Security Vulnerabilities
- CVEs Published In January 2022
Cross Site Scripting (XSS) vulnerability exists in index.html in AFI WebACMS through 2.1.0 via the the ID parameter.
Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.
Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code execution on the device.
Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07.
The initial admin account setup wizard on Lexmark devices allow unauthenticated access to the “out of service erase” feature.
PJL directory traversal vulnerability in Lexmark devices through 2021-12-07 that can be leveraged to overwrite internal configuration files.
Buffer overflow vulnerability has been identified in Lexmark devices through 2021-12-07 in postscript interpreter.
Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials may be used by malicious attackers to perform unauthorized actions. This vulnerability affects all MongoDB Extension for VS Code including and prior to version 0.7.0
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9.
Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags used for local authorization of users. This may lead to total loss of trustworthiness of the installation.