-2021-4501056В плане
A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attac
ВысокаяCVSS 8,8Proof of conceptEPSS 70 %prasathmani · tiny file manager15 мар. 2022 г.
- CVE-2022-2548755В плане
Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php.
КритическаяCVSS 9,8Proof of conceptEPSS 53 %thedigitalcraft · atomcms15 мар. 2022 г.
- CVE-2022-077852В плане
Infinite loop in BN_mod_sqrt() reachable when parsing certificates
ВысокаяCVSS 7,5Proof of conceptEPSS 73 %openssl · openssl15 мар. 2022 г.
- CVE-2022-2621347В плане
Totolink X5000R_Firmware v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via t
КритическаяCVSS 9,8Эксплойта нетEPSS 25 %totolink · x5000r firmware15 мар. 2022 г.
- CVE-2021-3979361На этой неделе
In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the code.
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 0 %google · android16 мар. 2022 г.
- CVE-2021-4198737Наблюдать
In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code
ВысокаяCVSS 8,1Эксплойта нетEPSS 16 %mikrotik · routeros16 мар. 2022 г.
- CVE-2022-081141В плане
A flaw was found in CRI-O in the way it set kernel options for a pod.
ВысокаяCVSS 8,8Proof of conceptEPSS 19 %kubernetes · cri-o16 мар. 2022 г.
- CVE-2021-4426127Наблюдать
A vulnerability is in the 'BRS_top.html' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access thi
СредняяCVSS 5,3Эксплойта нетEPSS 20 %netgear · wac104 firmware17 мар. 2022 г.
- CVE-2022-2650067На этой неделе
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to inte
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 5 %veeam · veeam backup \& replication17 мар. 2022 г.
- CVE-2022-2650170На этой неделе
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 4 %veeam · veeam backup \& replication17 мар. 2022 г.
- CVE-2021-4596745В плане
An issue was discovered in Pascom Cloud Phone System before 7.20.x.
КритическаяCVSS 9,8Proof of conceptEPSS 20 %pascom · cloud phone system18 мар. 2022 г.
- CVE-2021-4596833Наблюдать
An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.2
ВысокаяCVSS 7,5Proof of conceptEPSS 10 %pascom · cloud phone system18 мар. 2022 г.
- CVE-2022-2696539Наблюдать
In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.
ВысокаяCVSS 7,2Proof of conceptEPSS 36 %pluck-cms · pluck18 мар. 2022 г.
- CVE-2022-2463769На этой неделе
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to g
КритическаяCVSS 9,8Готовый эксплойтEPSS 99 %openwebanalytics · open web analytics18 мар. 2022 г.
- CVE-2020-2517641В плане
Rockwell Automation ISaGRAF5 Runtime Relative Path Traversal
КритическаяCVSS 9,8Эксплойта нетEPSS 6 %schneider-electric · easergy t300 firmware18 мар. 2022 г.
- CVE-2022-2258772На этой неделе
A memory corruption issue was addressed with improved input validation.
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 11 %apple · ipados18 мар. 2022 г.
- CVE-2022-2262070На этой неделе
A use after free issue was addressed with improved memory management.
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 16 %apple · safari18 мар. 2022 г.
- CVE-2022-2545042В плане
Tenda AC6 V15.03.05.09_multi was discovered to contain a stack overflow via the list parameter in the SetVirtualServerCfg function.
КритическаяCVSS 9,8Эксплойта нетEPSS 11 %tenda · ac6 firmware18 мар. 2022 г.
- CVE-2022-2626548В плане
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.
КритическаяCVSS 9,8Proof of conceptEPSS 30 %contao · contao18 мар. 2022 г.
- CVE-2022-2722645В плане
A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administ
ВысокаяCVSS 8,8Proof of conceptEPSS 33 %irz · ru21 firmware19 мар. 2022 г.
- CVE-2022-041555В плане
Remote Command Execution in uploading repository file in gogs/gogs
ВысокаяCVSS 8,8Proof of conceptEPSS 65 %gogs · gogs21 мар. 2022 г.
- CVE-2022-2696051В плане
connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal.
КритическаяCVSS 9,1Proof of conceptEPSS 50 %std42 · elfinder21 мар. 2022 г.
- CVE-2022-2423743В плане
The snaptPowered2 component of Snapt Aria v12.8 was discovered to contain a command injection vulnerability.
ВысокаяCVSS 8,8Эксплойта нетEPSS 25 %snapt · aria21 мар. 2022 г.
- CVE-2022-2576645В плане
Remote Code Execution (RCE)
ВысокаяCVSS 8,8Эксплойта нетEPSS 34 %ungit project · ungit21 мар. 2022 г.
- CVE-2022-036442В плане
Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site Scripting
СредняяCVSS 5,4Эксплойта нетEPSS 69 %webnus · modern events calendar lite21 мар. 2022 г.
- CVE-2022-059142В плане
Formcraft3 < 3.8.28 - Unauthenticated SSRF
КритическаяCVSS 9,1Proof of conceptEPSS 20 %subtlewebinc · formcraft321 мар. 2022 г.
- CVE-2022-073960На этой неделе
BookingPress < 1.0.11 - Unauthenticated SQL Injection
КритическаяCVSS 9,8Готовый эксплойтEPSS 37 %reputeinfosystems · bookingpress21 мар. 2022 г.
- CVE-2022-074743В плане
Infographic Maker - iList < 4.3.8 - Unauthenticated SQL Injection
КритическаяCVSS 9,8Proof of conceptEPSS 14 %quantumcloud · infographic maker21 мар. 2022 г.
- CVE-2022-076042В плане
Simple Link Directory < 7.7.2 - Unauthenticated SQL injection
КритическаяCVSS 9,8Proof of conceptEPSS 10 %quantumcloud · simple link directory21 мар. 2022 г.
- CVE-2022-2334734Наблюдать
BigAnt Software BigAnt Server v5.6.06 was discovered to be vulnerable to directory traversal attacks.
ВысокаяCVSS 7,5Proof of conceptEPSS 13 %bigantsoft · bigant server21 мар. 2022 г.
- CVE-2022-2614855В плане
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix.
КритическаяCVSS 9,8Proof of conceptEPSS 52 %grafana · grafana21 мар. 2022 г.
- CVE-2022-2722845В плане
In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code
КритическаяCVSS 9,8Proof of conceptEPSS 20 %bitrix24 · bitrix2422 мар. 2022 г.
- CVE-2022-2618745В плане
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.
КритическаяCVSS 9,8Эксплойта нетEPSS 19 %totolink · n600r firmware22 мар. 2022 г.
- CVE-2022-088851В плане
Ninja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File Upload
КритическаяCVSS 9,8Эксплойта нетEPSS 39 %ninjaforms · ninja forms file uploads23 мар. 2022 г.
- CVE-2022-2295142В плане
VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS
КритическаяCVSS 9,1Эксплойта нетEPSS 20 %vmware · carbon black app control23 мар. 2022 г.
- CVE-2022-2388156В плане
ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.
КритическаяCVSS 9,8Proof of conceptEPSS 56 %zzzcms · zzzphp23 мар. 2022 г.
- CVE-2022-2493445В плане
wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER in the registry.
КритическаяCVSS 9,8Proof of conceptEPSS 20 %wps · wps office23 мар. 2022 г.
- CVE-2022-105840В плане
Open Redirect on login in go-gitea/gitea
СредняяCVSS 6,1Proof of conceptEPSS 53 %gitea · gitea24 мар. 2022 г.
- CVE-2022-2182030Наблюдать
NVIDIA DCGM contains a vulnerability in nvhostengine, where a network user can cause detection of error conditions without action, which may
СредняяCVSS 6,3Эксплойта нетEPSS 16 %nvidia · data center gpu manager24 мар. 2022 г.
- CVE-2022-2627246В плане
A remote code execution (RCE) vulnerability in Ionize v1.0.8.1 allows attackers to execute arbitrary code via a crafted string written to th
КритическаяCVSS 9,8Эксплойта нетEPSS 22 %ionizecms · ionize24 мар. 2022 г.
- CVE-2022-104099Срочно
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %sophos · sfos25 мар. 2022 г.
- CVE-2018-2503246В плане
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
ВысокаяCVSS 7,5Proof of conceptEPSS 51 %zlib · zlib25 мар. 2022 г.
- CVE-2022-2626337Наблюдать
Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/WebHelp.
СредняяCVSS 6,1Proof of conceptEPSS 41 %yonyou · u8\+25 мар. 2022 г.