| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-38296 | Hig | 0.49 | 7.5 | 0.02 | Mar 10, 2022 | Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive… | ||
| CVE-2022-0890 | Med | 0.36 | 5.5 | 0.01 | Mar 10, 2022 | NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2. | ||
| CVE-2022-24753 | Hig | 0.43 | 7.7 | 0.00 | Mar 9, 2022 | Stripe CLI is a command-line tool for the Stripe eCommerce platform. A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directory where an attacker has planted files. The commands are `stripe login`, `stripe config -e`, `stripe community`, and… | ||
| CVE-2022-24748 | Med | 0.37 | 6.8 | 0.01 | Mar 9, 2022 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modify customers and to create orders without App Permission. This issue is a result of improper api route checking. Users… | ||
| CVE-2022-24747 | Med | 0.34 | 6.3 | 0.01 | Mar 9, 2022 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sensitive HTTP headers to be non-cacheable. If there is an HTTP cache between the server and client then headers may be… | ||
| CVE-2022-24746 | Med | 0.33 | 6.1 | 0.01 | Mar 9, 2022 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possible to inject code via the voucher code form. This issue has been patched in version 6.4.8.1. There are no known workarounds for this issue. | ||
| CVE-2022-24745 | Med | 0.31 | 4.8 | 0.01 | Mar 9, 2022 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared between customers when HTTP cache is enabled. This can lead to inconsistent experiences for guest users. Setups with Varnish… | ||
| CVE-2022-24744 | Low | 0.10 | 2.6 | 0.00 | Mar 9, 2022 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of… | ||
| CVE-2022-24323 | Med | 0.35 | 5.3 | 0.01 | Mar 9, 2022 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software, when an attacker is able to intercept and manipulate specific Modbus response data.… | ||
| CVE-2022-24322 | Med | 0.34 | 5.3 | 0.01 | Mar 9, 2022 | A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software when an attacker is able to intercept and manipulate specific Modbus… | ||
| CVE-2021-22783 | Hig | 0.57 | 8.8 | 0.00 | Mar 9, 2022 | A CWE-200: Information Exposure vulnerability exists which could allow a session hijack when the door panel is communicating with the door. Affected Product: Ritto Wiser Door (All versions) | ||
| CVE-2022-24741 | Low | 0.00 | 3.5 | 0.02 | Mar 9, 2022 | Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading specially crafted files which will cause the server to allocate too much memory / CPU. It is recommended that the Nextcloud… | ||
| CVE-2022-24734 | Hig | 0.49 | 7.2 | 0.78 | Mar 9, 2022 | MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type `php` with PHP code, executed on on _Change… | ||
| CVE-2022-24919 | Low | 0.24 | 3.7 | 0.01 | Mar 9, 2022 | An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code… | ||
| CVE-2022-24918 | Low | 0.24 | 3.7 | 0.01 | Mar 9, 2022 | An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code… | ||
| CVE-2022-24917 | Low | 0.24 | 3.7 | 0.01 | Mar 9, 2022 | An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious… | ||
| CVE-2022-24732 | Med | 0.34 | 6.3 | 0.00 | Mar 9, 2022 | Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired… | ||
| CVE-2022-24349 | Med | 0.30 | 4.6 | 0.01 | Mar 9, 2022 | An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to… | ||
| CVE-2022-22806 | Cri | 0.65 | 9.8 | 0.12 | Mar 9, 2022 | A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malformed connection is sent. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC… | ||
| CVE-2022-22805 | Cri | 0.65 | 9.8 | 0.12 | Mar 9, 2022 | A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperly handled TLS packet is reassembled. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and… | ||
| CVE-2022-22511 | Med | 0.35 | 5.4 | 0.00 | Mar 9, 2022 | Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use this to gain access to confidential information on a PC that connects to the WBM after it has been compromised. | ||
| CVE-2022-0715 | Cri | 0.60 | 9.1 | 0.06 | Mar 9, 2022 | A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series (SMT Series ID=18: UPS 09.8 and prior… | ||
| CVE-2022-0022 | Med | 0.27 | 4.1 | 0.00 | Mar 9, 2022 | Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not created with a sufficient level of computational effort, which allows for password cracking attacks on accounts in normal… | ||
| CVE-2022-24526 | Med | 0.40 | 6.1 | 0.02 | Mar 9, 2022 | Visual Studio Code Spoofing Vulnerability | ||
| CVE-2022-24525 | Hig | 0.46 | 7.0 | 0.00 | Mar 9, 2022 | Windows Update Stack Elevation of Privilege Vulnerability | ||
| CVE-2022-24522 | Med | 0.42 | 6.5 | 0.02 | Mar 9, 2022 | Skype Extension for Chrome Information Disclosure Vulnerability | ||
| CVE-2022-24520 | Hig | 0.47 | 7.2 | 0.02 | Mar 9, 2022 | Azure Site Recovery Remote Code Execution Vulnerability | ||
| CVE-2022-24519 | Med | 0.42 | 6.5 | 0.03 | Mar 9, 2022 | Azure Site Recovery Elevation of Privilege Vulnerability | ||
| CVE-2022-24518 | Med | 0.42 | 6.5 | 0.03 | Mar 9, 2022 | Azure Site Recovery Elevation of Privilege Vulnerability | ||
| CVE-2022-24517 | Hig | 0.47 | 7.2 | 0.02 | Mar 9, 2022 | Azure Site Recovery Remote Code Execution Vulnerability | ||
| CVE-2022-24515 | Med | 0.42 | 6.5 | 0.03 | Mar 9, 2022 | Azure Site Recovery Elevation of Privilege Vulnerability | ||
| CVE-2022-24512 | Med | 0.34 | 6.3 | 0.02 | Mar 9, 2022 | .NET and Visual Studio Remote Code Execution Vulnerability | ||
| CVE-2022-24511 | Med | 0.36 | 5.5 | 0.01 | Mar 9, 2022 | Microsoft Office Word Tampering Vulnerability | ||
| CVE-2022-24510 | Hig | 0.51 | 7.8 | 0.03 | Mar 9, 2022 | Microsoft Office Visio Remote Code Execution Vulnerability | ||
| CVE-2022-24509 | Hig | 0.51 | 7.8 | 0.03 | Mar 9, 2022 | Microsoft Office Visio Remote Code Execution Vulnerability | ||
| CVE-2022-24508 | Hig | 0.57 | 8.8 | 0.03 | Mar 9, 2022 | Win32 File Enumeration Remote Code Execution Vulnerability | ||
| CVE-2022-24507 | Hig | 0.51 | 7.8 | 0.04 | Mar 9, 2022 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | ||
| CVE-2022-24506 | Med | 0.42 | 6.5 | 0.03 | Mar 9, 2022 | Azure Site Recovery Elevation of Privilege Vulnerability | ||
| CVE-2022-24505 | Hig | 0.46 | 7.0 | 0.00 | Mar 9, 2022 | Windows ALPC Elevation of Privilege Vulnerability | ||
| CVE-2022-24503 | Med | 0.35 | 5.4 | 0.02 | Mar 9, 2022 | Remote Desktop Protocol Client Information Disclosure Vulnerability | ||
| CVE-2022-24502 | Med | 0.31 | 4.3 | 0.33 | Mar 9, 2022 | Windows HTML Platforms Security Feature Bypass Vulnerability | ||
| CVE-2022-24501 | Hig | 0.51 | 7.8 | 0.03 | Mar 9, 2022 | VP9 Video Extensions Remote Code Execution Vulnerability | ||
| CVE-2022-24471 | Hig | 0.47 | 7.2 | 0.02 | Mar 9, 2022 | Azure Site Recovery Remote Code Execution Vulnerability | ||
| CVE-2022-24470 | Hig | 0.47 | 7.2 | 0.02 | Mar 9, 2022 | Azure Site Recovery Remote Code Execution Vulnerability | ||
| CVE-2022-24469 | Hig | 0.53 | 8.1 | 0.03 | Mar 9, 2022 | Azure Site Recovery Elevation of Privilege Vulnerability | ||
| CVE-2022-24468 | Hig | 0.47 | 7.2 | 0.02 | Mar 9, 2022 | Azure Site Recovery Remote Code Execution Vulnerability | ||
| CVE-2022-24467 | Hig | 0.47 | 7.2 | 0.02 | Mar 9, 2022 | Azure Site Recovery Remote Code Execution Vulnerability | ||
| CVE-2022-24465 | Low | 0.22 | 3.3 | 0.01 | Mar 9, 2022 | Microsoft Intune Portal for iOS Security Feature Bypass Vulnerability | ||
| CVE-2022-24464 | Hig | 0.49 | 7.5 | 0.03 | Mar 9, 2022 | .NET and Visual Studio Denial of Service Vulnerability | ||
| CVE-2022-24463 | Med | 0.45 | 6.5 | 0.32 | Mar 9, 2022 | Microsoft Exchange Server Spoofing Vulnerability |
- risk 0.49cvss 7.5epss 0.02
Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive…
- risk 0.36cvss 5.5epss 0.01
NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2.
- risk 0.43cvss 7.7epss 0.00
Stripe CLI is a command-line tool for the Stripe eCommerce platform. A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directory where an attacker has planted files. The commands are `stripe login`, `stripe config -e`, `stripe community`, and…
- risk 0.37cvss 6.8epss 0.01
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modify customers and to create orders without App Permission. This issue is a result of improper api route checking. Users…
- risk 0.34cvss 6.3epss 0.01
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sensitive HTTP headers to be non-cacheable. If there is an HTTP cache between the server and client then headers may be…
- risk 0.33cvss 6.1epss 0.01
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possible to inject code via the voucher code form. This issue has been patched in version 6.4.8.1. There are no known workarounds for this issue.
- risk 0.31cvss 4.8epss 0.01
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared between customers when HTTP cache is enabled. This can lead to inconsistent experiences for guest users. Setups with Varnish…
- risk 0.10cvss 2.6epss 0.00
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of…
- risk 0.35cvss 5.3epss 0.01
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software, when an attacker is able to intercept and manipulate specific Modbus response data.…
- risk 0.34cvss 5.3epss 0.01
A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software when an attacker is able to intercept and manipulate specific Modbus…
- risk 0.57cvss 8.8epss 0.00
A CWE-200: Information Exposure vulnerability exists which could allow a session hijack when the door panel is communicating with the door. Affected Product: Ritto Wiser Door (All versions)
- risk 0.00cvss 3.5epss 0.02
Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading specially crafted files which will cause the server to allocate too much memory / CPU. It is recommended that the Nextcloud…
- risk 0.49cvss 7.2epss 0.78
MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type `php` with PHP code, executed on on _Change…
- risk 0.24cvss 3.7epss 0.01
An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code…
- risk 0.24cvss 3.7epss 0.01
An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code…
- risk 0.24cvss 3.7epss 0.01
An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious…
- risk 0.34cvss 6.3epss 0.00
Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired…
- risk 0.30cvss 4.6epss 0.01
An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to…
- risk 0.65cvss 9.8epss 0.12
A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malformed connection is sent. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC…
- risk 0.65cvss 9.8epss 0.12
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperly handled TLS packet is reassembled. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and…
- risk 0.35cvss 5.4epss 0.00
Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use this to gain access to confidential information on a PC that connects to the WBM after it has been compromised.
- risk 0.60cvss 9.1epss 0.06
A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series (SMT Series ID=18: UPS 09.8 and prior…
- risk 0.27cvss 4.1epss 0.00
Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not created with a sufficient level of computational effort, which allows for password cracking attacks on accounts in normal…
- risk 0.40cvss 6.1epss 0.02
Visual Studio Code Spoofing Vulnerability
- risk 0.46cvss 7.0epss 0.00
Windows Update Stack Elevation of Privilege Vulnerability
- risk 0.42cvss 6.5epss 0.02
Skype Extension for Chrome Information Disclosure Vulnerability
- risk 0.47cvss 7.2epss 0.02
Azure Site Recovery Remote Code Execution Vulnerability
- risk 0.42cvss 6.5epss 0.03
Azure Site Recovery Elevation of Privilege Vulnerability
- risk 0.42cvss 6.5epss 0.03
Azure Site Recovery Elevation of Privilege Vulnerability
- risk 0.47cvss 7.2epss 0.02
Azure Site Recovery Remote Code Execution Vulnerability
- risk 0.42cvss 6.5epss 0.03
Azure Site Recovery Elevation of Privilege Vulnerability
- risk 0.34cvss 6.3epss 0.02
.NET and Visual Studio Remote Code Execution Vulnerability
- risk 0.36cvss 5.5epss 0.01
Microsoft Office Word Tampering Vulnerability
- risk 0.51cvss 7.8epss 0.03
Microsoft Office Visio Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.03
Microsoft Office Visio Remote Code Execution Vulnerability
- risk 0.57cvss 8.8epss 0.03
Win32 File Enumeration Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.04
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- risk 0.42cvss 6.5epss 0.03
Azure Site Recovery Elevation of Privilege Vulnerability
- risk 0.46cvss 7.0epss 0.00
Windows ALPC Elevation of Privilege Vulnerability
- risk 0.35cvss 5.4epss 0.02
Remote Desktop Protocol Client Information Disclosure Vulnerability
- risk 0.31cvss 4.3epss 0.33
Windows HTML Platforms Security Feature Bypass Vulnerability
- risk 0.51cvss 7.8epss 0.03
VP9 Video Extensions Remote Code Execution Vulnerability
- risk 0.47cvss 7.2epss 0.02
Azure Site Recovery Remote Code Execution Vulnerability
- risk 0.47cvss 7.2epss 0.02
Azure Site Recovery Remote Code Execution Vulnerability
- risk 0.53cvss 8.1epss 0.03
Azure Site Recovery Elevation of Privilege Vulnerability
- risk 0.47cvss 7.2epss 0.02
Azure Site Recovery Remote Code Execution Vulnerability
- risk 0.47cvss 7.2epss 0.02
Azure Site Recovery Remote Code Execution Vulnerability
- risk 0.22cvss 3.3epss 0.01
Microsoft Intune Portal for iOS Security Feature Bypass Vulnerability
- risk 0.49cvss 7.5epss 0.03
.NET and Visual Studio Denial of Service Vulnerability
- risk 0.45cvss 6.5epss 0.32
Microsoft Exchange Server Spoofing Vulnerability