Total
193415 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-44228 | 11 Apache, Bentley, Cisco and 8 more | 156 Log4j, Synchro, Synchro 4d and 153 more | 2022-08-17 | 9.3 HIGH | 10.0 CRITICAL |
| Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | |||||
| CVE-2022-0996 | 2 Fedoraproject, Redhat | 3 Fedora, 389 Directory Server, Enterprise Linux | 2022-08-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication. | |||||
| CVE-2022-22455 | 2022-08-17 | N/A | N/A | ||
| IBM Security Verify Governance Identity Manager 10.0 virtual appliance component performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. IBM X-Force ID: 224989. | |||||
| CVE-2022-35821 | 1 Microsoft | 1 Azure Sphere | 2022-08-17 | N/A | 4.4 MEDIUM |
| Azure Sphere Information Disclosure Vulnerability. | |||||
| CVE-2022-36272 | 1 Mingsoft | 1 Mcms | 2022-08-17 | N/A | 9.8 CRITICAL |
| Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter. | |||||
| CVE-2022-36191 | 2022-08-17 | N/A | N/A | ||
| A heap-buffer-overflow had occurred in function gf_isom_dovi_config_get of isomedia/avc_ext.c:2490, as demonstrated by MP4Box. This vulnerability was fixed in commit fef6242. | |||||
| CVE-2022-38194 | 1 Esri | 1 Portal For Arcgis | 2022-08-17 | N/A | 5.5 MEDIUM |
| In Esri Portal for ArcGIS versions 10.8.1, a system property is not properly encrypted. This may lead to a local user reading sensitive information from a properties file. | |||||
| CVE-2022-38193 | 1 Esri | 1 Portal For Arcgis | 2022-08-17 | N/A | 9.6 CRITICAL |
| There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings which could potentially cause arbitrary code execution in a victims browser. | |||||
| CVE-2022-38192 | 1 Esri | 1 Portal For Arcgis | 2022-08-17 | N/A | 5.4 MEDIUM |
| A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser. | |||||
| CVE-2022-36273 | 1 Tenda | 2 Ac9, Ac9 Firmware | 2022-08-17 | N/A | 9.8 CRITICAL |
| Tenda AC9 V15.03.2.21_cn is vulnerable to command injection via goform/SetSysTimeCfg. | |||||
| CVE-2022-34156 | 1 Hjholdings | 1 Hulu | 2022-08-17 | N/A | 4.8 MEDIUM |
| 'Hulu / ????' App for iOS versions prior to 3.0.81 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack. | |||||
| CVE-2022-33939 | 1 Yokogawa | 14 Centum Cs 3000 Cp31, Centum Cs 3000 Cp31 Firmware, Centum Cs 3000 Cp33 and 11 more | 2022-08-17 | N/A | 7.5 HIGH |
| CENTUM VP / CS 3000 controller FCS (CP31, CP33, CP345, CP401, and CP451) contains an issue in processing communication packets, which may lead to resource consumption. If this vulnerability is exploited, an attacker may cause a denial of service (DoS) condition in ADL communication by sending a specially crafted packet to the affected product. | |||||
| CVE-2020-1756 | 1 Moodle | 1 Moodle | 2022-08-17 | N/A | 7.2 HIGH |
| In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, insufficient input escaping was applied to the PHP unit webrunner admin tool. | |||||
| CVE-2020-14379 | 1 Redhat | 1 Jboss A-mq | 2022-08-17 | N/A | 5.6 MEDIUM |
| A flaw was found in Red Hat AMQ Broker in a way that a XEE attack can be done via Broker's configuration files, leading to denial of service and information disclosure. | |||||
| CVE-2022-38149 | 2022-08-17 | N/A | N/A | ||
| HashiCorp Consul Template through 0.29.1 inserts Sensitive Information into a Log File. | |||||
| CVE-2022-36190 | 2022-08-17 | N/A | N/A | ||
| GPAC mp4box 2.1-DEV-revUNKNOWN-master has a use-after-free vulnerability in function gf_isom_dovi_config_get. This vulnerability was fixed in commit fef6242. | |||||
| CVE-2022-36186 | 2022-08-17 | N/A | N/A | ||
| A Null Pointer dereference vulnerability exists in GPAC 2.1-DEV-revUNKNOWN-master via the function gf_filter_pid_set_property_full () at filter_core/filter_pid.c:5250,which causes a Denial of Service (DoS). This vulnerability was fixed in commit b43f9d1. | |||||
| CVE-2022-31262 | 2022-08-17 | N/A | N/A | ||
| An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\GOG.com folder structure and change the GalaxyCommunication service executable to a malicious file, resulting in code execution as SYSTEM. | |||||
| CVE-2022-30262 | 2022-08-17 | N/A | N/A | ||
| The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases, firmware images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks. | |||||
| CVE-2022-2845 | 2022-08-17 | N/A | N/A | ||
| Buffer Over-read in GitHub repository vim/vim prior to 9.0.0217. | |||||