CVE & Exploit Intelligence Database

CVE-2022-36923 7.5 HIGH EXPLOITED NUCLEI EPSS 0.33

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs.

CWE-755 Aug 10, 2022

CVE-2022-22202 6.5 MEDIUM EPSS 0.00

An Improper Handling of Exceptional Conditions vulnerability on specific PTX Series devices, including the PTX1000, PTX3000 (NextGen), PTX5000, PTX10002-60C, PTX10008, and PTX10016 Series, in Juniper Networks Junos OS allows an unauthenticated MPLS-based attacker to cause a Denial of Service (DoS) by triggering the dcpfe process to crash and FPC to restart. On affected PTX Series devices, processing specific MPLS packets received on an interface with multiple units configured may cause FPC to restart unexpectedly. Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. This issue only affects PTX Series devices utilizing specific FPCs found on PTX1000, PTX3000 (NextGen), PTX5000, PTX10002-60C, PTX10008, and PTX10016 Series devices, only if multiple units are configured on the ingress interface, and at least one unit has 'family mpls' *not* configured. See the configuration sample below for more information. No other platforms are affected by this vulnerability. This issue affects: Juniper Networks Junos OS on PTX Series: All versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S6; 19.4 versions prior to 19.4R3-S8; 20.1 versions prior to 20.1R3-S4; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S4; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S2; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R2; 22.1 versions prior to 22.1R2.

CWE-755 Jul 20, 2022

CVE-2021-46828 7.5 HIGH EPSS 0.01

In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.

CWE-755 Jul 20, 2022

CVE-2022-34643 5.5 MEDIUM EPSS 0.00

RISCV ISA Sim commit ac466a21df442c59962589ba296c702631e041b5 implements the incorrect exception priotrity when accessing memory.

CWE-755 Jul 18, 2022

CVE-2022-34641 5.5 MEDIUM EPSS 0.00

CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a and RISCV-Boom commit ad64c5419151e5e886daee7084d8399713b46b4b implements the incorrect exception type when a PMP violation occurs during address translation.

CWE-755 Jul 18, 2022

CVE-2022-34639 5.5 MEDIUM EPSS 0.00

CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a treats non-standard fence instructions as illegal which can affect the function of the application.

CWE-755 Jul 18, 2022

CVE-2022-34637 5.5 MEDIUM EPSS 0.00

CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a implements an incorrect exception type when an illegal virtual address is loaded.

CWE-755 Jul 18, 2022

CVE-2022-34636 5.5 MEDIUM EPSS 0.00

CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a and RISCV-Boom commit ad64c5419151e5e886daee7084d8399713b46b4b implements the incorrect exception type when a PMA violation occurs during address translation.

CWE-755 Jul 18, 2022

CVE-2022-34634 5.5 MEDIUM EPSS 0.00

CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted det instructions rather create an exception.

CWE-755 Jul 18, 2022

CVE-2022-34633 5.5 MEDIUM EPSS 0.00

CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted sfence.vma instructions rather create an exception.

CWE-755 Jul 18, 2022

CVE-2022-32990 5.5 MEDIUM EPSS 0.00

An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service (DoS).

CWE-755 Jun 24, 2022

CVE-2022-1965 8.1 HIGH EPSS 0.01

Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be deleted. User interaction is not required.

CWE-755 Jun 24, 2022

CVE-2022-27872 7.8 HIGH EPSS 0.00

A maliciously crafted PDF file may be used to dereference a pointer for read or write operation while parsing PDF files in Autodesk Navisworks 2022. The vulnerability exists because the application fails to handle a crafted PDF file, which causes an unhandled exception. An attacker can leverage this vulnerability to cause a crash or read sensitive data or execute arbitrary code.

CWE-755 Jun 21, 2022

CVE-2022-30727 6.2 MEDIUM EPSS 0.00

Improper handling of insufficient permissions vulnerability in addAppPackageNameToAllowList in PersonaManagerService prior to SMR Jun-2022 Release 1 allows local attackers to set some setting value in work space.

CWE-755 Jun 07, 2022

CVE-2022-30725 4.0 MEDIUM EPSS 0.00

Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionError function of Bluetooth prior to SMR Jun-2022 Release 1 leaks MAC address of the connected Bluetooth device.

CWE-755 Jun 07, 2022

CVE-2022-30724 4.0 MEDIUM EPSS 0.00

Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionCompleted function of Bluetooth prior to SMR Jun-2022 Release 1 leaks MAC address of the connected Bluetooth device.

CWE-755 Jun 07, 2022

CVE-2022-30723 4.0 MEDIUM EPSS 0.00

Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in activateVoiceRecognitionWithDevice function of Bluetooth prior to SMR Jun-2022 Release 1 leaks MAC address of the connected Bluetooth device.

CWE-755 Jun 07, 2022

CVE-2022-30716 4.0 MEDIUM EPSS 0.00

Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access toast message information from device.

CWE-755 Jun 07, 2022

CVE-2022-29617 6.5 MEDIUM EPSS 0.00

Due to improper error handling an authenticated user can crash CLA assistant instance. This could impact the availability of the application.

CWE-755 Jun 06, 2022

CVE-2022-31799 9.8 CRITICAL 1 Writeup EPSS 0.00

Bottle before 0.12.20 mishandles errors during early request binding.

CWE-755 Jun 02, 2022