3196 matches found
PT-2022-21486 · Apple · Ipados +3
Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.5 watchOS versions prior to 8.7 iOS versions prior to 15.6 iPadOS versions prior to 15.6 Description: The issue was addressed with improved memory handling. An app may be able to execute arbitrary code with kernel...
PT-2022-20576 · Haproxy +3 · Haproxy +3
Name of the Vulnerable Software and Affected Versions: Roxy-WI versions prior to 6.1.1.0 Description: Roxy-WI is a Web interface for managing HAProxy, Nginx, and Keepalived servers. The system command can be run remotely via the subprocess execute function without processing the inputs received...
PT-2022-22976 · Bmc · Bmc Track-It!
Name of the Vulnerable Software and Affected Versions: BMC Track-It! version 20.21.2.109 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the authorization of...
PT-2022-3839 · Microsoft · Lync Server +1
Name of the Vulnerable Software and Affected Versions: Skype for Business Server and Microsoft Lync Server affected versions not specified Description: The issue is related to insufficient input validation, which can be exploited by a remote attacker to execute arbitrary code in the target system...
PT-2022-20540
Name of the Vulnerable Software and Affected Versions UltraJSON versions prior to 5.4.0 Description The issue occurs when an error happens while reallocating a buffer for string decoding, causing the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is...
GHSA-3829-MGMW-JCG4 Prototype Pollution in deep.assign
deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...
Authentication Bypass
firefox and thunderbird are vulnerable to authentication bypass. ms-msdt, search, and search-ms protocols deliver content to Microsoft applications, bypassing the browser, when a user accepts a prompt...
Denial Of Service (DoS)
curl is vulnerable to denial of service. The vulnerability exists because the amount of accepted "chained" algorithms is very high which allows an attacker to cause an application crash...
PT-2022-3174 · Emerson · Emerson Roc +1
Name of the Vulnerable Software and Affected Versions: Emerson ROC and FloBoss RTU product lines through 2022-05-02 Description: The issue is related to insecure filesystem operations in the Emerson ROC and FloBoss RTU product lines. These products use the ROC protocol for communications between ...
PT-2022-3093 · Omron · Omron Sysmac Cx
Name of the Vulnerable Software and Affected Versions: Omron SYSMAC Cx product family PLCs CS series, CJ series, and CP series through 2022-05-18 Description: The issue is related to a lack of cryptographic authentication in the Omron FINS 9600/TCP protocol used for engineering purposes, includin...
PT-2022-3096 · Omron · Omron Cs Series
Name of the Vulnerable Software and Affected Versions: Omron CS series, CJ series, and CP series PLCs through 2022-05-18 Description: The issue concerns the transmission of confidential information in cleartext, specifically passwords used for the UM Protection setting. This setting allows users ...
Denial Of Service (DoS)
@discordjs/opus is vulnerable to denial of service. An attacker is able cause an application crash via sending crafted requests through an encoder with zero channels, or a non-initialized buffer...
Cross-site Scripting (XSS)
microweber/microweber is vulnerable to cross site scripting. The vulnerability exists due to a lack of sanitization in the savefromliveedit function in ContentManagerHelpers.php which allow a malicious user to inject maliciously crafted script into the system...
PT-2022-21949
Name of the Vulnerable Software and Affected Versions got package versions prior to 12.1.0 got package versions prior to 11.8.5 Description The issue allows a redirect to a UNIX socket. This is related to the got package for Node.js. Recommendations For versions prior to 12.1.0, update to version...
PT-2022-20617 · Unknown · Drive Composer
Name of the Vulnerable Software and Affected Versions: Drive Composer affected versions not specified Description: The issue allows a low-privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content, provided the file does not already exist...
PT-2022-7918 · Navetti · Navetti Pricepoint
Name of the Vulnerable Software and Affected Versions: Navetti PricePoint version 4.6.0.0 Description: A critical issue has been found, affecting unknown code and leading to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be...
Unsafe deserialization in com.alibaba:fastjson
The package com.alibaba:fastjson before 1.2.83 is vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not...
Regular Expression Denial Of Service (ReDoS)
markdown-link-extractor is vulnerable to regular expression denial of service. An attacker can crash the application by providing malicious input to the module.exports function of index.js due to the insecure regex pattern used for the image parameter...
Privilege Escalation
ansible-runner is vulnerable to privilege escalation. A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment...
