Security Vulnerabilities - Known exploited
CVE-2022-23227
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
Known exploited
CVSS Score
9.8
EPSS Score
0.485
Published
2022-01-14
CVE-2022-23131
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
Known exploited
CVSS Score
9.1
EPSS Score
0.957
Published
2022-01-13
CVE-2022-23134
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
Known exploited
CVSS Score
3.7
EPSS Score
0.953
Published
2022-01-13
CVE-2022-21919
Windows User Profile Service Elevation of Privilege Vulnerability
Known exploited
CVSS Score
7.0
EPSS Score
0.024
Published
2022-01-11
CVE-2022-21882
Win32k Elevation of Privilege Vulnerability
Known exploited
CVSS Score
7.0
EPSS Score
0.592
Published
2022-01-11
CVE-2022-22265
An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.
Known exploited
CVSS Score
5.0
EPSS Score
0.004
Published
2022-01-10
CVE-2021-35247
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.
Known exploited
CVSS Score
4.3
EPSS Score
0.037
Published
2022-01-10
CVE-2021-44168
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.
Known exploited
CVSS Score
3.3
EPSS Score
0.009
Published
2022-01-04
CVE-2021-44207
Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.
Known exploited
CVSS Score
8.1
EPSS Score
0.176
Published
2021-12-21
CVE-2021-22054
VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.
Known exploited
CVSS Score
7.5
EPSS Score
0.997
Published
2021-12-17