Security Vulnerabilities - CVEs Published In 2022
Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad's asset handling mechanism has logic to ensure that customer users are not able to see personal information of other users. This logic was not effective when used through a web socket connection, so that a logged-in attacker would be able to fetch personal data of other users by querying the Zammad API. This issue is fixed in , 5.2.2.
CVSS Score
6.5
EPSS Score
0.008
Published
2022-09-27
Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some operations on such tickets, like adding and removing links, tags. and related answers. This issue has been fixed in 5.2.2.
CVSS Score
4.3
EPSS Score
0.005
Published
2022-09-27
Exam Reviewer Management System 1.0 is vulnerable to SQL Injection via the ‘id’ parameter.
CVSS Score
9.8
EPSS Score
0.013
Published
2022-09-27
In Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profile page to achieve Remote Code Execution (RCE).
CVSS Score
8.8
EPSS Score
0.237
Published
2022-09-27
An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Unauthenticated SQL injection can occur.
CVSS Score
9.8
EPSS Score
0.008
Published
2022-09-27
An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Local file inclusion can occur.
CVSS Score
9.8
EPSS Score
0.011
Published
2022-09-27
Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules.
CVSS Score
5.4
EPSS Score
0.009
Published
2022-09-27
readelf in ToaruOS 2.0.1 has a global overflow allowing RCE when parsing a crafted ELF file.
CVSS Score
7.8
EPSS Score
0.003
Published
2022-09-27
DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page.
CVSS Score
5.4
EPSS Score
0.007
Published
2022-09-27
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0.
CVSS Score
5.3
EPSS Score
0.006
Published
2022-09-27