VulnCheck KEV: CVE-2022-22706

Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages...

SUSE SLES12: libsnmp30 / libsnmp30-32bit / net-snmp / net-snmp-devel / perl-SNMP / etc (SUSE-SU-2022:0030-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0030-1 advisory. - CVE-2020-15862: Make extended MIB read-only bsc1174961 Tenable has extracted the preceding description block directly from the SUSE securi...

DEBIAN-CVE-2021-43816

containerd is an open source container runtime. On installations using SELinux, such as EL8 CentOS, RHEL, Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface CRI, an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any...

Design/Logic Flaw

containerd is an open source container runtime. On installations using SELinux, such as EL8 CentOS, RHEL, Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface CRI, an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any...

CVE-2021-45338

Multiple privilege escalation vulnerabilities in Avast Antivirus prior to 20.4 allow a local user to gain elevated privileges by calling unnecessarily powerful internal methods of the main antivirus service which could lead to the 1 arbitrary file delete, 2 write and 3 reset security...

OPENSUSE-SU-2021:1613-1 Security update for logback

This update for logback fixes the following issues: Upgrade to version 1.2.8 + In response to log4Shell/CVE-2021-44228, all JNDI lookup code in logback has been disabled until further notice. This impacts ContextJNDISelector and insertFromJNDI element in configuration files. + Also in response to...

Upgrade Logback for CVE-2021-42550

h3. Issue Summary In the wake of Log4Shell, CVE-2021-42550 has been created for similar JNDI considerations in Logback. The Logback maintainers have removed some functionality from Logback in response and released Logback 1.2.9. Please note: There is no RCE in Logback, and there is no vulnerabili...

CVE-2021-36780

A Missing Authentication for Critical Function vulnerability in longhorn of SUSE Longhorn allows attackers to connect to a longhorn-engine replica instance granting it the ability to read and write data to and from a replica that they should not have access to. This issue affects: SUSE Longhorn...

PT-2021-24194 · Hashicorp · Hashicorp Vault +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions 1.4.0 through 1.7.6 HashiCorp Vault and Vault Enterprise versions 1.8.0 through 1.8.5 HashiCorp Vault and Vault Enterprise versions 1.9.0 Description: The issue allows an authenticated user with...

The vulnerability of the Jenkins automation server, related to the use of an incomplete blacklist, allows a malicious actor to read and write the contents of any build catalog.

The vulnerability of the Jenkins automation server relates to the use of an incomplete blacklist. Exploiting this vulnerability allows a malicious actor to read and write the contents of any build catalog...

Privilege Escalation

github.com/couchbase/syncgateway is vulnerable to privilege escalation. The vulnerability exists because of storage of bucket credentials in the metadata within sync documents written to the bucket, allowing a user with read privilege to perform write access to data in Couchbase Server. Note: Thi...

CVE-2020-23545

IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ReadXPMW+0x0000000000000531...

Design/Logic Flaw

IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ReadXPMW+0x0000000000000531...

CVE-2021-40826

Clementine Music Player through 1.3.1 is vulnerable to a User Mode Write Access Violation, affecting the MP3 file parsing functionality at clementine+0x3aa207. The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is mishandled by Clementine...

Code injection

Clementine Music Player through 1.3.1 is vulnerable to a User Mode Write Access Violation, affecting the MP3 file parsing functionality at clementine+0x3aa207. The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is mishandled by Clementine...

CVE-2020-23545

CVE-2020-23545 concerns IrfanView 4.54, where a user-mode write access violation is triggered in FORMAT S!ReadXPM_W at +0x0000000000000531. The provided documents identify the vulnerable component as the ReadXPM_W path in the FORMAT handling, but do not publish specifics on exploit vectors, root ...

CVE-2021-40826

Clementine Music Player through 1.3.1 is vulnerable to a User Mode Write Access Violation, affecting the MP3 file parsing functionality at clementine+0x3aa207. The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is mishandled by Clementine...

IrfanView 安全漏洞

IrfanView is an image viewer by the individual developer Irfan Skiljan from Bosnia and Herzegovina, which supports image browsing, image editing, image format conversion and more. A security vulnerability exists in IrfanView 4.54 that allows user-mode write access conflicts starting from...

CVE-2021-38917

IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and write arbitrary host system memory through a series of carefully crafted service procedures. IBM X-Force ID: 210018...

CVE-2021-43963

An issue was discovered in Couchbase Sync Gateway 2.7.0 through 2.8.2. The bucket credentials used to read and write data in Couchbase Server were insecurely being stored in the metadata within sync documents written to the bucket. Users with read access could use these credentials to obtain writ...