CVE & Exploit Intelligence Database

CVE-2022-31649 7.5 HIGH EPSS 0.00

ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer.

CWE-668 Jun 09, 2022

CVE-2021-36710 8.8 HIGH 1 Writeup EPSS 0.00

ToaruOS 1.99.2 is affected by incorrect access control via the kernel. Improper MMU management and having a low GDT address allows it to be mapped in userland. A call gate can then be written to escalate to CPL 0.

CWE-668 Jun 08, 2022

CVE-2022-30734 4.0 MEDIUM EPSS 0.00

Sensitive information exposure in Sign-out log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without permission.

CWE-200 Jun 07, 2022

CVE-2022-30732 5.5 MEDIUM EPSS 0.00

Exposure of Sensitive Information vulnerability in Samsung Account prior to version 13.2.00.6 allows attacker to access sensitive information via onActivityResult.

CWE-200 Jun 07, 2022

CVE-2022-30728 1.9 LOW EPSS 0.00

Information exposure vulnerability in ScanPool prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information.

CWE-213 Jun 07, 2022

CVE-2022-30714 1.9 LOW EPSS 0.00

Information exposure vulnerability in SemIWCMonitor prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information.

CWE-213 Jun 07, 2022

CVE-2022-28794 2.2 LOW EPSS 0.00

Sensitive information exposure in low-battery dumpstate log prior to SMR Jun-2022 Release 1 allows local attackers to get SIM card information.

CWE-213 Jun 07, 2022

CVE-2020-36532 4.3 MEDIUM EPSS 0.00

A vulnerability has been found in Klapp App and classified as problematic. This vulnerability affects unknown code of the component Authorization. The manipulation leads to information disclosure (Credentials). The attack can be initiated remotely. It is recommended to upgrade the affected app.

CWE-200 Jun 07, 2022

CVE-2022-26869 9.8 CRITICAL EPSS 0.03

Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure and arbitrary code execution.

CWE-200 Jun 02, 2022

CVE-2022-1467 7.4 HIGH EPSS 0.00

Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere applications. It is possible to manipulate the Windows OS language bar to launch an OS command prompt, resulting in a context-escape from application into OS.

CWE-668 May 23, 2022

CVE-2022-28924 6.5 MEDIUM EPSS 0.00

An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/.

CWE-668 May 18, 2022

CVE-2022-29646 5.3 MEDIUM 1 Writeup EPSS 0.00

An access control issue in TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 allows attackers to obtain sensitive information via a crafted web request.

CWE-668 May 18, 2022

CVE-2021-43066 8.4 HIGH EPSS 0.00

A external control of file name or path in Fortinet FortiClientWindows version 7.0.2 and below, version 6.4.6 and below, version 6.2.9 and below, version 6.0.10 and below allows attacker to escalate privilege via the MSI installer.

CWE-668 May 11, 2022

CVE-2022-24823 5.5 MEDIUM 1 Writeup EPSS 0.00

Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.

CWE-378 May 06, 2022

CVE-2022-24900 9.9 CRITICAL 1 Writeup NUCLEI EPSS 0.69

Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The `os.path.join` call is unsafe for use with untrusted input. When the `os.path.join` call encounters an absolute path, it ignores all the parameters it has encountered till that point and starts working with the new absolute path. Since the "malicious" parameter represents an absolute path, the result of `os.path.join` ignores the static directory completely. Hence, untrusted input is passed via the `os.path.join` call to `flask.send_file` can lead to path traversal attacks. A patch with a fix is available on the `master` branch of the GitHub repository. This can also be fixed by preventing flow of untrusted data to the vulnerable `send_file` function. In case the application logic necessiates this behaviour, one can either use the `flask.safe_join` to join untrusted paths or replace `flask.send_file` calls with `flask.send_from_directory` calls.

CWE-22 Apr 29, 2022

CVE-2022-29820 3.0 LOW EPSS 0.00

In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible

CWE-1327 Apr 28, 2022

CVE-2022-27331 4.3 MEDIUM EPSS 0.00

An access control issue in Zammad v5.0.3 broadcasts administrative configuration changes to all users who have an active application instance, including settings that should only be visible to authenticated users.

CWE-668 Apr 27, 2022

CVE-2022-1385 3.7 LOW EPSS 0.00

Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.

CWE-668 Apr 19, 2022

CVE-2022-27817 4.4 MEDIUM EPSS 0.00

SWHKD 1.1.5 consumes the keyboard events of unintended users. This could potentially cause an information leak, but is usually a denial of functionality.

CWE-668 Apr 14, 2022

CVE-2022-24411 7.8 HIGH EPSS 0.00

Dell PowerScale OneFS 8.2.2 and above contain an elevation of privilege vulnerability. A local attacker with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE could potentially exploit this vulnerability, leading to elevation of privilege. This could potentially allow users to circumvent PowerScale Compliance Mode guarantees.

CWE-378 Apr 12, 2022