2137 matches found
2022 CWE Top 25 Most Dangerous Software Weaknesses
The Homeland Security Systems Engineering and Development Institute, sponsored by CISA and operated by MITRE, has released the 2022 Common Weakness Enumeration CWE Top 25 Most Dangerous Software Weaknesses list. The list uses data from the National Vulnerability Database to compile the most...
IBM Curam Social Program Management会话固定漏洞
IBM Curam Social Program Management is an IBM business and technology solution that provides pre-built health and social program components, business processes, toolsets and interfaces on top of a dynamically configurable architecture. The vulnerability stems from the failure of the program to...
FFmpeg lag_decode_frame function code execution vulnerability
FFmpeg is a complete solution for recording, converting and streaming audio and video from the Ffmpeg team. A code execution vulnerability exists in the FFmpeg lagdecodeframe function, which could be exploited by attackers to execute arbitrary code on the system...
MAL-2022-5770 Malicious code in retrieval-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e8e0b9fc49fd66b253cbe5471b658ced8c291eaca4357787eb75dbd9c5da308 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Code injection
SAP PowerDesigner Proxy - version 16.7, allows an attacker with low privileges and has local access, with the ability to work around system’s root disk access restrictions to Write/Create a program file on system disk root path, which could then be executed with elevated privileges of the...
Dell SupportAssist Client Consumer and Dell SupportAssist Client Commercial Code Issue Vulnerability
Dell SupportAssist Client is a client application from Dell USA. The program provides automated, proactive and predictive techniques for troubleshooting, etc. The Dell SupportAssist Client Consumer and Dell SupportAssist Client Commercial code issue vulnerability could be exploited by an attacker...
Arbitrary file deletion
Dell SupportAssist Client Consumer versions 3.10.4 and versions prior and Dell SupportAssist Client Commercial versions 3.1.1 and versions prior contain an arbitrary file deletion vulnerability. Authenticated non-admin user could exploit the issue and delete arbitrary files on the system...
CVE-2022-29094
Dell SupportAssist Client Consumer versions 3.10.4 and versions prior and Dell SupportAssist Client Commercial versions 3.1.1 and versions prior contain an arbitrary file deletion/overwrite vulnerability. Authenticated non-admin user could exploit the issue and delete or overwrite arbitrary files...
Design/Logic Flaw
Rescue Dispatch Management System v1.0 is vulnerable to Delete any file via /rdms/classes/Master.php?f=deleteimg...
CVE-2022-1882
CVE-2022-1882: A use-after-free in Linux kernel pipes handling (pipes.post_one_notification after free_pipe_info) allows a local user to crash the system and potentially escalate privileges. Documented in CVE-2022-1882 with CVSS v3 base 7.8 (LOCAL, LOW complexity, user is not required to interact...
Keysight N6854A Geolocation server and N6841A RF Sensor software
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Keysight Technologies, Inc. Equipment: N6854A Geolocation server and N6841A RF Sensor software Vulnerabilities: Relative Path Traversal, Deserialization of Untrusted Data 2. RISK EVALUATION Successful...
MAL-2022-2378 Malicious code in ddc-new-relic (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 724b8e2d9bbce93045922539d67f166495a0abac1fe3d410e5cea2ec861e82d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-29645
The CVE-2022-29645 entry concerns TOTOLINK A3100R devices. Connected sources confirm the affected models: V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129. The underlying issue is a hard coded root password stored in the component /etc/shadow.sample, enabling unauthorized root access. CVSS dat...
GHSA-CQ9M-RPM5-27M9 Jenkins Perfecto Mobile Plugin stores credentials in plain text
Jenkins Perfecto Mobile Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...
Important: Red Hat Security Advisory: kernel security and bug fix update
An update for kernel is now available for Red Hat Enterprise Linux 7.6 Advanced Update Support, Red Hat Enterprise Linux 7.6 Telco Extended Update Support, and Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impac...
CVE-2021-37851
CVE-2021-37851 is a local privilege escalation in ESET Windows products where an unpatched installer repair flow can be abused to execute code with higher privileges. Affected are ESET NOD32 Antivirus, Internet Security, Smart Security Premium (11.2 prior to 15.1.12.0) and ESET Endpoint Antivirus...
cockpit: authenticates with revoked certificates
A flaw was found in Cockpit in the way it handles the certificate verification performed by the System Security Services Daemon SSSD. This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List CRL configuration or the certificate status. The...
kernel: HID: mcp2221: prevent a buffer overflow in mcp_smbus_write()
A buffer overflow vulnerability has been found in the linux kernel, such that when calling mcpsmbuswrite, a buffer of a smaller size is called when performing memcpy, resulting in damage to confidentiality, integrity, and availability of the system...
Eaton Intelligent Power Manager
1. EXECUTIVE SUMMARY CVSS v3 5.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Eaton Equipment: Intelligent Power Manager IPM v1 Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code...