NVD disclosure day

Published threat advisories for June 14, 2022

CVE-2021-42675

Kreasfero Remote Code Execution via File Upload Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

Kreasfero's media upload feature has a vulnerability where it does not properly sanitize uploaded files. This could allow an attacker to upload a malicious PHP file and achieve remote code execution on the server. This is a critical issue because it could lead to a complete compromise of the system.

NVD modified: NVD date unavailable

CVE advisoryKnown Exploit

CVE-2022-22071

Qualcomm Chipsets Use-After-Free Vulnerability.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

Qualcomm chipsets are affected by a use-after-free vulnerability during process initialization. This can lead to unauthorized access and modification of data, potentially impacting system integrity and creating business risk. Organizations should review vendor advisories for mitigation guidance.

NVD modified: NVD date unavailable • CISA KEV