Low-severity CVEs (page 74)
Page 74 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-40199 | Low | 2.7 | 2022-09-27 | Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated… |
CVE-2022-23006 | Low | 1.8 | 2022-09-27 | A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessi… |
CVE-2022-3301 | Low | 2.4 | 2022-09-26 | Improper Cleanup on Thrown Exception in GitHub repository ikus060/rdiffweb prior to 2.4.8. |
CVE-2022-40215 | Low | 3.4 | 2022-09-23 | Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in Tabs plugin <= 3.7.1 at WordPress. |
CVE-2022-3257 | Low | 3.1 | 2022-09-23 | Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows auth… |
CVE-2022-37328 | Low | 3.4 | 2022-09-23 | Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0.5 at WordPress. |
CVE-2022-38703 | Low | 3.4 | 2022-09-23 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Foundry Button Plugin MaxButtons plugin <= 9.2 at WordPress |
CVE-2022-35252 | Low | 3.7 | 2022-09-23 | When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver migh… |
CVE-2022-39231 | Low | 3.7 | 2022-09-23 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.16, or from 5.0.0 to 5.2.6, v… |
CVE-2021-27774 | Low | 3.1 | 2022-09-22 | User input included in error response, which could be used in a phishing attack. |
CVE-2022-3274 | Low | 3.5 | 2022-09-22 | Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.7. |
CVE-2022-31679 | Low | 3.7 | 2022-09-21 | Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if… |
CVE-2019-5641 | Low | 3.3 | 2022-09-21 | Rapid7 InsightVM suffers from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the Inspect Eleme… |
CVE-2022-32872 | Low | 2.4 | 2022-09-20 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16, iOS 15.7 and iPadOS 15.7. A person with physical access to an iOS device… |
CVE-2022-39210 | Low | 3.2 | 2022-09-17 | Nextcloud android is the official Android client for the Nextcloud home server platform. Internal paths to the Nextcloud Android app files are not properly pro… |
CVE-2022-39211 | Low | 3.0 | 2022-09-16 | Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erron… |
CVE-2021-42948 | Low | 3.7 | 2022-09-16 | HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to… |
CVE-2022-36075 | Low | 2.6 | 2022-09-15 | Nextcloud files access control is a nextcloud app to manage access control for files. Users with limited access can see file names in certain cases where they… |
CVE-2022-36112 | Low | 3.5 | 2022-09-14 | GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licen… |
CVE-2022-37703 | Low | 3.3 | 2022-09-13 | In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exist… |
CVE-2022-38453 | Low | 3.0 | 2022-09-13 | Multiple binary application files on the CMS8000 device are compiled with 'not stripped' and 'debug_info' compilation settings. These compiler settings greatly… |
CVE-2022-31225 | Low | 3.0 | 2022-09-12 | Dell BIOS versions contain an Unchecked Return Value vulnerability. A local authenticated administrator user could potentially exploit this vulnerability in or… |
CVE-2022-31224 | Low | 2.0 | 2022-09-12 | Dell BIOS versions contain an Improper Protection Against Voltage and Clock Glitches vulnerability. An attacker with physical access to the system could potent… |
CVE-2022-31223 | Low | 2.3 | 2022-09-12 | Dell BIOS versions contain an Improper Neutralization of Null Byte vulnerability. A local authenticated administrator user could potentially exploit this vulne… |
CVE-2022-31222 | Low | 2.3 | 2022-09-12 | Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability. A local authenticated administrator user could potentially exp… |
CVE-2022-31221 | Low | 2.3 | 2022-09-12 | Dell BIOS versions contain an Information Exposure vulnerability. A local authenticated administrator user could potentially exploit this vulnerability in orde… |
CVE-2022-31220 | Low | 3.0 | 2022-09-12 | Dell BIOS versions contain an Unchecked Return Value vulnerability. A local authenticated administrator user could potentially exploit this vulnerability in or… |
CVE-2022-3147 | Low | 3.1 | 2022-09-09 | Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG images, which allows authenticated users to… |
CVE-2022-36878 | Low | 3.3 | 2022-09-09 | Exposure of Sensitive Information in Find My Mobile prior to version 7.2.25.14 allows local attacker to access IMEI via log. |
CVE-2022-36877 | Low | 2.8 | 2022-09-09 | Exposure of Sensitive Information in FaqSymptomCardViewModel in Samsung Members prior to versions 4.3.00.11 in Global and 14.0.02.4 in China allows local attac… |
CVE-2022-36876 | Low | 1.8 | 2022-09-09 | Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access account list without authentication. |
CVE-2022-36857 | Low | 1.9 | 2022-09-09 | Improper Authorization vulnerability in Photo Editor prior to SMR Sep-2022 Release 1 allows physical attackers to read internal application data. |
CVE-2022-36853 | Low | 3.3 | 2022-09-09 | Intent redirection in Photo Editor prior to SMR Sep-2022 Release 1 allows attacker to get sensitive information. |
CVE-2022-36852 | Low | 1.9 | 2022-09-09 | Improper Authorization vulnerability in Video Editor prior to SMR Sep-2022 Release 1 allows local attacker to access internal application data. |
CVE-2022-36851 | Low | 3.9 | 2022-09-09 | Improper access control vulnerability in Samsung pass prior to version 4.0.03.1 allow physical attackers to access data of Samsung pass on a certain state of a… |
CVE-2022-26392 | Low | 3.1 | 2022-09-09 | The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) when in superuser mode is susceptible to format string attacks vi… |
CVE-2022-22314 | Low | 3.3 | 2022-09-08 | IBM Planning Analytics Local 2.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 217371. |
CVE-2022-35931 | Low | 2.7 | 2022-09-06 | Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3… |
CVE-2022-29053 | Low | 2.3 | 2022-09-06 | A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the keytab files in FortiOS version 7.2.0, 7.0.0 through 7.0.5 and below 7… |
CVE-2022-1697 | Low | 3.9 | 2022-09-06 | Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerabil… |
CVE-2022-39049 | Low | 3.5 | 2022-09-05 | An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS. |
CVE-2022-2256 | Low | 3.8 | 2022-09-01 | A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execu… |
CVE-2022-1404 | Low | 3.3 | 2022-08-31 | Delta Electronics CNCSoft (All versions prior to 1.01.32) does not properly sanitize input while processing a specific project file, allowing a possible out-of… |
CVE-2022-36036 | Low | 3.6 | 2022-08-29 | mdx-mermaid provides plug and play access to Mermaid in MDX. There is a potential for an arbitrary javascript injection in versions less than 1.3.0 and 2.0.0-r… |
CVE-2022-2556 | Low | 2.7 | 2022-08-29 | The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the serv… |
CVE-2022-3015 | Low | 3.5 | 2022-08-27 | A vulnerability, which was classified as problematic, has been found in oretnom23 Fast Food Ordering System. This issue affects some unknown processing of the… |
CVE-2022-3014 | Low | 3.5 | 2022-08-27 | A vulnerability classified as problematic was found in SourceCodester Simple Task Managing System. This vulnerability affects unknown code. The manipulation of… |
CVE-2021-3644 | Low | 3.3 | 2022-08-26 | A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was… |
CVE-2021-3574 | Low | 3.3 | 2022-08-26 | A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks. |
CVE-2022-36168 | Low | 2.7 | 2022-08-26 | A directory traversal vulnerability was discovered in Wuzhicms 4.1.0. via /coreframe/app/attachment/admin/index.php: |
CVE-2022-36117 | Low | 3.1 | 2022-08-25 | An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possibl… |
CVE-2021-4217 | Low | 3.3 | 2022-08-24 | A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows… |
CVE-2022-28883 | Low | 3.5 | 2022-08-23 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aerdl unpack function crashes. This can lead to a possible… |
CVE-2022-2956 | Low | 3.5 | 2022-08-23 | A vulnerability classified as problematic has been found in ConsoleTVs Noxen. Affected is an unknown function of the file /Noxen-master/users.php. The manipula… |
CVE-2022-31237 | Low | 3.3 | 2022-08-22 | Dell PowerScale OneFS, versions 9.2.0 up to and including 9.2.1.12 and 9.3.0.5 contain an improper preservation of permissions vulnerability in SyncIQ. A low p… |
CVE-2022-2841 | Low | 2.7 | 2022-08-22 | A vulnerability was found in CrowdStrike Falcon 6.31.14505.0/6.42.15610/6.44.15806. It has been classified as problematic. Affected is an unknown function of t… |
CVE-2022-2788 | Low | 3.9 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '\..\Filename', also known as a ZipSlip attack, throu… |
CVE-2021-23188 | Low | 3.3 | 2022-08-18 | Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow an authenticated user to potentially enable information d… |
CVE-2020-14394 | Low | 3.2 | 2022-08-17 | An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw all… |
CVE-2022-37438 | Low | 2.6 | 2022-08-16 | In Splunk Enterprise versions in the following table, an authenticated user can craft a dashboard that could potentially leak information (for example, usernam… |
CVE-2022-2844 | Low | 3.5 | 2022-08-16 | A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?… |
CVE-2022-2843 | Low | 3.5 | 2022-08-16 | A vulnerability was found in MotoPress Timetable and Event Schedule. It has been rated as problematic. Affected by this issue is some unknown functionality of… |
CVE-2022-2814 | Low | 3.5 | 2022-08-15 | A vulnerability has been found in SourceCodester Simple and Nice Shopping Cart Script and classified as problematic. Affected by this vulnerability is an unkno… |
CVE-2022-2811 | Low | 3.5 | 2022-08-15 | A vulnerability classified as problematic has been found in SourceCodester Guest Management System. This affects an unknown part of the file myform.php. The ma… |
CVE-2022-35932 | Low | 3.5 | 2022-08-12 | Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are suscepti… |
CVE-2022-20342 | Low | 3.3 | 2022-08-12 | In WiFi, there is a possible disclosure of WiFi password to the end user due to an insecure default value. This could lead to local information disclosure with… |
CVE-2022-20340 | Low | 3.3 | 2022-08-12 | In SELinux policy, there is a possible way of inferring which websites are being opened in the browser due to a missing permission check. This could lead to lo… |
CVE-2022-20339 | Low | 3.3 | 2022-08-12 | In Android, there is a possible access of network neighbor table information due to an insecure SEpolicy configuration. This could lead to local information di… |
CVE-2022-20338 | Low | 3.3 | 2022-08-12 | In HierarchicalUri.readFrom of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. This could lead to a local e… |
CVE-2022-20336 | Low | 3.3 | 2022-08-12 | In Settings, there is a possible installed application disclosure due to a missing permission check. This could lead to local information disclosure of applica… |
CVE-2022-20335 | Low | 3.3 | 2022-08-12 | In Wifi Slice, there is a possible way to adjust Wi-Fi settings even when the permission has been disabled due to a missing permission check. This could lead t… |
CVE-2022-20330 | Low | 3.5 | 2022-08-12 | In Bluetooth, there is a possible way to connect or disconnect bluetooth devices without user awareness due to a missing permission check. This could lead to l… |
CVE-2022-20328 | Low | 3.3 | 2022-08-12 | In PackageManager, there is a possible way to determine whether an app is installed due to a missing permission check. This could lead to local information dis… |
CVE-2022-20327 | Low | 2.8 | 2022-08-12 | In Wi-Fi, there is a possible way to retrieve the WiFi SSID without location permissions due to a missing permission check. This could lead to local informatio… |
CVE-2022-20321 | Low | 3.3 | 2022-08-12 | In Settings, there is a possible way for an application without permissions to read content of WiFi QR codes due to a missing permission check. This could lead… |
CVE-2022-20320 | Low | 3.3 | 2022-08-12 | In ActivityManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2022-20318 | Low | 3.3 | 2022-08-12 | In PackageInstaller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. T… |
CVE-2022-20316 | Low | 3.3 | 2022-08-12 | In ContentResolver, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2022-20315 | Low | 3.3 | 2022-08-12 | In ActivityManager, there is a possible disclosure of installed packages due to a missing permission check. This could lead to local information disclosure wit… |
CVE-2022-20311 | Low | 3.3 | 2022-08-12 | In Telecomm, there is a possible disclosure of registered self managed phone accounts due to a missing permission check. This could lead to local information d… |
CVE-2022-20310 | Low | 3.3 | 2022-08-12 | In Telecomm, there is a possible disclosure of registered self managed phone accounts due to a missing permission check. This could lead to local information d… |
CVE-2022-20309 | Low | 3.3 | 2022-08-12 | In PackageInstaller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. T… |
CVE-2022-20307 | Low | 3.3 | 2022-08-12 | In AlarmManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure… |
CVE-2022-20305 | Low | 3.3 | 2022-08-12 | In ContentService, there is a possible disclosure of available account types due to a missing permission check. This could lead to local information disclosure… |
CVE-2022-20280 | Low | 3.3 | 2022-08-12 | In MMSProvider, there is a possible read of protected data due to improper input validationSQL injection. This could lead to local information disclosure of sm… |
CVE-2022-20267 | Low | 3.3 | 2022-08-12 | In bluetooth, there is a possible way to enable or disable bluetooth connection without user consent due to a missing permission check. This could lead to loca… |
CVE-2022-20262 | Low | 3.3 | 2022-08-12 | In ActivityManager, there is a possible way to check another process's capabilities due to a missing permission check. This could lead to local information dis… |
CVE-2022-20261 | Low | 2.3 | 2022-08-12 | In LocationManager, there is a possible way to get location information due to a missing permission check. This could lead to local information disclosure with… |
CVE-2022-20257 | Low | 3.3 | 2022-08-12 | In Bluetooth, there is a possible way to pair a display only device without PIN confirmation due to a logic error in the code. This could lead to local escalat… |
CVE-2022-20252 | Low | 3.3 | 2022-08-11 | In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Thi… |
CVE-2022-20251 | Low | 3.3 | 2022-08-11 | In LocaleManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2022-20249 | Low | 3.3 | 2022-08-11 | In LocaleManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2022-20245 | Low | 2.4 | 2022-08-11 | In WindowManager, there is a possible method to create a recording of the lock screen due to an insecure default value. This could lead to local information di… |
CVE-2022-20241 | Low | 3.3 | 2022-08-11 | In Messaging, there is a possible way to attach a private file to an SMS message due to improper input validation. This could lead to local information disclos… |
CVE-2022-2773 | Low | 3.5 | 2022-08-11 | A vulnerability was found in SourceCodester Apartment Visitor Management System. It has been classified as problematic. This affects an unknown part of the fil… |
CVE-2022-2769 | Low | 3.5 | 2022-08-11 | A vulnerability, which was classified as problematic, has been found in SourceCodester Company Website CMS. This issue affects some unknown processing of the f… |
CVE-2022-2768 | Low | 3.5 | 2022-08-11 | A vulnerability classified as problematic was found in SourceCodester Library Management System. This vulnerability affects unknown code of the file /qr/I/. Th… |
CVE-2022-2767 | Low | 3.5 | 2022-08-11 | A vulnerability classified as problematic has been found in SourceCodester Online Admission System. This affects an unknown part of the file /index.php. The ma… |
CVE-2022-2748 | Low | 3.5 | 2022-08-11 | A vulnerability was found in SourceCodester Simple Online Book Store System. It has been classified as problematic. Affected is an unknown function of the file… |
CVE-2022-30629 | Low | 3.1 | 2022-08-10 | Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to corr… |