CVE-2022-3971 matrix-appservice-irc PgDataStore.ts sql injection

A vulnerability was found in matrix-appservice-irc up to 0.35.1. It has been declared as critical. This vulnerability affects unknown code of the file src/datastore/postgres/PgDataStore.ts. The manipulation of the argument roomIds leads to sql injection. Upgrading to version 0.36.0 is able to...

CVE-2022-3971

Summary (CVE-2022-3971) : A SQL injection vulnerability exists in matrix-appservice-irc up to version 0.35.1, in an unknown portion of the code path that handles the argument roomIds within PgDataStore.ts . The issue is exploitable via untrusted input and is described as a critical risk in multip...

CVE-2021-3971

A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BIOS image could allow an attacker with elevated privileges to modify firmware protection region by modifying an NVRAM variable...

CVE-2021-3971

A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BIOS image could allow an attacker with elevated privileges to modify firmware protection region by modifying an NVRAM variable...

Lenovo issues fixes for laptop backdoors

Researchers have discovered three vulnerabilities affecting various Lenovo consumer laptop models. The vulnerabilities were found in UEFI firmware drivers originally meant to be used only during the manufacturing process, along with a vulnerability in the SW SMI handler function. The list of...

CVE-2021-3971

creationtimestamp| type| source ---|---|--- 2022-04-20 03:02:52+00:00| seen| https://t.me/SecLabNews/11982 2022-04-20 08:39:20+00:00| seen| https://t.me/cKure/9392 2022-04-20 11:50:25+00:00| seen| https://t.me/truesecator/2866 2022-04-20 15:13:05+00:00| seen| https://t.me/NeKaspersky/2140...

New Lenovo UEFI Firmware Vulnerabilities Affect Millions of Laptops

Three high-impact Unified Extensible Firmware Interface UEFI security vulnerabilities have been discovered impacting various Lenovo consumer laptop models, enabling malicious actors to deploy and execute firmware implants on the affected devices. Tracked as CVE-2021-3970, CVE-2021-3971, and...

Oracle Linux 7 : hunspell (ELSA-2020-3971)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-3971 advisory. 1.3.2-16 - Resolves: rhbz1775556 CVE-2019-16707 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note tha...

CVE-2020-3971

VMware CVE-2020-3971 describes a heap-overflow vulnerability in the vmxnet3 virtual network adapter affecting VMware ESXi (6.7/6.5 lines; 7.0 later), Workstation, and Fusion. An attacker with local access to a VM that has a vmxnet3 adapter present may read privileged information from physical/hyp...

VMSA-2020-0015:VMware Cloud Foundation, ESXi, Workstation, and Fusion updates address multiple security vulnerabilities

Advisory ID: VMSA-2020-0015.2 CVSSv3 Range: 4.0 - 9.3 Issue Date:2020-06-23 Updated On: 2020-07-02 CVEs: CVE-2020-3962, CVE-2020-3963, CVE-2020-3964, CVE-2020-3965, CVE-2020-3966, CVE-2020-3967, CVE-2020-3968, CVE-2020-3969, CVE-2020-3970, CVE-2020-3971 Synopsis: VMware Cloud Foundation, ESXi,...

Virtuozzo Linux Errata and Bugfix Advisory 2019:3971

Upstream security update. Follow RHBA-2019:3971 for details...

CVE-2019-3971

CVE-2019-3971 affects Comodo Antivirus up to version 12.0.0.6810. It is a local Denial of Service affecting CmdVirth.exe via the LPC port cmdvrtLPCServerPort. A low-privilege local process can connect and send an LPC_DATAGRAM, triggering an Access Violation due to hardcoded NULLs used as the Sour...

Ubuntu: Security Advisory (USN-3971-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 18.10 / 19.04 : Monit vulnerabilities (USN-3971-1)

Zack Flack discovered that Monit incorrectly handled certain input. A remote authenticated user could exploit this to conduct cross-site scripting XSS attacks. CVE-2019-11454 Zack Flack discovered a buffer overread when Monit decoded certain crafted URLs. An attacker could exploit this to leak...

MongoDB 2.6.x < 2.6.9, 3.0.x < 3.0.14, 3.2.x < 3.2.8 mongod

The version of the remote MongoDB server is 2.6.x prior to 2.6.9, is 3.0.x 3.0.14 or is 3.2.x 3.2.8. It is, therefore, affected by multiple vulnerabilities. - A credentials disclosure vulnerability exists in the PEMKeyPassword, clusterPassword and Windows servicePassword. An unauthenticated local...

CVE-2018-3971

creationtimestamp| type| source ---|---|--- 2018-11-01 16:05:37+00:00| published-proof-of-concept| https://t.me/ctinow/4375 2024-10-08 14:32:29+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/109...

CVE-2018-3971

An exploitable arbitrary write vulnerability exists in the 0x2222CC IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP request can cause the driver to write data under controlled by an attacker address, resulting in memory corruption. An attacker can send IRP...

CVE-2018-3971

An exploitable arbitrary write vulnerability exists in the 0x2222CC IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP request can cause the driver to write data under controlled by an attacker address, resulting in memory corruption. An attacker can send IRP...

CVE-2018-3971

CVE-2018-3971 is a privilege-escalation flaw in Sophos HitmanPro.Alert (hmpalert.sys) 3.7.6.744, exploitable via IOCTL 0x2222CC. The vulnerability enables an attacker to perform an arbitrary write by supplying srcAddress, dstAddress, and srcSize; a write-what-where effect can copy data from the a...

CVE-2017-3971

CVE-2017-3971 – McAfee Network Security Management (NSM) : The vulnerability affects the NSM web interface prior to 8.2.7.42.2, due to insecure use of RC4 encryption ciphers in the authentication/web layer, enabling attackers to view confidential information. The issue is documented across multip...