Low-severity CVEs (page 72)
Page 72 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-4279 | Low | 3.5 | 2022-12-03 | A vulnerability classified as problematic has been found in SourceCodester Human Resource Management System 1.0. Affected is an unknown function of the file /h… |
CVE-2022-4270 | Low | 2.0 | 2022-12-02 | Incorrect privilege assignment issue in M-Files Web in M-Files Web versions before 22.5.11436.1 could have changed permissions accidentally. |
CVE-2022-41970 | Low | 2.6 | 2022-12-01 | Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview im… |
CVE-2022-41969 | Low | 2.4 | 2022-12-01 | Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user… |
CVE-2022-41968 | Low | 3.5 | 2022-12-01 | Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a dat… |
CVE-2022-3710 | Low | 2.7 | 2022-12-01 | A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API controller of Sophos Fire… |
CVE-2022-4253 | Low | 3.5 | 2022-12-01 | A vulnerability was found in SourceCodester Canteen Management System. It has been declared as problematic. This vulnerability affects the function builtin_ech… |
CVE-2022-4252 | Low | 3.5 | 2022-12-01 | A vulnerability was found in SourceCodester Canteen Management System. It has been classified as problematic. This affects the function builtin_echo of the fil… |
CVE-2022-4251 | Low | 2.4 | 2022-12-01 | A vulnerability was found in Movie Ticket Booking System and classified as problematic. Affected by this issue is some unknown functionality of the file editBo… |
CVE-2022-4250 | Low | 3.5 | 2022-12-01 | A vulnerability has been found in Movie Ticket Booking System and classified as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2022-4249 | Low | 3.5 | 2022-12-01 | A vulnerability, which was classified as problematic, was found in Movie Ticket Booking System. Affected is an unknown function of the component POST Request H… |
CVE-2022-4234 | Low | 3.5 | 2022-11-30 | A vulnerability was found in SourceCodester Canteen Management System. It has been rated as problematic. This issue affects the function builtin_echo of the fi… |
CVE-2022-1606 | Low | 2.4 | 2022-11-30 | Incorrect privilege assignment in M-Files Server versions before 22.3.11164.0 and before 22.3.11237.1 allows user to read unmanaged objects. |
CVE-2022-4233 | Low | 2.4 | 2022-11-30 | A vulnerability has been found in SourceCodester Event Registration System 1.0 and classified as problematic. Affected by this vulnerability is an unknown func… |
CVE-2022-4031 | Low | 3.8 | 2022-11-29 | The Simple:Press plugin for WordPress is vulnerable to arbitrary file modifications in versions up to, and including, 6.8 via the 'file' parameter which does n… |
CVE-2022-32967 | Low | 2.1 | 2022-11-29 | RTL8111EP-CG/RTL8111FP-CG DASH function has hard-coded password. An unauthenticated physical attacker can use the hard-coded default password during system reb… |
CVE-2022-41944 | Low | 3.5 | 2022-11-28 | Discourse is an open-source discussion platform. In stable versions prior to 2.8.12 and beta or tests-passed versions prior to 2.9.0.beta.13, under certain con… |
CVE-2022-41921 | Low | 3.5 | 2022-11-28 | Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which can cause a denial o… |
CVE-2022-41954 | Low | 3.3 | 2022-11-25 | MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or mac… |
CVE-2022-41926 | Low | 3.3 | 2022-11-25 | Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protected by broadcastPermi… |
CVE-2022-39346 | Low | 3.5 | 2022-11-25 | Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a m… |
CVE-2022-39338 | Low | 3.5 | 2022-11-25 | user_oidc is an OpenID Connect user backend for Nextcloud. Versions prior to 1.2.1 did not properly validate discovery urls which may lead to a stored cross si… |
CVE-2022-39334 | Low | 3.9 | 2022-11-25 | Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to… |
CVE-2022-4091 | Low | 3.5 | 2022-11-25 | A vulnerability was found in SourceCodester Canteen Management System. It has been classified as problematic. This affects the function query of the file food… |
CVE-2022-29832 | Low | 3.7 | 2022-11-25 | Cleartext Storage of Sensitive Information in Memory vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later, GX Works2 all versio… |
CVE-2022-4045 | Low | 3.1 | 2022-11-23 | A denial-of-service vulnerability in the Mattermost allows an authenticated user to crash the server via multiple requests to one of the API endpoints which co… |
CVE-2020-23587 | Low | 3.1 | 2022-11-23 | A vulnerability found in the OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to con… |
CVE-2022-40228 | Low | 3.7 | 2022-11-22 | IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 does not invalidat… |
CVE-2022-4087 | Low | 2.6 | 2022-11-21 | A vulnerability was found in iPXE. It has been declared as problematic. This vulnerability affects the function tls_new_ciphertext of the file src/net/tls.c of… |
CVE-2022-4066 | Low | 3.5 | 2022-11-19 | A vulnerability was found in davidmoreno onion. It has been rated as problematic. Affected by this issue is the function onion_response_flush of the file src/o… |
CVE-2022-4064 | Low | 3.7 | 2022-11-19 | A vulnerability was found in Dalli up to 3.2.2. It has been classified as problematic. Affected is the function self.meta_set of the file lib/dalli/protocol/me… |
CVE-2022-45082 | Low | 3.4 | 2022-11-18 | Multiple Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabilities in Accordions plugin <= 2.0.3 on WordPress via &addons-style-name and &accordions_or_… |
CVE-2022-41618 | Low | 3.7 | 2022-11-18 | Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress. |
CVE-2022-45471 | Low | 3.5 | 2022-11-18 | In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address |
CVE-2022-28766 | Low | 3.3 | 2022-11-17 | Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptible to a DLL injecti… |
CVE-2022-42903 | Low | 3.3 | 2022-11-17 | Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list. |
CVE-2022-4053 | Low | 2.4 | 2022-11-17 | A vulnerability was found in Student Attendance Management System. It has been classified as problematic. Affected is an unknown function of the file createCla… |
CVE-2022-41914 | Low | 3.7 | 2022-11-16 | Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity Management(SCIM) account management enabled, Zulip Ser… |
CVE-2022-39347 | Low | 2.6 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing path canonicalization and base path check for `drive` c… |
CVE-2021-4241 | Low | 2.6 | 2022-11-15 | A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/psm/Service/User.php… |
CVE-2021-4240 | Low | 2.6 | 2022-11-15 | A vulnerability, which was classified as problematic, was found in phpservermon. This affects the function generatePasswordResetToken of the file src/psm/Servi… |
CVE-2022-4006 | Low | 3.7 | 2022-11-15 | A vulnerability, which was classified as problematic, has been found in WBCE CMS. Affected by this issue is the function increase_attempts of the file wbce/fra… |
CVE-2022-45393 | Low | 3.5 | 2022-11-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs. |
CVE-2022-42001 | Low | 3.3 | 2022-11-15 | Cross-site Scripting (XSS) vulnerability in BlueSpiceBookshelf extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary… |
CVE-2022-42000 | Low | 3.3 | 2022-11-15 | Cross-site Scripting (XSS) vulnerability in BlueSpiceSocialProfile extension of BlueSpice allows user with comment permissions to inject arbitrary HTML into th… |
CVE-2022-41814 | Low | 3.3 | 2022-11-15 | Cross-site Scripting (XSS) vulnerability in BlueSpiceFoundation extension of BlueSpice allows user with regular account and edit permissions to inject arbitrar… |
CVE-2022-41789 | Low | 3.3 | 2022-11-15 | Cross-site Scripting (XSS) vulnerability in BlueSpiceDiscovery skin of BlueSpice allows logged in user with edit permissions to inject arbitrary HTML into the… |
CVE-2022-41611 | Low | 2.3 | 2022-11-15 | Cross-site Scripting (XSS) vulnerability in BlueSpiceDiscovery skin of BlueSpice allows user with admin privileges to inject arbitrary HTML into the main navig… |
CVE-2022-3958 | Low | 3.3 | 2022-11-15 | Cross-site Scripting (XSS) vulnerability in BlueSpiceUserSidebar extension of BlueSpice allows user with regular account and edit permissions to inject arbitra… |
CVE-2022-3893 | Low | 2.3 | 2022-11-15 | Cross-site Scripting (XSS) vulnerability in BlueSpiceCustomMenu extension of BlueSpice allows user with admin permissions to inject arbitrary HTML into the cus… |
CVE-2022-28764 | Low | 3.3 | 2022-11-14 | The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.6 is susceptible to a local information exposure vulnerability… |
CVE-2022-34316 | Low | 3.7 | 2022-11-14 | IBM CICS TX 11.1 does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can proce… |
CVE-2022-3992 | Low | 2.4 | 2022-11-14 | A vulnerability classified as problematic was found in SourceCodester Sanitization Management System. Affected by this vulnerability is an unknown functionalit… |
CVE-2022-3988 | Low | 3.5 | 2022-11-14 | A vulnerability was found in Frappe. It has been rated as problematic. Affected by this issue is some unknown functionality of the file frappe/templates/includ… |
CVE-2022-3975 | Low | 3.5 | 2022-11-13 | A vulnerability, which was classified as problematic, has been found in NukeViet CMS. Affected by this issue is the function filterAttr of the file vendor/vina… |
CVE-2022-3969 | Low | 2.6 | 2022-11-13 | A vulnerability was found in OpenKM up to 6.3.11 and classified as problematic. Affected by this issue is the function getFileExtension of the file src/main/ja… |
CVE-2022-3968 | Low | 3.5 | 2022-11-13 | A vulnerability has been found in emlog and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/article_sav… |
CVE-2022-3963 | Low | 3.5 | 2022-11-12 | A vulnerability was found in gnuboard5. It has been classified as problematic. Affected is an unknown function of the file bbs/faq.php of the component FAQ Key… |
CVE-2022-45194 | Low | 3.8 | 2022-11-12 | CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure. |
CVE-2022-3959 | Low | 3.1 | 2022-11-11 | A vulnerability, which was classified as problematic, has been found in drogon up to 1.8.1. Affected by this issue is some unknown functionality of the compone… |
CVE-2022-33973 | Low | 3.3 | 2022-11-11 | Improper access control in the Intel(R) WAPI Security software for Windows 10/11 before version 22.2150.0.1 may allow an authenticated user to potentially enab… |
CVE-2022-30297 | Low | 3.8 | 2022-11-11 | Cross-site scripting in the Intel(R) EMA software before version 1.8.0 may allow a privileged user to potentially enable escalation of privilege via local acce… |
CVE-2022-27499 | Low | 2.5 | 2022-11-11 | Premature release of resource during expected lifetime in the Intel(R) SGX SDK software may allow a privileged user to potentially enable information disclosur… |
CVE-2022-26045 | Low | 3.3 | 2022-11-11 | Improper buffer restrictions in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable… |
CVE-2022-3952 | Low | 2.6 | 2022-11-11 | A vulnerability has been found in ManyDesigns Portofino 5.3.2 and classified as problematic. Affected by this vulnerability is the function createTempDir of th… |
CVE-2022-3950 | Low | 3.5 | 2022-11-11 | A vulnerability, which was classified as problematic, was found in sanluan PublicCMS. Affected is the function initLink of the file dwz.min.js of the component… |
CVE-2022-3949 | Low | 3.5 | 2022-11-11 | A vulnerability, which was classified as problematic, has been found in Sourcecodester Simple Cashiering System. This issue affects some unknown processing of… |
CVE-2022-3943 | Low | 3.5 | 2022-11-11 | A vulnerability was found in ForU CMS. It has been classified as problematic. Affected is an unknown function of the file cms_chip.php. The manipulation of the… |
CVE-2022-3940 | Low | 3.5 | 2022-11-11 | A vulnerability, which was classified as problematic, was found in lanyulei ferry. This affects an unknown part of the file apis/process/task.go. The manipulat… |
CVE-2022-41874 | Low | 2.6 | 2022-11-10 | Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolve… |
CVE-2022-39394 | Low | 3.8 | 2022-11-10 | Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmti… |
CVE-2022-43754 | Low | 2.6 | 2022-11-10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SU… |
CVE-2022-3867 | Low | 2.7 | 2022-11-10 | HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed… |
CVE-2022-3819 | Low | 3.5 | 2022-11-10 | An improper authorization issue in GitLab CE/EE affecting all versions from 15.0 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a malic… |
CVE-2022-3706 | Low | 3.1 | 2022-11-10 | Improper authorization in GitLab CE/EE affecting all versions from 7.14 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user retrying… |
CVE-2022-3280 | Low | 3.5 | 2022-11-09 | An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick u… |
CVE-2022-39893 | Low | 3.3 | 2022-11-09 | Sensitive information exposure vulnerability in FmmBaseModel in Galaxy Buds Pro Manage prior to version 4.1.22092751 allows local attackers with log access per… |
CVE-2022-39892 | Low | 3.6 | 2022-11-09 | Improper access control in Samsung Pass prior to version 4.0.05.1 allows attackers to unauthenticated access via keep open feature. |
CVE-2022-29836 | Low | 1.9 | 2022-11-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability was discovered via an HTTP API on Western Digital My Cloud Home; M… |
CVE-2022-42965 | Low | 3.7 | 2022-11-09 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply… |
CVE-2022-20446 | Low | 3.3 | 2022-11-08 | In AlwaysOnHotwordDetector of AlwaysOnHotwordDetector.java, there is a possible way to access the microphone from the background due to a missing permission ch… |
CVE-2022-42494 | Low | 3.0 | 2022-11-08 | Server Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin <= 4.2.5.1 on WordPress. |
CVE-2022-38163 | Low | 3.5 | 2022-11-07 | A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and below. Drag and drop operation by user on addr… |
CVE-2022-43562 | Low | 3.0 | 2022-11-04 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, Splunk Enterprise fails to properly validate and escape the Host header, which could let a remote… |
CVE-2022-20962 | Low | 3.8 | 2022-11-04 | A vulnerability in the Localdisk Management feature of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to make unauthorized… |
CVE-2022-42442 | Low | 3.3 | 2022-11-03 | IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner e-mail address to… |
CVE-2021-36906 | Low | 2.7 | 2022-11-03 | Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin <= 7.3.6 on WordPress. |
CVE-2022-3258 | Low | 3.7 | 2022-11-03 | Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authentication Abuse. |
CVE-2022-3675 | Low | 2.6 | 2022-11-03 | Fedora CoreOS supports setting a GRUB bootloader password using a Butane config. When this feature is enabled, GRUB requires a password to access the GRUB comm… |
CVE-2022-39376 | Low | 2.6 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39372 | Low | 3.5 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-44646 | Low | 2.2 | 2022-11-03 | In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings |
CVE-2022-44622 | Low | 2.7 | 2022-11-03 | In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive |
CVE-2022-39276 | Low | 3.5 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-3845 | Low | 2.4 | 2022-11-02 | A vulnerability has been found in phpipam and classified as problematic. Affected by this vulnerability is an unknown functionality of the file app/admin/impor… |
CVE-2022-3844 | Low | 3.5 | 2022-11-02 | A vulnerability, which was classified as problematic, was found in Webmin 2.001. Affected is an unknown function of the file xterm/index.cgi. The manipulation… |
CVE-2020-36608 | Low | 3.5 | 2022-11-02 | A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS. Affected by this issue is some unknown functionality of the… |
CVE-2022-39379 | Low | 3.1 | 2022-11-02 | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerabi… |
CVE-2022-35842 | Low | 3.7 | 2022-11-02 | An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiOS SSL-VPN versions 7.2.0, versions 7.0.0 through 7.0.6 and versi… |
CVE-2022-33878 | Low | 2.2 | 2022-11-02 | An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiClient for Mac versions 7.0.0 through 7.0.5 may allow a local aut… |