CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-43447
https://notcve.org/view.php?id=CVE-2021-43447
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attackers to edit documents without authentication. • https://github.com/ONLYOFFICE/server https://labs.nettitude.com/blog/exploiting-onlyoffice-web-sockets-for-unauthenticated-remote-code-execution https://www.onlyoffice.com • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 0CVE-2022-46764
https://notcve.org/view.php?id=CVE-2022-46764
A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 allows remote unauthenticated attackers to execute arbitrary SQL commands, ultimately leading to remote code execution. Un problema de inyección SQL en la API web en TrueConf Server 5.2.0.10225 permite a atacantes remotos no autenticados ejecutar comandos SQL arbitrarios, lo que en última instancia conduce a la ejecución remota de código. • https://github.com/sldlb/public_cve_submissions/blob/main/CVE-2022-46764.txt https://solidlab.ru/our-news/145-trueconf.html https://vuldb.com/?diff.216845 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-46763
https://notcve.org/view.php?id=CVE-2022-46763
A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 allows a low-privileged database user to execute arbitrary SQL commands as the database administrator, resulting in execution of arbitrary code. Un problema de inyección SQL en una función almacenada de base de datos en TrueConf Server 5.2.0.10225 permite a un usuario de base de datos con pocos privilegios ejecutar comandos SQL arbitrarios como administrador de la base de datos, lo que resulta en la ejecución de código arbitrario. • https://github.com/sldlb/public_cve_submissions/blob/main/CVE-2022-46763.txt https://solidlab.ru/our-news/145-trueconf.html https://vuldb.com/?diff.216851 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.2EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41810 – Script injection in M-Files Server products with versions before 22.2.11051.0, allows executing stored script in admin tool
https://notcve.org/view.php?id=CVE-2021-41810
Admin tool allows storing configuration data with script which may then get run by another vault administrator. Requires vault admin level authentication and is not remotely exploitable La herramienta de administración permite almacenar datos de configuración con un script que puede ser ejecutado por otro administrador de la bóveda. Requiere autenticación a nivel de administrador de la bóveda y no es explotable remotamente • https://www.m-files.com/about/trust-center/security-advisories/cve-2021-41810 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-42973
https://notcve.org/view.php?id=CVE-2021-42973
NoMachine Server is affected by Integer Overflow. IOCTL Handler 0x22001B in the NoMachine Server above 4.0.346 and below 7.7.4 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet. NoMachine Server está afectado por un desbordamiento de enteros. IOCTL Handler 0x22001B en NoMachine Server versiones posteriores de 4.0.346 y anteriores a 7.7.4, permite a atacantes locales ejecutar código arbitrario en modo kernel o causar una denegación de servicio (corrupción de memoria y bloqueo del Sistema Operativo) por medio de un paquete de petición de E/S especialmente diseñado • https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services • CWE-190: Integer Overflow or Wraparound •