17638 matches found
CVE-2021-39635
imsex is a vendor system service used to manage VoLTE in unisoc devices，But it does not verify the caller's permissions，so that normal apps No phone permissions can obtain some VoLTE sensitive information and manage VoLTE calls.Product: AndroidVersions: Android SoCAndroid ID: A-206492634...
CVE-2022-22766
The CVE-2022-22766 issue affects BD Pyxis medical dispensing devices and related systems. Root cause: use of hard-coded credentials enabling potential access to the device file system and sensitive data (ePHI). Affected products include a wide range of BD Pyxis components (Anesthesia Station ES/4...
CVE-2020-14521
CVE-2020-14521 affects Mitsubishi Electric Factory Automation engineering software and is a vulnerability in unquoted search path or element (CWE-428) that can lead to remote code execution with high impact. Public sources indicate affected Mitsubishi products span a wide range of engineering uti...
CVE-2021-45385
Summary (CVE-2021-45385 – ffjpeg) A Null Pointer Dereference affects ffjpeg (revision d5cfd49, 2021-12-06) in bmp_load(). When BMP metadata size is out of range, the code may skip allocating memory to pb->pdata and continue execution, causing a crash when jfif_encode() accesses pb->data (jf...
Beers with Talos, Ep. #116: Let's wade into the MuddyWater filled with Vipers
Beers with Talos BWT Podcast episode No. 116 is now available. Download this episode and subscribe to Beers with Talos: Apple Podcasts Google Podcasts Spotify StitcherRecorded Feb. 4, 2022. If iTunes and Google Play aren't your thing, click here. Most people... This is only the beginning! Please...
Code Injection in publify/publify
Description The application doesn't check/filter the comments provided by the user before save to database. Attacker can't insert js code to steal admin's data but can insert html code, leads to many information security risks. Proof of Concept - Step 1: Go to...
CVE-2022-20630
The CVE-2022-20630 issue affects Cisco DNA Center and is caused by unsecured logging of sensitive information in audit logs. An authenticated, local attacker with administrative privileges could access audit logs via the CLI and retrieve sensitive data, including user credentials. Cisco has relea...
Improper Access Control in liukuo362573/yishaadmin
Description https://www.github.com/liukuo362573/yishaadmin has an endpoint "/admin/File/UploadFile" that allows uploading files without authentication. Root-cause Server doesn't check user's permission when attacker access the endpoint. After that, server will directly call UploadFile function wi...
Bentley Systems MicroStation Buffer Overflow Vulnerability (CNVD-2022-16150)
Bentley Systems MicroStation is a Cad software platform for 2D and 3D design and drafting from Bentley Systems, USA. A buffer overflow vulnerability exists in Bentley Systems MicroStation, which can be exploited by an attacker to disclose sensitive information about an affected installation of...
Home Owners Collection Management System 1.0 Account Takeover
Exploit Title: Home Owners Collection Management System 1.0 - Account Takeover Unauthenticated Date: 9/02/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://www.sourcecodester.com/ Software Link:...
Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of D...
CVE-2022-21205
CVE-2022-21205 is an XML External Entity (XXE) vulnerability in Intel® Quartus® Prime Pro Edition’s DSP Builder Pro. Before version 21.3, an unauthenticated attacker could potentially disclose information via network access due to improper restriction of XML external entity references. Affected p...
CVE-2021-33068
CVE-2021-33068 is a null pointer dereference in the Intel AMT subsystem. Intel SPS/AMT/PMC chipset firmware before certain versions may allow an authenticated remote attacker to cause a denial-of-service via network access. Public documents from NVD/Intel/Red Hat/IBM describe affected components ...
CVE-2021-0170
CVE-2021-0170 affects firmware for Intel PROSet/Wireless Wi-Fi and some Killer Wi‑Fi products. Affected firmware exposes sensitive information to authenticated users via local access (information disclosure). Root cause: improper exposure of data in firmware. Impacts include Intel PROSet/Wireless...
CVE-2022-0536
CVE-2022-0536 affects npm follow-redirects before 1.14.8. Root cause: improper removal of sensitive information before storage or transfer. Impact is limited (low base score in connected doc); upgrading to 1.14.8+ fixes the issue. References include a responsible-commit link and an associated Hun...
