Low-severity CVEs (page 78)
Page 78 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0488 | Low | 3.5 | 2022-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions starting with version 8.10. It was possible to trigger a timeout on a page with markdown by… |
CVE-2022-0344 | Low | 3.1 | 2022-03-28 | An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions sta… |
CVE-2022-0249 | Low | 3.1 | 2022-03-28 | A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not… |
CVE-2018-25030 | Low | 3.3 | 2022-03-28 | A vulnerability classified as problematic has been found in Mirmay Secure Private Browser and File Manager up to 2.5. Affected is the Auto Lock. A race conditi… |
CVE-2022-24784 | Low | 3.7 | 2022-03-25 | Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's password hash using a spe… |
CVE-2022-25610 | Low | 3.4 | 2022-03-25 | Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code. However, the attack requires… |
CVE-2021-27456 | Low | 2.4 | 2022-03-23 | Philips Gemini PET/CT family software stores sensitive information in a removable media device that does not have built-in access control. |
CVE-2022-0862 | Low | 3.1 | 2022-03-23 | A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote… |
CVE-2022-0861 | Low | 3.5 | 2022-03-23 | A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a… |
CVE-2022-21718 | Low | 3.4 | 2022-03-22 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`… |
CVE-2022-0652 | Low | 3.3 | 2022-03-22 | Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt o… |
CVE-2022-24236 | Low | 3.5 | 2022-03-21 | An insecure permissions vulnerability in Snapt Aria v12.8 allows unauthenticated attackers to send e-mails from spoofed users' accounts. |
CVE-2022-0475 | Low | 3.5 | 2022-03-21 | Malicious translator is able to inject JavaScript code in few translatable strings (where HTML is allowed). The code could be executed in the Package manager… |
CVE-2022-22670 | Low | 3.3 | 2022-03-18 | An access issue was addressed with improved access restrictions. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, watchOS 8.5. A malicious applicati… |
CVE-2022-22656 | Low | 3.3 | 2022-03-18 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.6.5, macOS Monterey 12.3, Security Update 2022-00… |
CVE-2022-22599 | Low | 2.4 | 2022-03-18 | Description: A permissions issue was addressed with improved validation. This issue is fixed in watchOS 8.5, iOS 15.4 and iPadOS 15.4, macOS Big Sur 11.6.5, ma… |
CVE-2022-22598 | Low | 3.3 | 2022-03-18 | An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 15.4 and iPadOS 15.4. An app may be able to learn inf… |
CVE-2022-1003 | Low | 3.3 | 2022-03-18 | One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two dis… |
CVE-2022-1002 | Low | 2.0 | 2022-03-18 | Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with specia… |
CVE-2020-16232 | Low | 2.8 | 2022-03-18 | In Yokogawa WideField3 R1.01 - R4.03, a buffer overflow could be caused when a user loads a maliciously crafted project file. |
CVE-2022-0758 | Low | 3.3 | 2022-03-17 | Rapid7 Nexpose versions 6.6.129 and earlier suffer from a reflected cross site scripting vulnerability, within the shared scan configuration component of the t… |
CVE-2022-21164 | Low | 3.7 | 2022-03-16 | The package node-lmdb before 0.9.7 are vulnerable to Denial of Service (DoS) when defining a non-invokable ToString value, which will cause a crash during type… |
CVE-2022-26354 | Low | 3.2 | 2022-03-16 | A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading… |
CVE-2021-40769 | Low | 3.3 | 2022-03-16 | Adobe Character Animator version 4.4 (and earlier versions) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memo… |
CVE-2021-40766 | Low | 3.3 | 2022-03-16 | Adobe Character Animator version 4.4 (and earlier versions) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memo… |
CVE-2022-22348 | Low | 2.4 | 2022-03-14 | IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to reverse tabnabbing where it could allow a page linked to from within Opera… |
CVE-2021-36368 | Low | 3.7 | 2022-03-13 | An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an atta… |
CVE-2022-25830 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch3 Plugin prior to version 2.2.09.22012751 allows attacker to access password information of connected WiFiAp… |
CVE-2022-25829 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Watch Active2 Plugin prior to version 2.2.08.22012751 allows attacker to access password information of connected WiFiAp… |
CVE-2022-25828 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access password information of connected WiFiAp i… |
CVE-2022-25827 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.22012751 allows attacker to access password information of connected WiFiAp i… |
CVE-2022-25826 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy S3 Plugin prior to version 2.2.03.22012751 allows attacker to access password information of connected WiFiAp in t… |
CVE-2022-25823 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.220126741 allows attackers to access user information in log. |
CVE-2022-25821 | Low | 3.3 | 2022-03-10 | Improper use of SMS buffer pointer in Shannon baseband prior to SMR Mar-2022 Release 1 allows OOB read. |
CVE-2022-21170 | Low | 3.7 | 2022-03-10 | Improper check for certificate revocation in i-FILTER Ver.10.45R01 and earlier, i-FILTER Ver.9.50R10 and earlier, i-FILTER Browser & Cloud MultiAgent for Windo… |
CVE-2021-3981 | Low | 3.3 | 2022-03-10 | A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read… |
CVE-2022-24744 | Low | 2.6 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged ou… |
CVE-2022-24741 | Low | 3.5 | 2022-03-09 | Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading spec… |
CVE-2022-24919 | Low | 3.7 | 2022-03-09 | An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only… |
CVE-2022-24918 | Low | 3.7 | 2022-03-09 | An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only w… |
CVE-2022-24917 | Low | 3.7 | 2022-03-09 | An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed onl… |
CVE-2022-24465 | Low | 3.3 | 2022-03-09 | Microsoft Intune Portal for iOS Security Feature Bypass Vulnerability |
CVE-2022-21977 | Low | 3.3 | 2022-03-09 | Media Foundation Information Disclosure Vulnerability |
CVE-2021-41181 | Low | 2.4 | 2022-03-08 | Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen s… |
CVE-2021-3716 | Low | 3.1 | 2022-03-02 | A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject… |
CVE-2021-46270 | Low | 2.7 | 2022-03-02 | JFrog Artifactory before 7.31.10, is vulnerable to Broken Access Control where a project admin user is able to list all available repository names due to insuf… |
CVE-2022-22303 | Low | 2.8 | 2022-03-02 | An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiManager versions prior to 7.0.2, 6.4.7 and 6.2.9… |
CVE-2022-24719 | Low | 2.6 | 2022-03-01 | Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using `followRedirects` or `followRedirectsWith` with any of the redirection str… |
CVE-2020-15936 | Low | 2.6 | 2022-03-01 | A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version 6.0.11 and below, version 5.6.13 and below allows a… |
CVE-2022-23984 | Low | 3.7 | 2022-02-21 | Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11). |
CVE-2022-0279 | Low | 3.1 | 2022-02-21 | The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user t… |
CVE-2021-25075 | Low | 3.5 | 2022-02-21 | The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_s… |
CVE-2022-23649 | Low | 3.3 | 2022-02-18 | Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to… |
CVE-2021-46608 | Low | 3.3 | 2022-02-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interac… |
CVE-2021-46607 | Low | 3.3 | 2022-02-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interac… |
CVE-2021-46602 | Low | 3.3 | 2022-02-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interac… |
CVE-2021-46600 | Low | 3.3 | 2022-02-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interac… |
CVE-2021-46599 | Low | 3.3 | 2022-02-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interac… |
CVE-2021-3155 | Low | 3.8 | 2022-02-17 | snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to re… |
CVE-2019-4352 | Low | 2.4 | 2022-02-16 | IBM Maximo Anywhere 7.6.4.0 applications could allow obfuscation of the application source code. IBM X-Force ID: 161494. |
CVE-2021-25109 | Low | 2.7 | 2022-02-14 | The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from th… |
CVE-2021-25014 | Low | 3.5 | 2022-02-14 | The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated… |
CVE-2022-24924 | Low | 2.2 | 2022-02-11 | An improper access control in LiveWallpaperService prior to versions 3.0.9.0 allows to create a specific named system directory without a proper permission. |
CVE-2022-24001 | Low | 3.8 | 2022-02-11 | Information disclosure vulnerability in Edge Panel prior to Android S(12) allows physical attackers to access screenshot in clipboard via Edge Panel. |
CVE-2022-24000 | Low | 3.9 | 2022-02-11 | PendingIntent hijacking vulnerability in DataUsageReminderReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without permiss… |
CVE-2022-23999 | Low | 3.9 | 2022-02-11 | PendingIntent hijacking vulnerability in CpaReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without permission in KnoxPri… |
CVE-2022-23994 | Low | 3.3 | 2022-02-11 | An Improper access control vulnerability in StBedtimeModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to cha… |
CVE-2022-23427 | Low | 3.9 | 2022-02-11 | PendingIntent hijacking vulnerability in KnoxPrivacyNoticeReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without permiss… |
CVE-2021-4035 | Low | 3.5 | 2022-02-11 | A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit thi… |
CVE-2022-0021 | Low | 3.3 | 2022-02-10 | An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the… |
CVE-2022-22779 | Low | 3.7 | 2022-02-09 | The Keybase Clients for macOS and Windows before version 5.9.0 fails to properly remove exploded messages initiated by a user. This can occur if the receiving… |
CVE-2021-25939 | Low | 2.7 | 2022-02-09 | In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not… |
CVE-2022-0536 | Low | 2.6 | 2022-02-09 | Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8. |
CVE-2022-0474 | Low | 2.4 | 2022-02-07 | Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each… |
CVE-2022-0473 | Low | 3.8 | 2022-02-07 | OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the age… |
CVE-2022-24448 | Low | 3.3 | 2022-02-04 | An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_a… |
CVE-2020-8562 | Low | 2.2 | 2022-02-01 | As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when… |
CVE-2021-40340 | Low | 3.7 | 2022-01-28 | Information Exposure vulnerability in Hitachi Energy LinkOne application, due to a misconfiguration in the ASP server exposes server and ASP.net information, a… |
CVE-2021-40339 | Low | 3.7 | 2022-01-28 | Configuration vulnerability in Hitachi Energy LinkOne application due to the lack of HTTP Headers, allows an attacker that manages to exploit this vulnerabilit… |
CVE-2021-40338 | Low | 3.7 | 2022-01-28 | Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path of the filesystem d… |
CVE-2021-23174 | Low | 3.4 | 2022-01-28 | Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable param… |
CVE-2021-22799 | Low | 3.8 | 2022-01-28 | A CWE-331: Insufficient Entropy vulnerability exists that could cause unintended connection from an internal network to an external network when an attacker ma… |
CVE-2021-29846 | Low | 2.7 | 2022-01-26 | IBM Security Guardium Insights 3.0 could allow an authenticated user to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 20… |
CVE-2022-0333 | Low | 3.8 | 2022-01-25 | A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability al… |
CVE-2021-38129 | Low | 3.3 | 2022-01-25 | Escalation of privileges vulnerability in Micro Focus in Micro Focus Operations Agent, affecting versions 12.x up to and including 12.21. The vulnerability cou… |
CVE-2021-35005 | Low | 3.3 | 2022-01-24 | This vulnerability allows local attackers to disclose sensitive information on affected installations of TeamViewer. An attacker must first obtain the ability… |
CVE-2022-21388 | Low | 3.3 | 2022-01-19 | Vulnerability in the Oracle Communications Pricing Design Center product of Oracle Communications Applications (component: On Premise Install). Supported versi… |
CVE-2022-21372 | Low | 2.7 | 2022-01-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.27 and prior… |
CVE-2022-21357 | Low | 2.9 | 2022-01-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and… |
CVE-2022-21355 | Low | 2.9 | 2022-01-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and… |
CVE-2022-21333 | Low | 2.9 | 2022-01-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and… |
CVE-2022-21331 | Low | 2.9 | 2022-01-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and… |
CVE-2022-21325 | Low | 2.9 | 2022-01-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and… |
CVE-2022-21324 | Low | 2.9 | 2022-01-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and… |
CVE-2022-21323 | Low | 2.9 | 2022-01-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.5.24 and prior, 7.6.20 and… |
CVE-2022-21321 | Low | 2.9 | 2022-01-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and… |
CVE-2022-21319 | Low | 2.9 | 2022-01-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and… |
CVE-2022-21317 | Low | 2.9 | 2022-01-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and… |
CVE-2022-21313 | Low | 2.9 | 2022-01-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.6.20 and prior and 8.0.27… |
CVE-2022-21312 | Low | 2.9 | 2022-01-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and… |