February 2023 - Page 3 of 19 - Dr. Ware Technology Services

Extend and optimize your customer outreach with custom channels

by Contributed | Feb 23, 2023 | Dynamics 365, Microsoft 365, Technology

This article is contributed. See the original author and article here.

In this fast-paced world, customers expect to be able to interact with brands in ways that extend beyond traditional channels. Brands are constantly competing for the attention of customers who are deluged with messages daily. Text messages and messaging apps like WhatsApp, Viber, and Telegram represent an opportunity to engage your customers where they’re paying attention. Your customers benefit from increased and faster engagement with your brand through a real-time, personalized experienceand you’re more effective in triggering a specific customer action or behavior.

Curious about how you can integrate WhatsApp, Viber, Telegram, and many other channels in your journeys to engage your customers in the moments that matter?

Discover Dynamics 365 Marketing custom channels

With custom channels, Microsoft Dynamics 365 Marketing meets the need for a customizable model that supports any customer outreach and engagement medium marketers may demand. Along with built-in channels like email, text messages, and push notifications, you can now create custom communication channels to use in your journeys. Custom channels provide additional extensibility and personalization capabilities when reaching out to your customers, increasing the efficiency of your communications.

With custom channels you can:

Bring a new communication channel like WhatsApp, Viber, or Telegram to Dynamics 365 Marketing. These channels support a custom message editor and deliverability analytics. Two-way communication and custom interactions will follow in future releases.
Extend the functionality of text messages by connecting to any provider you want. Custom text message channels come with all the features supported by the built-in providers: text message editor with preview, two-way communication, analytics, and interactions.

Screenshot that illustrates creating a custom journey in Microsoft Dynamics 365 Marketing.

By adding a custom channel to Dynamics 365 Marketing, you unfold its true potential and maximize your users’ engagement through:

Creation of personalized messages content for a more individualized experience.
Plugging your custom channels and messages into any customer journey.
Tracking the deliverability of your messages to assess and optimize the effectiveness of your new channels.

Engaging your customers in non-conventional channels can also freshen up the image and perception of your brand. For instance, sending messages on WhatsApp can give your customers a feeling of closeness. You can define the channels that match your brand and your audience.

Our Dynamics 365 Marketing customers are already using custom channels in their journeys to send:

Appointment confirmations with local text message providers, for customer to never miss on them,
Promotional campaigns with exclusive discounts on WhatsApp or Viber,
Various types of reminders through text messages or WhatsApp,
Informational WhatsApp messages to increase the attendance for upcoming community events.

For instance, one of our customers has set up a journey that informs like-minded professionals about webinars and live community events that could interest them. The message includes a link to a form for professionals to sign up for the events. WhatsApp was chosen as a more engaging and real-time channel than emails, while less intrusive than text messages. In addition to keeping customers informed of upcoming events, the goal is to increase event registrations and the average attendance.

Start using custom channels in your customer outreach

Take advantage of custom channels in Dynamics 365 Marketing to capitalize on favorite and proven channels you’ve already invested time and effort in. Add real-time marketing capabilities like personalization, consent, and deliverability analytics to take your personalized targeting to the next level and maximize the impact of your communications.

Learn more

Ready to start building your new custom channels in Dynamics 365 Marketing? Read the release notes and check out the product documentation: Create custom channels (Dynamics 365 Marketing) | Microsoft Learn

Not yet a Dynamics 365 Marketing Customer? Take a guided tour and get a free trial!

The post Extend and optimize your customer outreach with custom channels appeared first on Microsoft Dynamics 365 Blog.

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

Microsoft Purview Data Catalog: New Features & Enhancements

by Contributed | Feb 23, 2023 | Technology

This article is contributed. See the original author and article here.

Microsoft Purview Data Catalog provides data scientists, engineers, and analysts with the data they need for BI, analytics, AI, and machine learning. It makes data easily discoverable by using familiar business and technical search terms and eliminates the need for Excel data dictionaries with an enterprise-grade business glossary. It enables customers to track the origin of their data with interactive data lineage visualization.

We continue to listen to your feedback and have been hard at work to enable various features in Purview Data Catalog in different areas like data curation, browse & search, business glossaries, business workflows, and self-service data access among others in the last 6 months.

Data Curation:

Create, update, delete, and assign managed attributes to data assets. Learn more here.

Rich text editor support for asset updates (description etc.). Learn more here.

Browse & Search:

Keyword highlighting in search results. Learn more here.

Managed attributes filter support in search results. Learn more here.

Business Glossary:

Create multiple glossaries to manage business terms across different business units in your organization. Learn more here.

Rich text editor support for business glossaries. Learn more here.

Delete term templates without references. Learn more here.

Add, update, and remove templates for existing terms. Learn more here.

Business Workflows:

Approval workflow for data asset curation. Learn more here.

Cancel Workflow run. Learn more here.

Reassign approvals and tasks in workflows. Learn more here.

Support for HTTP connector. Learn more here.

Set reminders and expiry for approvals and task requests in workflows. Learn more here.

Self-Service Data Access:

Request access on behalf of another user in Microsoft Purview Studio. Learn more here.

Request access on behalf of another user in Microsoft Synapse Studio. Learn more here.

Assign data asset owners as approvers for self-service data access. Learn more here.

Our goal is to continue adding features and improve the usability of Microsoft Purview governance capabilities. Get Started easily and quickly using Microsoft Purview. If you have any feature requests or want to provide feedback, please visit the Microsoft Purview forum.

Vulnerability Summary for the Week of February 13, 2023

by Scott Muniz | Feb 23, 2023 | Security, Technology

This article is contributed. See the original author and article here.

walrusirc — walrusirc A vulnerability was found in juju2143 WalrusIRC 0.0.2. It has been rated as problematic. This issue affects the function parseLinks of the file public/parser.js. The manipulation of the argument text leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 0.0.3 is able to address this issue. The name of the patch is 45fd885895ae13e8d9b3a71e89d59768914f60af. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220751. 2023-02-13 not yet calculated CVE-2015-10079
MISC
MISC
MISC
MISC

mozilla — fierfox_for_ios

Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed. 2023-02-16 not yet calculated CVE-2019-17003
MISC

mozilla — fierfox_esr

The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites. 2023-02-16 not yet calculated CVE-2020-12413
MISC
MISC mvp-player — mvp An issue in MPV v.0.29.1 fixed in v0.30 allows attackers to execute arbitrary code and crash program via the ao_c parameter. 2023-02-17 not yet calculated CVE-2020-19824
MISC kimai2 — kimai2 Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges. 2023-02-15 not yet calculated CVE-2020-19825
MISC
MISC kliqqi-cms — kliqqi-cms SQL Injection vulnerability in Kliqqi-CMS 2.0.2 in admin/admin_update_module_widgets.php in recordIDValue parameter, allows attackers to gain escalated privileges and execute arbitrary code. 2023-02-15 not yet calculated CVE-2020-21119
MISC uqcms — uqcms SQL Injection vulnerability in file homecontrolscart.class.php in UQCMS 2.1.3, allows attackers execute arbitrary commands via the cookie_cart parameter to /index.php/cart/num. 2023-02-15 not yet calculated CVE-2020-21120
MISC
MISC online_doctor_appointment_booking_system — online_doctor_appointment_booking_system SQL Injection vulnerability in Projectworlds Online Doctor Appointment Booking System, allows attackers to gain sensitive information via the q parameter to the getuser.php endpoint. 2023-02-17 not yet calculated CVE-2020-29168
MISC
MISC
MISC kong — lua-multipart A vulnerability was found in Kong lua-multipart 0.5.8-1. It has been declared as problematic. This vulnerability affects the function is_header of the file src/multipart.lua. The manipulation leads to inefficient regular expression complexity. Upgrading to version 0.5.9-1 is able to address this issue. The name of the patch is d632e5df43a2928fd537784a99a79dec288bf01b. It is recommended to upgrade the affected component. VDB-220642 is the identifier assigned to this vulnerability. 2023-02-12 not yet calculated CVE-2020-36661
MISC
MISC
MISC
MISC
MISC mozilla — bleach bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(…, attributes={‘a’: [‘style’]}). 2023-02-16 not yet calculated CVE-2020-6817
MISC
MISC intel — 3rd_gen_intel_xeon_scalable_processor Improper access control in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2021-0187
MISC

mozilla — bleach

A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True. 2023-02-16 not yet calculated CVE-2021-23980
MISC
MISC vivo — frame_service The framework service handles pendingIntent incorrectly, allowing a malicious application with certain privileges to perform privileged actions. 2023-02-17 not yet calculated CVE-2021-26277
CONFIRM phpfusion — phpfusion An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature. 2023-02-17 not yet calculated CVE-2021-3172
MISC
MISC libraw — libraw Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/libraw/src/libraw_datastream.cpp. 2023-02-17 not yet calculated CVE-2021-32142
MISC
MISC
MISC
MISC mosn — mosn Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization. 2023-02-17 not yet calculated CVE-2021-32163
MISC
MISC schism_tracker — schism_tracker An issue in Schism Tracker v20200412 fixed in v.20200412 allows attacker to obtain sensitive information via the fmt_mtm_load_song function in fmt/mtm.c. 2023-02-17 not yet calculated CVE-2021-32419
MISC
MISC exponent-cms — exponent-cms SQL Injection vulnerability in Exponent-CMS v.2.6.0 fixed in 2.7.0 allows attackers to gain access to sensitive information via the selectValue function in the expConfig class. 2023-02-17 not yet calculated CVE-2021-32441
MISC
MISC moby — hyperkit HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, `virtio.c` has is a call to `vc_cfgread` that does not check for null which when called makes the host crash. This issue may lead to a guest crashing the host causing a denial of service. This issue is fixed in commit df0e46c7dbfd81a957d85e449ba41b52f6f7beb4. 2023-02-17 not yet calculated CVE-2021-32843
MISC
MISC
CONFIRM moby — hyperkit HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, ` vi_pci_write` has is a call to `vc_cfgwrite` that does not check for null which when called makes the host crash. This issue may lead to a guest crashing the host causing a denial of service. This issue is fixed in commit 451558fe8aaa8b24e02e34106e3bb9fe41d7ad13. 2023-02-17 not yet calculated CVE-2021-32844
MISC
MISC
CONFIRM moby — hyperkit HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, the implementation of `qnotify` at `pci_vtrnd_notify` fails to check the return value of `vq_getchain`. This leads to `struct iovec iov;` being uninitialized and used to read memory in `len = (int) read(sc->vrsc_fd, iov.iov_base, iov.iov_len);` when an attacker is able to make `vq_getchain` fail. This issue may lead to a guest crashing the host causing a denial of service and, under certain circumstance, memory corruption. This issue is fixed in commit 41272a980197917df8e58ff90642d14dec8fe948. 2023-02-17 not yet calculated CVE-2021-32845
MISC
MISC
CONFIRM moby — hyperkit HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107, function `pci_vtsock_proc_tx` in `virtio-sock` can lead to to uninitialized memory use. In this situation, there is a check for the return value to be less or equal to `VTSOCK_MAXSEGS`, but that check is not sufficient because the function can return `-1` if it finds an error it cannot recover from. Moreover, the negative return value will be used by `iovec_pull` in a while condition that can further lead to more corruption because the function is not designed to handle a negative `iov_len`. This issue may lead to a guest crashing the host causing a denial of service and, under certain circumstance, memory corruption. This issue is fixed in commit af5eba2360a7351c08dfd9767d9be863a50ebaba. 2023-02-17 not yet calculated CVE-2021-32846
MISC
MISC
CONFIRM intel — ofu_software Improper access control in the Intel(R) OFU software before version 14.1.28 may allow an authenticated user to potentially enable denial of service via local access. 2023-02-16 not yet calculated CVE-2021-33104
MISC saltstack — saltstack Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file. 2023-02-17 not yet calculated CVE-2021-33226
MISC ymfe — yapo Cross Site Scripting vulnerability in YMFE yapo v1.9.1 allows attacker to execute arbitrary code via the remark parameter of the interface edit page. 2023-02-17 not yet calculated CVE-2021-33237
MISC virtualsquare — pictotcp Double Free vulnerability in virtualsquare picoTCP v1.7.0 and picoTCP-NG v2.1 in modules/pico_fragments.c in function pico_fragments_reassemble, allows attackers to execute arbitrary code. 2023-02-15 not yet calculated CVE-2021-33304
MISC htacg — html_tidy An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c. 2023-02-17 not yet calculated CVE-2021-33391
MISC baijiacms — baijiacms Cross Site Request Forgery (CSRF) vulnerability in baijiacms 4.1.4, allows attackers to change the password or other information of an arbitrary account via index.php. 2023-02-15 not yet calculated CVE-2021-33396
MISC cms-corephp — cms-corephp
SQL Injection vulnerability in nitinparashar30 cms-corephp through commit bdabe52ef282846823bda102728a35506d0ec8f9 (May 19, 2021) allows unauthenticated attackers to gain escilated privledges via a crafted login. 2023-02-15 not yet calculated CVE-2021-33925
MISC plone — plone_cms
An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5.0rc3, 5.0rc2, 5.0rc1, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.10, 5.0.1, 5.0, 4.3.9, 4.3.8, 4.3.7, 4.3.6, 4.3.5, 4.3.4, 4.3.3, 4.3.20, 4 allows attacker to access sensitive information via the RSS feed protlet. 2023-02-17 not yet calculated CVE-2021-33926
MISC
MISC
MISC fantasticlbp — hotels_server SQL injection vulnerability in FantasticLBP Hotels Server v1.0 allows attacker to execute arbitrary code via the username parameter. 2023-02-17 not yet calculated CVE-2021-33948
MISC feminer — wms
An issue in FeMiner WMS v1.1 allows attackers to execute arbitrary code via the filename parameter and the exec function. 2023-02-17 not yet calculated CVE-2021-33949
MISC openkm — document_management_system An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function. 2023-02-17 not yet calculated CVE-2021-33950
MISC
MISC
MISC dvidelabs — flatcc Buffer Overflow vulnerability in Dvidelabs flatcc v.0.6.0 allows local attacker to execute arbitrary code via the fltacc execution of the error_ref_sym function. 2023-02-17 not yet calculated CVE-2021-33983
MISC seopanel — seopanel SQL Injection vulnerability in SEO Panel 4.9.0 in api/user.api.php in function getUserName in the username parameter, allows attackers to gain sensitive information. 2023-02-15 not yet calculated CVE-2021-34117
MISC
MISC
MISC lizhifaka — lizhifaka Permissions vulnerability in LIZHIFAKA v.2.2.0 allows authenticated attacker to execute arbitrary commands via the set password function in the admin/index/email location. 2023-02-17 not yet calculated CVE-2021-34164
MISC ttyd — ttyd An issue in ttyd v.1.6.3 allows attacker to execute arbitrary code via default configuration permissions. 2023-02-17 not yet calculated CVE-2021-34182
MISC yupoxion — bearadmin File Upload Vulnerability in Yupoxion BearAdmin before commit 10176153528b0a914eb4d726e200fd506b73b075 allows attacker to execute arbitrary remote code via the Upfile function of the extend/tools/Ueditor endpoint. 2023-02-17 not yet calculated CVE-2021-35261
MISC dataease — dataease SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10. 2023-02-15 not yet calculated CVE-2021-38239
MISC flatcore — flatcore-cms Cross site scripting (XSS) vulnerability in flatCore-CMS 2.2.15 allows attackers to execute arbitrary code via description field on the new page creation form. 2023-02-16 not yet calculated CVE-2021-40555
MISC fortinet — fortiweb Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, 6.4 all versions may allow an unauthenticated remote attacker to achieve arbitrary code execution via specifically crafted HTTP requests. 2023-02-16 not yet calculated CVE-2021-42756
MISC fortinet — fortiweb A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session identifier of other users and possibly usurp their session. 2023-02-16 not yet calculated CVE-2021-42761
MISC fortinet — multiple_products An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and below, 6.4.8 and below, 6.2 all versions, 6.0 all versions; FortiSwitch 7.0.3 and below, 6.4.10 and below, 6.2 all versions, 6.0 all versions; FortiProxy 7.0.1 and below, 2.0.7 and below, 1.2 all versions, 1.1 all versions, 1.0 all versions may allow an attacker to decrypt portions of the administrative session management cookie if able to intercept the latter. 2023-02-16 not yet calculated CVE-2021-43074
MISC mozilla — thunderbird Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures. 2023-02-16 not yet calculated CVE-2021-43529
MISC mruby — mruby An Untrusted Pointer Dereference was discovered in function mrb_vm_exec in mruby before 3.1.0-rc. The vulnerability causes a segmentation fault and application crash. 2023-02-14 not yet calculated CVE-2021-46023
MISC mozilla — mozilla_pollbot There was an open redirection vulnerability pollbot, which was used in https://pollbot.services.mozilla.com/ and https://pollbot.stage.mozaws.net/ An attacker could have redirected anyone to malicious sites. 2023-02-16 not yet calculated CVE-2022-0637
MISC
MISC cisco — clamav A vulnerability in the OLE2 file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device.The vulnerability is due to incorrect use of the realloc function that may result in a double-free. An attacker could exploit this vulnerability by submitting a crafted OLE2 file to be scanned by ClamAV on the affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition. 2023-02-17 not yet calculated CVE-2022-20803
CISCO crypto — crypto_api_toolkit_for_intel_sgx Improper access control in the Crypto API Toolkit for Intel(R) SGX before version 2.0 commit ID 91ee496 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-21163
MISC intel — atom/xeon_scalable_processors Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent network access. 2023-02-16 not yet calculated CVE-2022-21216
MISC dell — emc_unity Dell EMC Unity versions before 5.2.0.0.5.173 , use(es) broken cryptographic algorithm. A remote unauthenticated attacker could potentially exploit this vulnerability by performing MitM attacks and let attackers obtain sensitive information. 2023-02-14 not yet calculated CVE-2022-22564
MISC intel — oneapi_data_analytics_library/oneapi_base_toolkit Uncontrolled search path element in the Intel(R) oneAPI Data Analytics Library (oneDAL) before version 2021.5 for Intel(R) oneAPI Base Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-25905
MISC glance — glance Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is related to but distinct from the vulnerability reported in [CVE-2018-3715](https://security.snyk.io/vuln/npm:glance:20180129). 2023-02-13 not yet calculated CVE-2022-25937
MISC
MISC usememos — memos All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on external resources, which allows malicious actors to introduce links starting with a javascript: scheme. 2023-02-15 not yet calculated CVE-2022-25978
MISC
MISC
MISC intel — c++_compiler_classic Improper handling of Unicode encoding in source code to be compiled by the Intel(R) C++ Compiler Classic before version 2021.6 for Intel(R) oneAPI Toolkits before version 2022.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access. 2023-02-16 not yet calculated CVE-2022-25987
MISC intel — oneapi_toolkits_oneapi-cli Insecure inherited permissions in the Intel(R) oneAPI Toolkits oneapi-cli before version 0.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-25992
MISC intel — distribution_for_python_programming_language_for_intel_oneapi_toolkits Uncontrolled search path element in the Intel(R) Distribution for Python programming language before version 2022.1 for Intel(R) oneAPI Toolkits may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-26032
MISC intel — mpi_library_for_intel_oneapi_hpc_toolkit Uncontrolled search path element in the Intel(R) MPI Library before version 2021.6 for Intel(R) oneAPI HPC Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-26052
MISC intel — trace_analyzer_and_collector_for_intel_oneapi_hpc Uncontrolled search path element in the Intel(R) Trace Analyzer and Collector before version 2021.6 for Intel(R) oneAPI HPC Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-26062
MISC intel — oneapi_deep_neural_network Uncontrolled search path element in the Intel(R) oneAPI Deep Neural Network (oneDNN) before version 2022.1 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-26076
MISC fortinet — fortisandbox A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords. 2023-02-16 not yet calculated CVE-2022-26115
MISC intel — multiple_products Improper access control in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-26343
MISC intel — oneapi_toolkit_openmp Uncontrolled search path element in the Intel(R) oneAPI Toolkit OpenMP before version 2022.1 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-26345
MISC intel — dpc++/c++_compiler Uncontrolled search path element in the Intel(R) oneAPI DPC++/C++ Compiler Runtime before version 2022.0 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-26421
MISC intel — oneapi_collective_communications_library/oneapi_base_toolkit Uncontrolled search path element in the Intel(R) oneAPI Collective Communications Library (oneCCL) before version 2021.6 for Intel(R) oneAPI Base Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-26425
MISC intel — sgx_sdk Improper conditions check in the Intel(R) SGX SDK software may allow a privileged user to potentially enable information disclosure via local access. 2023-02-16 not yet calculated CVE-2022-26509
MISC intel — fpga_add-on_for_intel_oneapi_base_toolkit Uncontrolled search path element in the Intel(R) FPGA Add-on for Intel(R) oneAPI Base Toolkit before version 2022.2 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-26512
MISC intel — multiple_products Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-26837
MISC intel — quartus_prime_pro_and_standard_editions Improper neutralization in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-26840
MISC intel — sgx_sdk_software_for_linux Insufficient control flow management for the Intel(R) SGX SDK software for Linux before version 2.16.100.1 may allow an authenticated user to potentially enable information disclosure via local access. 2023-02-16 not yet calculated CVE-2022-26841
MISC intel — dpc++/c++_compiler Insufficient visual distinction of homoglyphs presented to user in the Intel(R) oneAPI DPC++/C++ Compiler before version 2022.1 for Intel(R) oneAPI Toolkits before version 2022.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access. 2023-02-16 not yet calculated CVE-2022-26843
MISC intel — quartus_prime_pro_and_standard_editions Cross-site scripting in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable information disclosure via local access. 2023-02-16 not yet calculated CVE-2022-26888
MISC intel — media_sdk Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-27170
MISC intel — computer_vision_annotation_tool Server-side request forgery in the CVAT software maintained by Intel(R) before version 2.0.1 may allow an authenticated user to potentially enable information disclosure via network access. 2023-02-16 not yet calculated CVE-2022-27234
MISC fortinet — fortiadc A improper neutralization of special elements used in an os command (‘os command injection’) in Fortinet FortiADC version 7.0.0 through 7.0.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.6, 6.0.x, 5.x.x allows attacker to execute arbitrary shell code as `root` via CLI commands. 2023-02-16 not yet calculated CVE-2022-27482
MISC fortinet — fortiextender A improper neutralization of special elements used in an os command (‘os command injection’) in Fortinet FortiExtender 7.0.0 through 7.0.3, 5.3.2, 4.2.4 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests. 2023-02-16 not yet calculated CVE-2022-27489
MISC intel — ethernet_controller_administrative_tools Insufficient control flow management in some Intel(R) Ethernet Controller Administrative Tools drivers for Windows before version 1.5.0.2 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-27808
MISC palantir — atlasdb It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. In the case of AtlasDB, the vulnerability was mitigated by other network controls such as two-way TLS when deployed as part of a Palantir platform. Palantir still recommends upgrading to a non-vulnerable version out of an abundance of caution. 2023-02-16 not yet calculated CVE-2022-27890
MISC palantir — gotham Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session. The affected services have been patched and automatically deployed to all Apollo-managed Gotham instances. It is highly recommended that customers upgrade all affected services to the latest version. This issue affects: Palantir Gotham versions prior to 103.30221005.0. 2023-02-16 not yet calculated CVE-2022-27891
MISC palantir — gotham Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory of the Gotham dispatch service. 2023-02-16 not yet calculated CVE-2022-27892
MISC palantir — gotham Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory. An attacker could repeatedly upload a malicious zip file, which would allow them to exhaust memory resources on the dispatch server. 2023-02-16 not yet calculated CVE-2022-27897
MISC fortinet — fortios A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.9, 6.2.x and 6.0.x may allow an attacker in possession of the encrypted key to decipher it. 2023-02-16 not yet calculated CVE-2022-29054
MISC integrated_bmc — integrated_bmc Uncaught exception in webserver for the Integrated BMC in some Intel(R) platforms before versions 2.86, 2.09 and 2.78 may allow a privileged user to potentially enable denial of service via network access. 2023-02-16 not yet calculated CVE-2022-29493
MISC openbmc — openbmc Improper input validation in firmware for OpenBMC in some Intel(R) platforms before versions egs-0.91-179 and bhs-04-45 may allow an authenticated user to potentially enable denial of service via network access. 2023-02-16 not yet calculated CVE-2022-29494
MISC intel — sur Improper access control in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to potentially enable escalation of privilege via network access. 2023-02-16 not yet calculated CVE-2022-29514
MISC intel — open_cas Improper conditions check in the Open CAS software maintained by Intel(R) before version 22.3.1 may allow an authenticated user to potentially enable denial of service via local access. 2023-02-16 not yet calculated CVE-2022-29523
MISC lexisnexis_firco_compliance_link — lexisnexis_firco_compliance_link LexisNexis Firco Compliance Link 3.7 allows CSRF. 2023-02-15 not yet calculated CVE-2022-29557
MISC fortinet — fortiweb A path traversal vulnerability [CWE-23] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions may allow an authenticated attacker to retrieve specific parts of files from the underlying file system via specially crafted web requests. 2023-02-16 not yet calculated CVE-2022-30299
MISC fortinet — fortiweb A relative path traversal vulnerability [CWE-23] in FortiWeb 7.0.0 through 7.0.1, 6.3.6 through 6.3.18, 6.4 all versions may allow an authenticated attacker to obtain unauthorized access to files and data via specifically crafted HTTP GET requests. 2023-02-16 not yet calculated CVE-2022-30300
MISC fortinet — fortiweb An improper neutralization of special elements used in an os command (‘OS Command Injection’) [CWE-78] in FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions may allow an authenticated attacker to execute arbitrary shell code as `root` user via crafted HTTP requests. 2023-02-16 not yet calculated CVE-2022-30303
MISC fortinet — fortianalyzer An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8 may allow a remote unauthenticated attacker to perform a stored cross site scripting (XSS) attack via the URL parameter observed in the FortiWeb attack event logview in FortiAnalyzer. 2023-02-16 not yet calculated CVE-2022-30304
MISC fortinet — fortiweb A stack-based buffer overflow vulnerability [CWE-121] in the CA sign functionality of FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted password. 2023-02-16 not yet calculated CVE-2022-30306
MISC intel — integrated_sensor_solution Out-of-bounds read in firmware for the Intel(R) Integrated Sensor Solution before versions 5.4.2.4579v3, 5.4.1.4479 and 5.0.0.4143 may allow a privileged user to potentially enable denial of service via local access. 2023-02-16 not yet calculated CVE-2022-30339
MISC intel — dsa Protection mechanism failure in the Intel(R) DSA software before version 22.4.26 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-30530
MISC intel — iris_xe max_drivers_for_windows Out-of-bounds read in the Intel(R) Iris(R) Xe MAX drivers for Windows before version 100.0.5.1474 may allow a privileged user to potentially enable information disclosure via local access. 2023-02-16 not yet calculated CVE-2022-30531
MISC intel — multiple_products Use after free in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-30539
MISC intel — sur Improper conditions check in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to potentially enable denial of service via network access. 2023-02-16 not yet calculated CVE-2022-30692
MISC intel — multiple_products Improper initialization in the Intel(R) TXT SINIT ACM for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-30704
MISC enocean — echelon_smartserver Echelon SmartServer 2.2 with i.LON Vision 2.2 stores cleartext credentials in a file, which could allow an attacker to obtain cleartext usernames and passwords of the SmartServer. If the attacker obtains the file, then the credentials could be used to control the web user interface and file transfer protocol (FTP) server. 2023-02-13 not yet calculated CVE-2022-3089
MISC intel — sur Improper access control in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable denial of service via local access. 2023-02-16 not yet calculated CVE-2022-31476
MISC siemens — sipass_integrated_ac5102 A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V2.85.44), SiPass integrated ACC-AP (All versions < V2.85.43). Affected devices improperly sanitize user input on the telnet command line interface. This could allow an authenticated user to escalate privileges by injecting arbitrary commands that are executed with root privileges. 2023-02-14 not yet calculated CVE-2022-31808
MISC intel — multiple_products Improper initialization in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-32231
MISC insyde — insydeh2o An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the PnpSmm shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated using IOMMU protection for the ACPI runtime memory used for the command buffer. This attack can be mitigated by copying the firmware block services data to SMRAM before checking it. 2023-02-15 not yet calculated CVE-2022-32469
MISC
MISC insyde — insydeh2o An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the FwBlockServiceSmm shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated using IOMMU protection for the ACPI runtime memory used for the command buffer. This attack can be mitigated by copying the firmware block services data to SMRAM before checking it. 2023-02-15 not yet calculated CVE-2022-32470
MISC
MISC insyde — insydeh2o An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. The IhisiDxe driver uses the command buffer to pass input and output data. By modifying the command buffer contents with DMA after the input parameters have been checked but before they are used, the IHISI SMM code may be convinced to modify SMRAM or OS, leading to possible data corruption or escalation of privileges. 2023-02-15 not yet calculated CVE-2022-32471
MISC
MISC insyde — insydeh2o An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the HddPassword shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated using IOMMU protection for the ACPI runtime memory used for the command buffer. This attack can be mitigated by copying the firmware block services data to SMRAM before checking it. 2023-02-15 not yet calculated CVE-2022-32473
MISC
MISC insyde — insydeh2o An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the StorageSecurityCommandDxe shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated using IOMMU protection for the ACPI runtime memory used for the command buffer. This attack can be mitigated by copying the firmware block services data to SMRAM before checking it. 2023-02-15 not yet calculated CVE-2022-32474
MISC
MISC insyde — insydeh2o An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the VariableRuntimeDxe shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This issue was fixed in the kernel, which also protected chipset and OEM chipset code. 2023-02-15 not yet calculated CVE-2022-32475
MISC
MISC insyde — insydeh2o An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the AhciBusDxe shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated using IOMMU protection for the ACPI runtime memory used for the command buffer. This attack can be mitigated by copying the firmware block services data to SMRAM before checking it. 2023-02-15 not yet calculated CVE-2022-32476
MISC
MISC insyde — insydeh2o An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the FvbServicesRuntimeDxe shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated using IOMMU protection for the ACPI runtime memory used for the command buffer. This attack can be mitigated by copying the firmware block services data to SMRAM before checking it. 2023-02-15 not yet calculated CVE-2022-32477
MISC
MISC insyde — insydeh2o An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the IdeBusDxe shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated using IOMMU protection for the ACPI runtime memory used for the command buffer. This attack can be mitigated by copying the firmware block services data to SMRAM before checking it. 2023-02-15 not yet calculated CVE-2022-32478
MISC
MISC

intel — quartus_prime_pro_and_standard_editions

Improper authentication in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-32570
MISC intel — trace_analyzer_and collector Out-of-bounds write in the Intel(R) Trace Analyzer and Collector software before version 2021.5 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-32575
MISC intel — dsa Description: Race condition in the Intel(R) DSA software before version 22.4.26 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-32764
MISC insyde — insydeh2o An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the SdHostDriver buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated by using IOMMU protection for the ACPI runtime memory used for the command buffer. This attack can be mitigated by copying the link data to SMRAM before checking it and verifying that all pointers are within the buffer. 2023-02-15 not yet calculated CVE-2022-32953
MISC
MISC insyde — insydeh2o An issue was discovered in Insyde InsydeH2O with kernel 5.1 through 5.5. DMA attacks on the SdMmcDevice buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated by using IOMMU protection for the ACPI runtime memory used for the command buffer. This attack can be mitigated by copying the link data to SMRAM before checking it and verifying that all pointers are within the buffer. 2023-02-15 not yet calculated CVE-2022-32954
MISC
MISC insyde — insydeh2o An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the NvmExpressDxe buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated by using IOMMU protection for the ACPI runtime memory used for the command buffer. This attack can be mitigated by copying the link data to SMRAM before checking it and verifying that all pointers are within the buffer. 2023-02-15 not yet calculated CVE-2022-32955
MISC
MISC intel — sur Improper authentication in the Intel(R) SUR software before version 2.4.8902 may allow a privileged user to potentially enable escalation of privilege via network access. 2023-02-16 not yet calculated CVE-2022-32971
MISC infoblox — bloxone_endpoint_for_windows Infoblox BloxOne Endpoint for Windows through 2.2.7 allows DLL injection that can result in local privilege escalation. 2023-02-17 not yet calculated CVE-2022-32972
MISC
MISC intel — sur Improper input validation in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-33190
MISC intel — xeon_processors_with_intelâ_software_guard_extensions Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-33196
MISC fortinet — fortiwan An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiWAN 4.0.0 through 4.5.9 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands. 2023-02-16 not yet calculated CVE-2022-33869
MISC fortinet — fortiweb A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb version 7.0.1 and earlier, 6.4 all versions, version 6.3.19 and earlier may allow a privileged attacker to execute arbitrary code or commands via specifically crafted CLI `execute backup-local rename` and `execute backup-local show` operations. 2023-02-16 not yet calculated CVE-2022-33871
MISC intel — quartus_prime_pro_and_standard_editions Path traversal in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-33892
MISC intel — quartus_prime_pro_and_standard_editions Insufficient control flow management in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-33902
MISC intel — sur Improper authentication in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-33946
MISC intel — sur Improper input validation in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to potentially enable escalation of privilege via network access. 2023-02-16 not yet calculated CVE-2022-33964
MISC intel — 3rd generation_xeon_scalable_processors Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially enable information disclosure via local access. 2023-02-16 not yet calculated CVE-2022-33972
MISC gitlab– gitlab A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage. 2023-02-13 not yet calculated CVE-2022-3411
MISC
MISC
CONFIRM intel — battery_life_diagnostic_tool Improper initialization in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-34153
MISC intel — quartus_prime_pro_and_standard_editions Improper access control in the Intel(R) FPGA SDK for OpenCL(TM) with Intel(R) Quartus(R) Prime Pro Edition software before version 22.1 may allow authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-34157
MISC intel — media_sdk Out-of-bounds read in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-34346
MISC ibm — qradar_siem IBM QRadar SIEM 7.4 and 7.5 is vulnerable to information exposure allowing a non-tenant user with a specific domain security profile assigned to see some data from other domains. IBM X-Force ID: 230402. 2023-02-17 not yet calculated CVE-2022-34351
MISC
MISC dell — unisphere_for_powermax Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 10.0.0.5 and below contains an authorization bypass vulnerability, allowing users to perform actions in which they are not authorized. 2023-02-13 not yet calculated CVE-2022-34397
MISC intel — media_sdk Improper buffer restrictions in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-34841
MISC intel — trace_analyzer_and collector Integer overflow in the Intel(R) Trace Analyzer and Collector software before version 2021.5 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-34843
MISC intel — iris_xe max_drivers_for_windows Uncaught exception in the Intel(R) Iris(R) Xe MAX drivers for Windows before version 100.0.5.1436(v2) may allow a privileged user to potentially enable denial of service via local access. 2023-02-16 not yet calculated CVE-2022-34849
MISC intel — sur Improper access control in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-34854
MISC intel — trace_analyzer_and collector Out-of-bounds read in the Intel(R) Trace Analyzer and Collector software before version 2021.5 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-34864
MISC openbmc — openbmc Out of bounds read in firmware for OpenBMC in some Intel(R) platforms before version 0.72 may allow unauthenticated user to potentially enable denial of service via network access. 2023-02-16 not yet calculated CVE-2022-35729
MISC siemens — multiple_products A vulnerability has been identified in TIA Multiuser Server V14 (All versions), TIA Multiuser Server V15 (All versions < V15.1 Update 8), TIA Project-Server (All versions < V1.1), TIA Project-Server V16 (All versions), TIA Project-Server V17 (All versions). Affected applications contain an untrusted search path vulnerability that could allow an attacker to escalate privileges, when tricking a legitimate user to start the service from an attacker controlled path. 2023-02-14 not yet calculated CVE-2022-35868
MISC intel — media_sdk NULL pointer dereference in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable denial of service via local access. 2023-02-16 not yet calculated CVE-2022-35883
MISC intel — battery_life_diagnostic_tool Insufficient control flow management in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-36278
MISC intel — fcs_server Uncaught exception in the FCS Server software maintained by Intel before version 1.1.79.3 may allow a privileged user to potentially enable denial of service via physical access. 2023-02-16 not yet calculated CVE-2022-36287
MISC intel — media_sdk Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable denial of service via local access. 2023-02-16 not yet calculated CVE-2022-36289
MISC intel — sps_firmware Active debug code in some Intel (R) SPS firmware before version SPS_E5_04.04.04.300.0 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-36348
MISC intel – qatzip Improper access control in some QATzip software maintained by Intel(R) before version 1.0.9 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-36369
MISC intel — multiple_products Out-of-bounds write in firmware for some Intel(R) Ethernet Network Controllers and Adapters E810 Series before version 1.7.0.8 and some Intel(R) Ethernet 700 Series Controllers and Adapters before version 9.101 may allow a privileged user to potentially enable denial of service via local access. 2023-02-16 not yet calculated CVE-2022-36382
MISC intel — qat_drivers_for_linux Incorrect default permissions in the software installer for some Intel(R) QAT drivers for Linux before version 4.17 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-36397
MISC intel — battery_life_diagnostic_tool Uncontrolled search path in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-36398
MISC intel –ethernet_500_series_controller_drivers_for_vmware Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.13 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-36416
MISC ibm — security verify access IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 233576. 2023-02-17 not yet calculated CVE-2022-36775
MISC
MISC intel — sps_firmware Improper condition check in some Intel(R) SPS firmware before version SPS_E3_06.00.03.300.0 may allow a privileged user to potentially enable denial of service via local access. 2023-02-16 not yet calculated CVE-2022-36794
MISC intel –ethernet_500_series_controller_drivers_for_vmware Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 may allow an authenticated user to potentially enable denial of service via local access. 2023-02-16 not yet calculated CVE-2022-36797
MISC intel — quartus_prime_pro_and_standard_editions Uncontrolled search path in some Intel(R) Quartus(R) Prime Pro and Standard Edition software may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-37329
MISC intel — qat_drivers_for_windows Uncontrolled search path in some Intel(R) QAT drivers for Windows before version 1.6 may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-37340
MISC gitlab — gitlab An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. An attacker may upload a crafted CI job artifact zip file in a project that uses dynamic child pipelines and make a sidekiq job allocate a lot of memory. In GitLab instances where Sidekiq is memory-limited, this may cause Denial of Service. 2023-02-13 not yet calculated CVE-2022-3759
MISC
CONFIRM
MISC intel — ema Improper neutralization in the Intel(R) EMA software before version 1.8.1.0 may allow a privileged user to potentially enable escalation of privilege via network access. 2023-02-16 not yet calculated CVE-2022-38056
MISC intel — multiple_products Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially enable information disclosure via local access. 2023-02-16 not yet calculated CVE-2022-38090
MISC solarwinds — platform SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands. 2023-02-15 not yet calculated CVE-2022-38111
MISC
MISC fortinet — fortinac An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests. 2023-02-16 not yet calculated CVE-2022-38375
MISC fortinet — fortinac Multiple improper neutralization of input during web page generation (‘Cross-site Scripting’) vulnerabilities [CWE-79] in Fortinet FortiNAC portal UI before 9.4.1 allows an attacker to perform an XSS attack via crafted HTTP requests. 2023-02-16 not yet calculated CVE-2022-38376
MISC fortinet — multiple_products An improper privilege management vulnerability [CWE-269] in Fortinet FortiOS version 7.2.0 and before 7.0.7 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an attacker that has access to the admin profile section (System subsection Administrator Users) to modify their own profile and upgrade their privileges to Read Write via CLI or GUI commands. 2023-02-16 not yet calculated CVE-2022-38378
MISC

qaelum — dose

Qaelum DOSE 18.08 through 21.1 before 21.2 allows Directory Traversal via the loadimages name parameter. It allows a user to specify an arbitrary location on the server’s filesystem from which to load an image. (Only images are displayed to the attacker. All other files are loaded but not displayed.) The Content-Type response header reflects the actual content type of the file being requested. This allows an attacker to enumerate files on the local system. Additionally, remote resources can be requested via a UNC path, allowing an attacker to coerce authentication out from the server to the attackers machine. 2023-02-16 not yet calculated CVE-2022-38731
MISC
MISC rttys — rttys SQL Injection vulnerability in rttys versions 4.0.0, 4.0.1, and 4.0.2 in api.go, allows attackers to execute arbitrary code. 2023-02-15 not yet calculated CVE-2022-38867
MISC ehoney — ehoney SQL Injection vulnerability in Ehoney version 2.0.0 in models/protocol.go and models/images.go, allows attackers to execute arbitrary code. 2023-02-15 not yet calculated CVE-2022-38868
MISC

wordpress — wordpress

The WP FullCalendar WordPress plugin before 1.5 does not ensure that the post retrieved via an AJAX action is public and can be accessed by the user making the request, allowing unauthenticated attackers to get the content of arbitrary posts, including draft/private as well as password-protected ones. 2023-02-13 not yet calculated CVE-2022-3891
MISC

niterforum — niterforum

An issue was discovered in NiterForum version 2.5.0-beta in /src/main/java/cn/niter/forum/api/SsoApi.java and /src/main/java/cn/niter/forum/controller/AdminController.java, allows attackers to gain escalated privileges. 2023-02-15 not yet calculated CVE-2022-38935
MISC

fortinet — multiple_products

An improper certificate validation vulnerability [CWE-295] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all versions and FortiProxy 7.0.0 through 7.0.6, 2.0 all versions, 1.2 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the FortiOS/FortiProxy device and remote servers hosting threat feeds (when the latter are configured as Fabric connectors in FortiOS/FortiProxy) 2023-02-16 not yet calculated CVE-2022-39948
MISC fortinet — fortinac A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP request. 2023-02-16 not yet calculated CVE-2022-39952
MISC fortinet — fortinac An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC version 9.1.0 through 9.1.8, FortiNAC version 8.8.0 through 8.8.11, FortiNAC version 8.7.0 through 8.7.6, FortiNAC version 8.6.0 through 8.6.5, FortiNAC version 8.5.0 through 8.5.4, FortiNAC version 8.3.7 allows attacker to read arbitrary files or trigger a denial of service via specifically crafted XML documents. 2023-02-16 not yet calculated CVE-2022-39954
MISC ireader — media-server Use After Free (UAF) vulnerability in ireader media-server before commit 3e0f63f1d3553f75c7d4eb32fa7c7a1976a9ff84 in librtmp, allows attackers to cause a denial of service. 2023-02-15 not yet calculated CVE-2022-40016
MISC qvidium_technologies — amino_a140 QVidium Technologies Amino A140 (prior to firmware version 1.0.0-283) was discovered to contain a command injection vulnerability. 2023-02-17 not yet calculated CVE-2022-40021
MISC microsemi — syncserver_s650 Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability. 2023-02-13 not yet calculated CVE-2022-40022
MISC
MISC
MISC
MISC sourcecodester — simple_task_managing_system SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in ‘username’ and ‘password’ parameters, allows attackers to execute arbitrary code and gain sensitive information. 2023-02-17 not yet calculated CVE-2022-40032
MISC
MISC
MISC acer — aspire Stack overflow vulnerability in Aspire E5-475G ‘s BIOS firmware, in the FpGui module, a second call to GetVariable services allows local attackers to execute arbitrary code in the UEFI DXE phase and gain escalated privileges. 2023-02-16 not yet calculated CVE-2022-40080
MISC
MISC

ibm — sterling_b2b_integrator

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 could allow an authenticated user to perform unauthorized actions due to improper access controls. IBM X-Force ID: 235533. 2023-02-17 not yet calculated CVE-2022-40231
MISC
MISC

ibm — sterling_b2b_integrator

IBM Sterling B2B Integrator Standard Edition 6.1.0.0 through 6.1.1.1, and 6.1.2.0 could allow an authenticated user to perform actions they should not have access to due to improper permission controls. IBM X-Force ID: 235597. 2023-02-17 not yet calculated CVE-2022-40232
MISC
MISC intern_record_system — intern_record_system SQL Injection vulnerability in Intern Record System version 1.0 in /intern/controller.php in ‘phone’, ’email’, ‘deptType’ and ‘name’ parameters, allows attackers to execute arbitrary code and gain sensitive information. 2023-02-17 not yet calculated CVE-2022-40347
MISC
MISC
MISC intern_record_system — intern_record_system Cross Site Scripting (XSS) vulnerability in Intern Record System version 1.0 in /intern/controller.php in ‘name’ and ’email’ parameters, allows attackers to execute arbitrary code. 2023-02-18 not yet calculated CVE-2022-40348
MISC
MISC
MISC

fortinet — fortinac

Some cryptographic issues in Fortinet FortiNAC versions 9.4.0 through 9.4.1, 9.2.0 through 9.2.7, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an attacker to decrypt and forge protocol communication messages. 2023-02-16 not yet calculated CVE-2022-40675
MISC

fortinet — fortinac

A improper neutralization of argument delimiters in a command (‘argument injection’) in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 allows attacker to execute unauthorized code or commands via specially crafted input parameters. 2023-02-16 not yet calculated CVE-2022-40677
MISC

fortinet — fortinac

An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow a local attacker with database access to recover user passwords. 2023-02-16 not yet calculated CVE-2022-40678
MISC fortinet — fortiweb A double free in Fortinet FortiWeb version 7.0.0 through 7.0.3 may allows attacker to execute unauthorized code or commands via specially crafted commands 2023-02-16 not yet calculated CVE-2022-40683
MISC optinlyhq — optinly Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versions. 2023-02-13 not yet calculated CVE-2022-41134
MISC intel — network_adapter_installer_software Uncontrolled search path in some Intel(R) Network Adapter installer software may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-02-16 not yet calculated CVE-2022-41314
MISC

fortinet — fortios

An improper neutralization of input during web page generation [CWE-79] vulnerability in FortiOS versions 7.0.0 to 7.0.7 and 7.2.0 to 7.2.3 may allow a remote, unauthenticated attacker to launch a cross site scripting (XSS) attack via the “redir” parameter of the URL seen when the “Sign in with FortiCloud” button is clicked. 2023-02-16 not yet calculated CVE-2022-41334
MISC

fortinet — multiple_products

A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, FortiProxy version 7.2.0 through 7.2.1, 7.0.0 through 7.0.7 and before 2.0.10, FortiSwitchManager 7.2.0 and before 7.0.0 allows an authenticated attacker to read and write files on the underlying Linux system via crafted HTTP requests. 2023-02-16 not yet calculated CVE-2022-41335
MISC gitlab — gitlab A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a project if an Owner or Maintainer uploads a file to a malicious project. 2023-02-13 not yet calculated CVE-2022-4138
CONFIRM
MISC
MISC

tibco — multiple_products

The Hawk Console component of TIBCO Software Inc.’s TIBCO Hawk and TIBCO Operational Intelligence Hawk RedTail contains a vulnerability that will return the EMS transport password and EMS SSL password to a privileged user. Affected releases are TIBCO Software Inc.’s TIBCO Hawk: versions 6.2.1 and below and TIBCO Operational Intelligence Hawk RedTail: versions 7.2.0 and below. 2023-02-14 not yet calculated CVE-2022-41564
CONFIRM
CONFIRM intel — on_event_series_android_application Insufficiently protected credentials in the Intel(R) ON Event Series Android application before version 2.0 may allow an authenticated user to potentially enable information disclosure via local access. 2023-02-16 not yet calculated CVE-2022-41614
MISC ibm — maximo_asset_management IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 237587. 2023-02-17 not yet calculated CVE-2022-41734
MISC
MISC

asus — ec_tool_driver

ASUS EC Tool driver (aka d.sys) 1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb, as signed by ASUS and shipped with multiple ASUS software products, contains multiple IOCTL handlers that provide raw read and write access to port I/O and MSRs via unprivileged IOCTL calls. Local users can gain privileges. 2023-02-15 not yet calculated CVE-2022-42455
MISC fortinet — multiple_products A improper neutralization of crlf sequences in http headers (‘http response splitting’) in Fortinet FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.11, 6.2.0 through 6.2.12, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.1, 7.0.0 through 7.0.7, 2.0.0 through 2.0.10, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6 may allow an authenticated and remote attacker to perform an HTTP request splitting attack which gives attackers control of the remaining headers and body of the response. 2023-02-16 not yet calculated CVE-2022-42472
MISC apache — shenyu Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level administrators create users with higher privileges than their own. This issue affects Apache ShenYu: 2.5.0. Upgrade to Apache ShenYu 2.5.1 or apply patch https://github.com/apache/shenyu/pull/3958 https://github.com/apache/shenyu/pull/3958 . 2023-02-15 not yet calculated CVE-2022-42735
MISC

b&r-automation — system_diagnostics_manager

A reflected cross-site scripting (XSS) vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions >=3.00 and <=C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session. 2023-02-14 not yet calculated CVE-2022-4286
MISC

fujifilm — driver_distributor

Driver Distributor v2.2.3.1 and earlier contains a vulnerability where passwords are stored in a recoverable format. If an attacker obtains a configuration file of Driver Distributor, the encrypted administrator’s credentials may be decrypted. 2023-02-13 not yet calculated CVE-2022-43460
MISC
MISC wordpress — wordpress Cross-Site Request Forgery (CSRF) vulnerability in Orchestrated Corona Virus (COVID-19) Banner & Live Data plugin <= 1.7.0.6 versions. 2023-02-14 not yet calculated CVE-2022-43469
MISC ibm — sterling_b2b_integrator IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 238684. 2023-02-17 not yet calculated CVE-2022-43579
MISC
MISC

ibm — multiple_products

IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to information Disclosure due to improper privilege management when a specially crafted table access is used. IBM X-Force ID: 241671. 2023-02-17 not yet calculated CVE-2022-43927
MISC
MISC

ibm — multiple_products

IBM Db2 for Linux, UNIX and Windows 11.1 and 11.5 may be vulnerable to a Denial of Service when executing a specially crafted ‘Load’ command. IBM X-Force ID: 241676. 2023-02-17 not yet calculated CVE-2022-43929
MISC
MISC

ibm — multiple_products

IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to an Information Disclosure as sensitive information may be included in a log file. IBM X-Force ID: 241677. 2023-02-17 not yet calculated CVE-2022-43930
MISC
MISC

fortinet — fortiportal

An insertion of sensitive information into log file vulnerability [CWE-532] in the FortiPortal management interface 7.0.0 through 7.0.2 may allow a remote authenticated attacker to read other devices’ passwords in the audit log page. 2023-02-16 not yet calculated CVE-2022-43954
MISC ricoh — mp_c4504ex Ricoh mp_c4504ex devices with firmware 1.06 mishandle credentials. 2023-02-16 not yet calculated CVE-2022-43969
MISC
MISC

siteservercms — siteservercms

SiteServerCMS 7.1.3 sscms has a file read vulnerability. 2023-02-16 not yet calculated CVE-2022-44299
MISC wordpress — wordpress The FL3R FeelBox WordPress plugin through 8.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. 2023-02-13 not yet calculated CVE-2022-4445
MISC wordpress — wordpress The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks 2023-02-13 not yet calculated CVE-2022-4448
MISC wordpress — wordpress The amr shortcode any widget WordPress plugin through 4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. 2023-02-13 not yet calculated CVE-2022-4458
MISC wordpress — wordpress The YARPP WordPress plugin through 5.30.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. 2023-02-13 not yet calculated CVE-2022-4471
MISC wordpress — wordpress The Widget Shortcode WordPress plugin through 0.3.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. 2023-02-13 not yet calculated CVE-2022-4473
MISC wordpress — wordpress The Widgets on Pages WordPress plugin through 1.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. 2023-02-13 not yet calculated CVE-2022-4488
MISC wordpress — wordpress The Better Font Awesome WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. 2023-02-13 not yet calculated CVE-2022-4512
MISC suse — multiple_products An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5; openSUSE Leap 15.4 allows local attackers to escalate to root by manipulating the sudo configuration that is created. This issue affects: SUSE Linux Enterprise Module for SAP Applications 15-SP1 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. SUSE Linux Enterprise Server for SAP 12-SP5 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. openSUSE Leap 15.4 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. 2023-02-15 not yet calculated CVE-2022-45153
CONFIRM suse — multiple_products A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions. 2023-02-15 not yet calculated CVE-2022-45154
CONFIRM ithacalabs –vsourz_digital Vsourz Digital Advanced Contact form 7 DB Versions 1.7.2 and 1.9.1 is vulnerable to Cross Site Scripting (XSS). 2023-02-13 not yet calculated CVE-2022-45285
MISC
MISC pandora_fms — artica Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting (XSS). As a manager privilege user , create a network map containing name as xss payload. Once created, admin user must click on the edit network maps and XSS payload will be executed, which could be used for stealing admin users cookie value. 2023-02-15 not yet calculated CVE-2022-45436
CONFIRM pandora_fms — artica Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Artica PFMS Pandora FMS v765 on all allows Cross-Site Scripting (XSS). A user with edition privileges can create a Payload in the reporting dashboard module. An admin user can observe the Payload without interaction and attacker can get information. 2023-02-15 not yet calculated CVE-2022-45437
CONFIRM acronis — multiple_products Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before build 30161, Acronis Cyber Protect 15 (Windows) before build 30984. 2023-02-13 not yet calculated CVE-2022-45454
MISC acronis — multiple_products Local privilege escalation due to incomplete uninstallation cleanup. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107, Acronis Agent (Windows) before build 30025, Acronis Cyber Protect 15 (Windows) before build 30984. 2023-02-13 not yet calculated CVE-2022-45455
MISC wordpress — wordpress The Mapwiz WordPress plugin through 1.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. 2023-02-13 not yet calculated CVE-2022-4546
MISC
MISC wordpress — wordpress The Rich Table of Contents WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks 2023-02-13 not yet calculated CVE-2022-4551
MISC

discuzx — discuzx

Cross site scripting (XSS) vulnerability in DiscuzX 3.4 allows attackers to execute arbitrary code via the datetline, title, tpp, or username parameters via the audit search. 2023-02-15 not yet calculated CVE-2022-45543
MISC screencheck_badgemaker — screencheck_badgemaker Information Disclosure in Authentication Component of ScreenCheck BadgeMaker 2.6.2.0 application allows internal attacker to obtain credentials for authentication via network sniffing. 2023-02-15 not yet calculated CVE-2022-45546
MISC

xpdfreader — xpdfreader

Stack overflow vulnerability in function Dict::find in xpdf/Dict.cc in xpdf 4.04, allows local attackers to cause a denial of service. 2023-02-15 not yet calculated CVE-2022-45586
MISC

xpdfreader — xpdfreader

Stack overflow vulnerability in function gmalloc in goo/gmem.cc in xpdf 4.04, allows local attackers to cause a denial of service. 2023-02-15 not yet calculated CVE-2022-45587
MISC wordpress — wordpress The Meks Flexible Shortcodes WordPress plugin before 1.3.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. 2023-02-13 not yet calculated CVE-2022-4562
MISC arris — router Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature. 2023-02-17 not yet calculated CVE-2022-45701
MISC
MISC comfast — router Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to perform any HTTP request to an unauthenticated page to force the server to generate a SESSION_ID, and using this SESSION_ID an attacker can then perform authenticated requests. 2023-02-13 not yet calculated CVE-2022-45724
MISC
MISC
MISC comfast — router Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to execute arbitrary code on the target via an HTTP POST request 2023-02-13 not yet calculated CVE-2022-45725
MISC
MISC
MISC wordpress — wordpress The Twenty20 Image Before-After WordPress plugin through 1.5.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks 2023-02-13 not yet calculated CVE-2022-4580
MISC

open_solutions_for_education — opensis_community_edition

Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php. 2023-02-13 not yet calculated CVE-2022-45962
MISC
MISC
MISC
CONFIRM
MISC wordpress — wordpress The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks 2023-02-13 not yet calculated CVE-2022-4628
MISC wordpress — wordpress The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.5 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. 2023-02-13 not yet calculated CVE-2022-4656
MISC wordpress — wordpress The TemplatesNext ToolKit WordPress plugin before 3.2.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. 2023-02-13 not yet calculated CVE-2022-4678
MISC wordpress — wordpress The Lightbox Gallery WordPress plugin before 0.9.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks 2023-02-13 not yet calculated CVE-2022-4682
MISC wordpress — wordpress Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.7 versions. 2023-02-14 not yet calculated CVE-2022-46862
MISC ampere_computing — multiple_products In Ampere AltraMax and Ampere Altra before 2.10c, improper access controls allows the OS to reinitialize a disabled root complex. 2023-02-15 not yet calculated CVE-2022-46892
MISC playsms — playsms A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication. 2023-02-13 not yet calculated CVE-2022-47034
MISC
MISC pandora_fms — console
Stored cross-site scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker typically exploits this vulnerability by injecting XSS payloads on popular pages of a site or passing a link to a victim, tricking them into viewing the page that contains the stored XSS payload. 2023-02-15 not yet calculated CVE-2022-47372
CONFIRM pandora_fms — console Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript payload. 2023-02-15 not yet calculated CVE-2022-47373
CONFIRM wordpress — wordpress
The WP Customer Area WordPress plugin before 8.1.4 does not have CSRF checks when performing some actions such as chmod, mkdir and copy, which could allow attackers to make a logged-in admin perform them and create arbitrary folders, copy file for example. 2023-02-13 not yet calculated CVE-2022-4745
MISC solarwinds — platform SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands. 2023-02-15 not yet calculated CVE-2022-47503
MISC
MISC solarwinds — platform SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands. 2023-02-15 not yet calculated CVE-2022-47504
MISC
MISC solarwinds — platform SolarWinds Platform was susceptible to the Directory Traversal Vulnerability. This vulnerability allows a local adversary with authenticated account access to edit the default configuration, enabling the execution of arbitrary commands. 2023-02-15 not yet calculated CVE-2022-47506
MISC
MISC solarwinds — platform SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands. 2023-02-15 not yet calculated CVE-2022-47507
MISC
MISC solarwinds — platform Customers who had configured their polling to occur via Kerberos did not expect NTLM Traffic on their environment, but since we were querying for data via IP address this prevented us from utilizing Kerberos. 2023-02-15 not yet calculated CVE-2022-47508
MISC
MISC wordpress — wordpress The GigPress WordPress plugin before 2.3.28 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks 2023-02-13 not yet calculated CVE-2022-4759
MISC tianjie — cpe906-3 TIANJIE CPE906-3 is vulnerable to password disclosure. This is present on Software Version WEB5.0_LCD_20200513, Firmware Version MV8.003, and Hardware Version CPF906-V5.0_LCD_20200513. 2023-02-16 not yet calculated CVE-2022-47703
MISC wordpress — wordpress The Youtube Channel Gallery WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks 2023-02-13 not yet calculated CVE-2022-4783
MISC siemens — multiple_products A vulnerability has been identified in JT Open (All versions < V11.2.3.0), JT Utilities (All versions < V13.2.3.0), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Parasolid V35.1 (All versions < V35.1.150). The affected application contains a stack overflow vulnerability while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. 2023-02-14 not yet calculated CVE-2022-47936
MISC siemens — multiple_products
A vulnerability has been identified in JT Open (All versions < V11.2.3.0), JT Utilities (All versions < V13.2.3.0). The affected application contains a memory corruption vulnerability while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. 2023-02-14 not yet calculated CVE-2022-47977
MISC ibm — aspera_faspex IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512. 2023-02-17 not yet calculated CVE-2022-47986
MISC
MISC genymotion — desktop Genymotion Desktop v3.3.2 was discovered to contain a DLL hijacking vulnerability that allows attackers to escalate privileges and execute arbitrary code via a crafted DLL. 2023-02-13 not yet calculated CVE-2022-48077
MISC
MISC jspreadsheet — jspreadsheet The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting (XSS). 2023-02-17 not yet calculated CVE-2022-48115
MISC
MISC wordpress — wordpress The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. 2023-02-13 not yet calculated CVE-2022-4830
MISC palantir — gotham
Improper Validation of Certificate with Host Mismatch vulnerability in Gotham Chat IRC helper of Palantir Gotham allows A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. This issue affects: Palantir Palantir Gotham Chat IRC helper versions prior to 30221005.210011.9242. 2023-02-16 not yet calculated CVE-2022-48306
MISC palantir — magritte-ftp It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. In the case of a successful man in the middle attack on magritte-ftp, an attacker would be able to read and modify network traffic such as authentication tokens or raw data entering a Palantir Foundry stack. 2023-02-16 not yet calculated CVE-2022-48307
MISC palantir — sls-logging It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. 2023-02-16 not yet calculated CVE-2022-48308
MISC netgear — nighthawk_wifi_mesh NETGEAR Nighthawk WiFi Mesh systems and routers are affected by a stack-based buffer overflow vulnerability. This affects MR60 before 1.1.7.132, MS60 before 1.1.7.132, R6900P before 1.3.3.154, R7000P before 1.3.3.154, R7960P before 1.4.4.94, and R8000P before 1.4.4.94. 2023-02-13 not yet calculated CVE-2022-48322
MISC sunlogin — sunflower_simplified Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker can execute arbitrary programs on the victim host by sending a crafted HTTP request, as demonstrated by /check?cmd=ping../ followed by the pathname of the powershell.exe program. 2023-02-13 not yet calculated CVE-2022-48323
MISC
MISC
MISC mapos — mapos
Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) pesquisa, (2) data, (3) data2, (4) nome, (5) descricao, (6) idDocumentos, (7) id in file application/controllers/Arquivos.php; (8) senha, (9) nomeCliente, (10) contato, (11) documento, (12) telefone, (13) celular, (14) email, (15) rua, (16) numero, (17) complemento, (18) bairro, (19) cidade, (20) estado, (21) cep, (22) idClientes, (23) id in file application/controllers/Clientes.php; (24) id, (25) tipo, (26) forma_pagamento, (27) gateway_de_pagamento, (28) excluir_id, (29) confirma_id, (30) cancela_id in file application/controllers/Cobrancas.php; (31) vencimento_de, (32) vencimento_ate, (33) cliente, (34) tipo, (35) status, (36) valor_desconto, (37) desconto, (38) periodo, (39) per_page, (40) urlAtual, (41) vencimento, (42) recebimento, (43) valor, (44) recebido, (45) formaPgto, (46) desconto_parc, (47) entrada, (48) qtdparcelas_parc, (49) valor_parc, (50) dia_pgto, (51) dia_base_pgto, (52) comissao, (53) descricao_parc, (54) cliente_parc, (55) observacoes_parc, (56) formaPgto_parc, (57) tipo_parc, (58) pagamento, (59) pago, (60) valor_desconto_editar, (61) descricao, (62) fornecedor, (63) observacoes, (64) id in file application/controllers/Financeiro.php; (65) refGarantia, (66) textoGarantia, (67) idGarantias in file application/controllers/Garantias.php; (68) email, (69) senha in file application/controllers/Login.php. 2023-02-16 not yet calculated CVE-2022-48324
MISC
MISC
MISC mapos — mapos
Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) year, (2) oldSenha, (3) novaSenha, (4) termo, (5) nome, (6) cnpj, (7) ie, (8) cep, (9) logradouro, (10) numero, (11) bairro, (12) cidade, (13) uf, (14) telefone, (15) email, (16) id, (17) app_name, (18) per_page, (19) app_theme, (20) os_notification, (21) email_automatico, (22) control_estoque, (23) notifica_whats, (24) control_baixa, (25) control_editos, (26) control_edit_vendas, (27) control_datatable, (28) pix_key, (29) os_status_list, (30) control_2vias, (31) status, (32) start, (33) end in file application/controllers/Mapos.php; (34) token, (35) senha, (36) email, (37) nomeCliente, (38) documento, (39) telefone, (40) celular, (41) rua, (42) numero, (43) complemento, (44) bairro, (45) cidade, (46) estado, (47) cep, (48) idClientes, (49) descricaoProduto, (50) defeito in file application/controllers/Mine.php; (51) pesquisa, (52) status, (53) data, (54) data2, (55) dataInicial, (56) dataFinal, (57) termoGarantia, (58) garantias_id, (59) clientes_id, (60) usuarios_id, (61) idOs, (62) garantia, (63) descricaoProduto, (64) defeito, (65) observacoes, (66) laudoTecnico, (67) id, (68) preco, (69) quantidade, (70) idProduto, (71) idOsProduto, (72) produto, (73) idServico, (74) idOsServico, (75) desconto, (76) tipoDesconto, (77) resultado, (78) vencimento, (79) recebimento, (80) os_id, (81) valor, (82) recebido, (83) formaPgto, (84) tipo, (85) anotacao, (86) idAnotacao in file application/controllers/Os.php. 2023-02-16 not yet calculated CVE-2022-48325
MISC
MISC
MISC mapos — mapos
Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) nome, (2) aCliente, (3) eCliente, (4) dCliente, (5) vCliente, (6) aProduto, (7) eProduto, (8) dProduto, (9) vProduto, (10) aServico, (11) eServico, (12) dServico, (13) vServico, (14) aOs, (15) eOs, (16) dOs, (17) vOs, (18) aVenda, (19) eVenda, (20) dVenda, (21) vVenda, (22) aGarantia, (23) eGarantia, (24) dGarantia, (25) vGarantia, (26) aArquivo, (27) eArquivo, (28) dArquivo, (29) vArquivo, (30) aPagamento, (31) ePagamento, (32) dPagamento, (33) vPagamento, (34) aLancamento, (35) eLancamento, (36) dLancamento, (37) vLancamento, (38) cUsuario, (39) cEmitente, (40) cPermissao, (41) cBackup, (42) cAuditoria, (43) cEmail, (44) cSistema, (45) rCliente, (46) rProduto, (47) rServico, (48) rOs, (49) rVenda, (50) rFinanceiro, (51) aCobranca, (52) eCobranca, (53) dCobranca, (54) vCobranca, (55) situacao, (56) idPermissao, (57) id in file application/controllers/Permissoes.php; (58) precoCompra, (59) precoVenda, (60) descricao, (61) unidade, (62) estoque, (63) estoqueMinimo, (64) idProdutos, (65) id, (66) estoqueAtual in file application/controllers/Produtos.php. 2023-02-16 not yet calculated CVE-2022-48326
MISC
MISC
MISC mapos — mapos
Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) dataInicial, (2) dataFinal, (3) tipocliente, (4) format, (5) precoInicial, (6) precoFinal, (7) estoqueInicial, (8) estoqueFinal, (9) de_id, (10) ate_id, (11) clientes_id, (12) origem, (13) cliente, (14) responsavel, (15) status, (16) tipo, (17) situacao in file application/controllers/Relatorios.php; (18) preco, (19) nome, (20) descricao, (21) idServicos, (22) id in file application/controllers/Servicos.php; (23) senha, (24) permissoes_id, (25) idUsuarios, (26) situacao, (27) nome, (28) rg, (29) cpf, (30) cep, (31) rua, (32) numero, (33) bairro, (34) cidade, (35) estado, (36) email, (37) telefone, (38) celular in file application/controllers/Usuarios.php; (39) dataVenda, (40) observacoes, (41) observacoes_cliente, (42) clientes_id, (43) usuarios_id, (44) idVendas, (45) id, (46) idVendasProduto, (47) preco, (48) quantidade, (49) idProduto, (50) produto, (51) desconto, (52) tipoDesconto, (53) resultado, (54) vendas_id, (55) vencimento, (56) recebimento, (57) valor, (58) recebido, (59) formaPgto, (60) tipo in file application/controllers/Vendas.php; (61) situacao, (62) periodo, (63) vencimento_de, (64) vencimento_ate, (65) tipo, (66) status, (67) cliente in file application/views/financeiro/lancamentos.php; (68) year in file application/views/mapos/painel.php; (69) pesquisa in file application/views/os/os.php; (70) etiquetaCode in file application/views/relatorios/imprimir/imprimirEtiquetas.php. 2023-02-16 not yet calculated CVE-2022-48327
MISC
MISC
MISC wordpress — wordpress
A vulnerability was found in UDX Stateless Media Plugin 3.1.1. It has been declared as problematic. This vulnerability affects the function setup_wizard_interface of the file lib/classes/class-settings.php. The manipulation of the argument settings leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.2.0 is able to address this issue. The name of the patch is 6aee7ae0b0beeb2232ce6e1c82aa7e2041ae151a. It is recommended to upgrade the affected component. VDB-220750 is the identifier assigned to this vulnerability. 2023-02-13 not yet calculated CVE-2022-4905
MISC
MISC
MISC
MISC
MISC sap_se — grc In SAP GRC (Process Control) – versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module in the proprietary SAP solution enables an authenticated attacker with minimal privileges to access all the confidential data stored in the database. Successful exploitation of this vulnerability can expose user credentials from client-specific tables of the database, leading to high impact on confidentiality. 2023-02-14 not yet calculated CVE-2023-0019
MISC
MISC sap_se — businessobjects_business_intelligence_platform SAP BusinessObjects Business Intelligence platform – versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high impact on confidentiality and limited impact on integrity of the application. 2023-02-14 not yet calculated CVE-2023-0020
MISC
MISC sap_se — solution_manager
SAP Solution Manager (BSP Application) – version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired resources, resulting in Cross-Site Scripting vulnerability. 2023-02-14 not yet calculated CVE-2023-0024
MISC
MISC sap_se — solution_manager SAP Solution Manager (BSP Application) – version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired resources. 2023-02-14 not yet calculated CVE-2023-0025
MISC
MISC wordpress — wordpress The JetWidgets For Elementor WordPress plugin through 1.0.13 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks 2023-02-13 not yet calculated CVE-2023-0034
MISC wordpress — wordpress The Responsive Gallery Grid WordPress plugin before 2.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. 2023-02-13 not yet calculated CVE-2023-0060
MISC wordpress — wordpress The Judge.me Product Reviews for WooCommerce WordPress plugin before 1.3.21 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. 2023-02-13 not yet calculated CVE-2023-0061
MISC wordpress — wordpress
The Amazon JS WordPress plugin through 0.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. 2023-02-13 not yet calculated CVE-2023-0075
MISC wordpress — wordpress The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability. 2023-02-13 not yet calculated CVE-2023-0080
MISC wordpress — wordpress The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated users, leading to a SQL injection exploitable by low privilege users such as subscriber. 2023-02-13 not yet calculated CVE-2023-0098
MISC wordpress — wordpress The Simple URLs WordPress plugin before 115 does not sanitise and escape some parameters before outputting them back in some pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin. 2023-02-13 not yet calculated CVE-2023-0099
MISC ls_electric — xbc-dn32u LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication for its deletion command. This could allow an attacker to delete arbitrary files. 2023-02-15 not yet calculated CVE-2023-0102
MISC ls_electric — xbc-dn32u If an attacker were to access memory locations of LS ELECTRIC XBC-DN32U with operating system version 01.80 that are outside of the communication buffer, the device stops operating. This could allow an attacker to cause a denial-of-service condition. 2023-02-15 not yet calculated CVE-2023-0103
MISC wordpress — wordpress The uTubeVideo Gallery WordPress plugin before 2.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. 2023-02-13 not yet calculated CVE-2023-0151
MISC gnutls — gnutls A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection. 2023-02-15 not yet calculated CVE-2023-0361
MISC
MISC
MISC
MLIST hashicorp — gogetter HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0. 2023-02-16 not yet calculated CVE-2023-0475
MISC resteasy — resteasy In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user. 2023-02-17 not yet calculated CVE-2023-0482
MISC gitlab — gitlab An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. It was possible to trigger a DoS attack by uploading a malicious Helm chart. 2023-02-13 not yet calculated CVE-2023-0518
CONFIRM
MISC
MISC php — php In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification. 2023-02-16 not yet calculated CVE-2023-0568
MISC sonicwall — email_security SonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes sensitive information about users email addresses. 2023-02-14 not yet calculated CVE-2023-0655
CONFIRM php — php In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries. This can cause denial of service on the affected server by exhausting CPU resources or disk space. 2023-02-16 not yet calculated CVE-2023-0662
MISC multiple_vendors — inverter A vulnerability was found in Deye/Revolt/Bosswerk Inverter MW3_15U_5406_1.47/MW3_15U_5406_1.471. It has been rated as problematic. This issue affects some unknown processing of the component Access Point Setting Handler. The manipulation with the input 12345678 leads to use of hard-coded password. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. Upgrading to version MW3_16U_5406_1.53 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-220769 was assigned to this vulnerability. 2023-02-13 not yet calculated CVE-2023-0808
MISC
MISC
MISC btcpayserver — btcpayserver Cross-site Scripting (XSS) – Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.11. 2023-02-13 not yet calculated CVE-2023-0810
CONFIRM
MISC

gpac — gpac

Buffer Over-read in GitHub repository gpac/gpac prior to v2.3.0-DEV. 2023-02-13 not yet calculated CVE-2023-0817
MISC
CONFIRM

gpac — gpac

Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV. 2023-02-13 not yet calculated CVE-2023-0818
MISC
CONFIRM

gpac — gpac

Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to v2.3.0-DEV. 2023-02-13 not yet calculated CVE-2023-0819
MISC
CONFIRM

hashicorp — multiple_products

HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause excessive disk usage. Fixed in 1.2.16, 1.3.9, and 1.4.4. 2023-02-16 not yet calculated CVE-2023-0821
MISC

delta_electronics — dianergie

The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality. 2023-02-17 not yet calculated CVE-2023-0822
MISC

pimcore — pimcore

Cross-site Scripting (XSS) – Stored in GitHub repository pimcore/pimcore prior to 1.5.17. 2023-02-14 not yet calculated CVE-2023-0827
MISC
CONFIRM

easynas — easynas

A vulnerability classified as critical has been found in EasyNAS 1.1.0. Affected is the function system of the file /backup.pl. The manipulation leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. VDB-220950 is the identifier assigned to this vulnerability. 2023-02-14 not yet calculated CVE-2023-0830
MISC
MISC
MISC

phpcrazy — phpcrazy

A vulnerability classified as problematic was found in PHPCrazy 1.1.1. This vulnerability affects unknown code of the file admin/admin.php?action=users&mode=info&user=2. The manipulation of the argument username leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221086 is the identifier assigned to this vulnerability. 2023-02-15 not yet calculated CVE-2023-0840
MISC
MISC
MISC

gpac — gpac

A vulnerability, which was classified as critical, has been found in GPAC 2.3-DEV-rev40-g3602a5ded. This issue affects the function mp3_dmx_process of the file filters/reframe_mp3.c. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221087. 2023-02-15 not yet calculated CVE-2023-0841
MISC
MISC
MISC

netgear — wndr3700v2

A vulnerability was found in Netgear WNDR3700v2 1.0.1.14. It has been rated as problematic. This issue affects some unknown processing of the component Web Management Interface. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221147. 2023-02-15 not yet calculated CVE-2023-0848
MISC
MISC

netgear — wndr3700v2

A vulnerability has been found in Netgear WNDR3700v2 1.0.1.14 and classified as critical. This vulnerability affects unknown code of the component Web Interface. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221152. 2023-02-15 not yet calculated CVE-2023-0849
MISC
MISC

netgear — wndr3700v2

A vulnerability was found in Netgear WNDR3700v2 1.0.1.14 and classified as problematic. This issue affects some unknown processing of the component Web Interface. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221153 was assigned to this vulnerability. 2023-02-15 not yet calculated CVE-2023-0850
MISC
MISC

modoboa –modoboa-installer

Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4. 2023-02-16 not yet calculated CVE-2023-0860
CONFIRM
MISC netmodule — nsrw NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. This issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103. 2023-02-16 not yet calculated CVE-2023-0861
MISC
MISC

netmodule — nsrw

The NetModule NSRW web administration interface is vulnerable to path traversals, which could lead to arbitrary file uploads and deletion. By uploading malicious files to the web root directory, authenticated users could gain remote command execution with elevated privileges. This issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103. 2023-02-16 not yet calculated CVE-2023-0862
MISC
MISC

gpac — gpac

Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3.0-DEV. 2023-02-16 not yet calculated CVE-2023-0866
CONFIRM
MISC

froxlor — froxlor

Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11. 2023-02-17 not yet calculated CVE-2023-0877
CONFIRM
MISC

nuxt — nuxt

Cross-site Scripting (XSS) – Generic in GitHub repository nuxt/framework prior to 3.2.1. 2023-02-17 not yet calculated CVE-2023-0878
MISC
CONFIRM

btcpayserver — btcpay_server

Cross-site Scripting (XSS) – Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.12. 2023-02-17 not yet calculated CVE-2023-0879
CONFIRM
MISC phpmyfaq — phpmyfaq Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11. 2023-02-17 not yet calculated CVE-2023-0880
MISC
CONFIRM

kron_technologies –kron_tech_single_connect

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Kron Tech Single Connect on Windows allows Privilege Abuse. This issue affects Single Connect: 2.16. 2023-02-17 not yet calculated CVE-2023-0882
MISC
MISC

sourcecodester — online_pizza_ordering_system

A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file /php-opos/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221350 is the identifier assigned to this vulnerability. 2023-02-17 not yet calculated CVE-2023-0883
MISC
MISC
MISC

tftpd64 — tftpd64

A vulnerability was found in phjounin TFTPD64-SE 4.64 and classified as critical. This issue affects some unknown processing of the file tftpd64_svc.exe. The manipulation leads to unquoted search path. An attack has to be approached locally. The associated identifier of this vulnerability is VDB-221351. 2023-02-17 not yet calculated CVE-2023-0887
MISC
MISC

wordpress — wordpress

The WP Coder – add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrative privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2023-02-17 not yet calculated CVE-2023-0895
MISC
MISC

pixelfed — pixelfed

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pixelfed/pixelfed prior to 0.11.4. 2023-02-18 not yet calculated CVE-2023-0901
CONFIRM
MISC

sourcecodester — simple_food_ordering_system

A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file process_order.php. The manipulation of the argument order leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221451. 2023-02-18 not yet calculated CVE-2023-0902
MISC
MISC
MISC

sourcecodester — employee_task_management_system

A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file edit-task.php. The manipulation of the argument task_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221452. 2023-02-18 not yet calculated CVE-2023-0903
MISC
MISC
MISC

sourcecodester — employee_task_management_system

A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file task-details.php. The manipulation of the argument task_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221453 was assigned to this vulnerability. 2023-02-18 not yet calculated CVE-2023-0904
MISC
MISC
MISC

sourcecodester — employee_task_management_system

A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function of the file changePasswordForEmployee.php. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221454 is the identifier assigned to this vulnerability. 2023-02-18 not yet calculated CVE-2023-0905
MISC
MISC
MISC sourcecodester — online_pizza_ordering_system A vulnerability classified as critical was found in SourceCodester Online Pizza Ordering System 1.0. Affected by this vulnerability is the function delete_category of the file ajax.php of the component POST Parameter Handler. The manipulation leads to missing authentication. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-221455. 2023-02-18 not yet calculated CVE-2023-0906
MISC
MISC

filseclab — twister_antivirus

A vulnerability, which was classified as problematic, has been found in Filseclab Twister Antivirus 8.17. Affected by this issue is some unknown functionality in the library ffsmon.sys of the component IoControlCode Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221456. 2023-02-18 not yet calculated CVE-2023-0907
MISC
MISC
MISC

xoslab — easy_file_locker

A vulnerability, which was classified as problematic, was found in Xoslab Easy File Locker 2.2.0.184. This affects the function MessageNotifyCallback in the library xlkfs.sys. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-221457 was assigned to this vulnerability. 2023-02-18 not yet calculated CVE-2023-0908
MISC
MISC
MISC

snyk — cxasm/notepad

A vulnerability, which was classified as problematic, was found in cxasm notepad– 1.22. This affects an unknown part of the component Directory Comparison Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The associated identifier of this vulnerability is VDB-221475. 2023-02-18 not yet calculated CVE-2023-0909
MISC
MISC
MISC

sourcecodester — online_pizza_ordering_system

A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file view_prod.php of the component GET Parameter Handler. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The identifier of this vulnerability is VDB-221476. 2023-02-18 not yet calculated CVE-2023-0910
MISC
MISC

sourcecodester — auto_dealer_management_system

A vulnerability classified as critical has been found in SourceCodester Auto Dealer Management System 1.0. This affects an unknown part of the file /adms/admin/?page=vehicles/view_transaction. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221481 was assigned to this vulnerability. 2023-02-18 not yet calculated CVE-2023-0912
MISC
MISC
MISC

sourcecodester — auto_dealer_management_system

A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. This vulnerability affects unknown code of the file /adms/admin/?page=vehicles/sell_vehicle. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221482 is the identifier assigned to this vulnerability. 2023-02-18 not yet calculated CVE-2023-0913
MISC
MISC
MISC google — androidmanifest.xml In permissions of AndroidManifest.xml, there is a possible way to grant signature permissions due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-244216503 2023-02-15 not yet calculated CVE-2023-20927
MISC google — multiple_products In s2mpg11_pmic_probe of s2mpg11-regulator.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-259323133References: N/A 2023-02-15 not yet calculated CVE-2023-20949
MISC