CVE Vulnerability Catalog

An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6. A local user may be able to read kernel memory.

A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.

SolarView Compact version 6.00 was found to contain a command injection vulnerability via conf_mail.php. An attacker can exploit this to execute arbitrary system commands on the device.

A OS command injection vulnerability exists in the CGI program of Zyxel USG FLEX, ATP, and VPN series firmware. It allows an attacker to modify specific files and execute OS commands on the vulnerable device. Affected versions include USG FLEX 100(W) 5.00-5.21 Patch 1, USG FLEX 200, 500, 700, USG FLEX 50(W), USG20(W)-VPN, ATP, and VPN series.

A spoofing vulnerability in the Windows LSA service. An attacker can force a domain controller to authenticate to a malicious server.

A privilege elevation vulnerability in Active Directory Domain Services (AD DS). An attacker can gain domain administrator privileges.

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

In F5 BIG-IP versions 16.1.x prior to 16.1.2.2, 15.1.x prior to 15.1.5.1, 14.1.x prior to 14.1.4.6, 13.1.x prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. This allows an attacker to access the management interface without authentication.

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The documentation has always recommended proper security measures, including a firewall.

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution due to incorrect data validation. Affected appliances are SA 100, SA 400, and Virtual SA.

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

Zimbra Collaboration (ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands become unescaped, causing an overwrite of arbitrary cached entries.

Vulnerability in Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces) in versions 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise ADF, potentially leading to takeover. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as ../../../../repository/deployment/server/webapps. Affects WSO2 API Manager 2.2.0-4.0.0, WSO2 Identity Server 5.2.0-5.11.0, WSO2 Identity Server Analytics 5.4.0-5.6.0, WSO2 Identity Server as Key Manager 5.3.0-5.11.0, WSO2 Enterprise Integrator 6.2.0-6.6.0, WSO2 Open Banking AM 1.4.0-2.0.0, and WSO2 Open Banking KM 1.4.0-2.0.0.

Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.

A privilege elevation vulnerability in the Windows User Profile Service. It requires authentication as a local user.

A privilege elevation vulnerability in the Windows Common Log File System Driver. It is exploited locally by an authenticated user.

JAI-EXT is an open-source project extending the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script via network request can lead to Remote Code Execution as the script is compiled into Java code via Janino and executed. This affects the downstream GeoServer project. Version 1.2.22 contains a patch that disables the ability to inject malicious code into the resulting script.

A vulnerability in VMware Workspace ONE Access, Identity Manager and vRealize Automation due to improper permissions in support scripts. A local attacker can escalate privileges to root.