Lucene search
+L
PrionMost viewed

213680 matches found

Prion
Prion
•added 2022/10/29 2:15 a.m.•44 views

Design/Logic Flaw

In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly instead of using an insecure cleartext HTTP step even when HTTP is provided in the URL. This mechanism could be bypassed if the host nam...

5CVSS8.2AI score0.01644EPSS
SaveExploits0References11Affected Software3
Prion
Prion
•added 2022/10/18 9:15 p.m.•44 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Privileges. Supported versions that are affected are 5.7.39 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromi...

4CVSS3.3AI score0.00936EPSS
SaveExploits0References2Affected Software1
Prion
Prion
•added 2022/09/26 2:15 a.m.•44 views

Design/Logic Flaw

An issue was discovered in Zimbra Collaboration ZCS 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole extraction to /opt/zimbra/jetty/webapps/zimbra/public that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also,...

7.5CVSS8.7AI score0.95478EPSS
SaveExploits7References5Affected Software1
Prion
Prion
•added 2022/09/23 7:15 p.m.•44 views

Input validation

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing maliciously crafted web content may lead to arbitrary code execution...

6.8CVSS8.5AI score0.02048EPSS
SaveExploits0References5Affected Software5
Prion
Prion
•added 2022/07/25 3:15 p.m.•44 views

Cross site scripting

OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting XSS vulnerability via the SitePages module...

4.3CVSS5AI score0.00853EPSS
SaveExploits1References4Affected Software1
Prion
Prion
•added 2022/07/14 8:15 p.m.•44 views

Input validation

The jQuery Validation Plugin jquery-validation provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service ReDoS when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix...

5CVSS7.5AI score0.0204EPSS
SaveExploits2References3Affected Software1
Prion
Prion
•added 2022/06/09 5:15 p.m.•44 views

Buffer overflow

Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread that point past the end of the storage allocated for the buffer...

5CVSS8.4AI score0.04998EPSS
SaveExploits0References6Affected Software2
Prion
Prion
•added 2022/06/05 10:15 p.m.•44 views

Double free

The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 "Double-Hash Port Selection Algorithm" of RFC 6056...

2.1CVSS5.2AI score0.00431EPSS
SaveExploits1References6Affected Software1
Prion
Prion
•added 2022/05/09 6:15 p.m.•44 views

Design/Logic Flaw

There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including KernelFloat and Stringtof...

4.3CVSS8.5AI score0.04267EPSS
SaveExploits0References14Affected Software3
Prion
Prion
•added 2022/04/19 9:15 p.m.•44 views

Design/Logic Flaw

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows...

5CVSS7AI score0.60336EPSS
SaveExploits6References18Affected Software5
Prion
Prion
•added 2022/04/19 9:15 p.m.•44 views

Design/Logic Flaw

Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: General. Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physica...

2.9CVSS2.1AI score0.0175EPSS
SaveExploits0References2Affected Software1
Prion
Prion
•added 2022/04/01 11:15 p.m.•44 views

Race condition

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition...

4CVSS6.6AI score0.36081EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2022/03/04 4:15 p.m.•44 views

Sql injection

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption...

5.1CVSS7AI score0.01901EPSS
SaveExploits0References5Affected Software6
Prion
Prion
•added 2022/02/14 12:15 p.m.•44 views

Null pointer dereference

In gcdatasegment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a movedatapage NULL pointer dereference...

4.3CVSS5.1AI score0.01234EPSS
SaveExploits1References6Affected Software1
Prion
Prion
•added 2022/02/01 1:15 p.m.•44 views

Sql injection

The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the questionid GET parameter before using it in a SQL statement in the getquestion AJAX action, allowing unauthenticated users to perform SQL injection...

7.5CVSS9.7AI score0.86896EPSS
SaveExploits7References2Affected Software1
Prion
Prion
•added 2022/01/19 12:15 p.m.•44 views

Buffer overflow

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allow...

5CVSS4.7AI score0.02896EPSS
SaveExploits0References6Affected Software7
Prion
Prion
•added 2022/01/18 10:15 p.m.•44 views

Design/Logic Flaw

Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, sending a query to that datasource with an API token and no other user credentials will forward the OAuth Identity of the most recently...

3.5CVSS6AI score0.01996EPSS
SaveExploits0References7Affected Software2
Prion
Prion
•added 2021/12/12 5:15 a.m.•44 views

Authentication flaw

Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2,...

10CVSS9.6AI score0.99867EPSS
SaveExploits2References3Affected Software1
Prion
Prion
•added 2021/10/04 6:15 p.m.•44 views

Design/Logic Flaw

Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support 3.2 or newer...

4CVSS5.9AI score0.01831EPSS
SaveExploits0References9Affected Software5
Prion
Prion
•added 2021/08/17 10:15 p.m.•44 views

Code injection

ThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary ThroughTek TUTK device given a valid 20-byte uniquely assigned identifier UID. This could result in an attacker hijacking a victim's connection and forcing them into supplying credentials needed to access the...

7.6CVSS8.2AI score0.02554EPSS
SaveExploits1References3Affected Software1
Prion
Prion
•added 2021/08/17 7:15 p.m.•44 views

Design/Logic Flaw

An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. It is possible that a server would interpret this as a request for that protected resource, such ...

5CVSS6.1AI score0.0177EPSS
SaveExploits0References5Affected Software3
Prion
Prion
•added 2021/07/09 2:15 p.m.•44 views

Sql injection

The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injection in the parameter fldrId. Detailed description --- Given the following request: GET /InstallTab/exportFldr.asp?fldrId=1’ HTTP/1.1 Host: 192.168.1.194 User-Agent: Mozilla/5.0 Macintosh;...

6.5CVSS9.6AI score0.85735EPSS
SaveExploits1References2Affected Software1
Prion
Prion
•added 2021/07/09 2:15 p.m.•44 views

Authentication flaw

Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client...

7.5CVSS9.2AI score0.85735EPSS
SaveExploits1References4Affected Software2
Prion
Prion
•added 2021/07/08 7:15 p.m.•44 views

Authorization

Multiple vulnerabilities in the web-based management interface of Cisco Business Process Automation BPA could allow an authenticated, remote attacker to elevate privileges to Administrator. These vulnerabilities are due to improper authorization enforcement for specific features and for access to...

4CVSS8.6AI score0.01091EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2021/06/22 3:15 p.m.•44 views

Session fixation

For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being...

3.6CVSS5.4AI score0.00963EPSS
SaveExploits1References12Affected Software10
Prion
Prion
•added 2021/06/11 4:15 p.m.•44 views

Design/Logic Flaw

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client...

6.8CVSS8.1AI score0.60122EPSS
SaveExploits1References10Affected Software9
Prion
Prion
•added 2021/06/10 7:15 a.m.•44 views

Heap overflow

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow...

7.5CVSS9.2AI score0.68289EPSS
SaveExploits0References13Affected Software7
Prion
Prion
•added 2021/05/06 1:15 p.m.•44 views

Design/Logic Flaw

Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. Local users can alter the behavior of root processes because a recipient address can have a newline character...

7.2CVSS8.6AI score0.00376EPSS
SaveExploits1References1Affected Software1
Prion
Prion
•added 2021/04/27 6:15 a.m.•44 views

Design/Logic Flaw

DISPUTED Unbound before 1.9.5 allows an assertion failure and denial of service in synthcname. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited...

5CVSS8.3AI score0.01989EPSS
SaveExploits0References3Affected Software2
Prion
Prion
•added 2021/04/06 5:15 a.m.•44 views

Improper access control

The Dashboard plugin through 1.0.2 for GLPI allows remote low-privileged users to bypass access control on viewing information about the last ten events, the connected users, and the users in the tech category. For example, plugins/dashboard/front/main2.php can be used...

4CVSS4.7AI score0.00806EPSS
SaveExploits0References2Affected Software1
Prion
Prion
•added 2021/03/25 10:15 a.m.•44 views

Design/Logic Flaw

In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...

10CVSS9.2AI score0.06132EPSS
SaveExploits0References7Affected Software3
Prion
Prion
•added 2021/02/24 5:15 p.m.•44 views

Remote code execution

The vSphere Client HTML5 contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects...

10CVSS9.8AI score0.99518EPSS
SaveExploits48References4Affected Software2
Prion
Prion
•added 2021/01/20 3:15 p.m.•44 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Stored Procedure. Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. While t...

6.8CVSS6.2AI score0.02157EPSS
SaveExploits0References3Affected Software1
Prion
Prion
•added 2020/11/17 2:15 a.m.•44 views

Privilege escalation

BinaryNights ForkLift 3.x before 3.4 has a local privilege escalation vulnerability because the privileged helper tool implements an XPC interface that allows file operations to any process copy, move, delete as root and changing permissions...

7.2CVSS7.7AI score0.00743EPSS
SaveExploits1References2Affected Software1
Prion
Prion
•added 2020/10/21 3:15 p.m.•44 views

Design/Logic Flaw

Vulnerability in the Java SE product of Oracle Java SE component: Libraries. Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of th...

5CVSS4.3AI score0.0316EPSS
SaveExploits0References7Affected Software7
Prion
Prion
•added 2020/10/21 3:15 p.m.•44 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: LDAP Auth. Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromi...

6.8CVSS5.1AI score0.01802EPSS
SaveExploits0References3Affected Software1
Prion
Prion
•added 2020/09/11 5:15 p.m.•44 views

Security feature bypass

A security feature bypass vulnerability exists in Windows Defender Application Control WDAC which could allow an attacker to bypass WDAC enforcement. An attacker who successfully exploited this vulnerability could execute PowerShell commands that would be blocked by WDAC. To exploit the...

7.2CVSS7.9AI score0.07037EPSS
SaveExploits0References1Affected Software3
Prion
Prion
•added 2020/08/17 7:15 p.m.•44 views

Privilege escalation

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol MS-NRPC. An attacker who successfully exploited the vulnerability could run a specially crafted application on a...

9.3CVSS6.1AI score0.99512EPSS
SaveExploits75References17Affected Software10
Prion
Prion
•added 2020/07/30 9:15 p.m.•44 views

Design/Logic Flaw

The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c...

4.3CVSS4.8AI score0.05271EPSS
SaveExploits0References15Affected Software9
Prion
Prion
•added 2020/07/15 6:15 p.m.•44 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 5.6.48 and prior, 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to...

4CVSS6.1AI score0.02237EPSS
SaveExploits0References7Affected Software3
Prion
Prion
•added 2020/07/14 3:15 p.m.•44 views

Denial of service

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of...

5CVSS7.2AI score0.86608EPSS
SaveExploits1References17Affected Software18
Prion
Prion
•added 2020/06/29 6:15 p.m.•44 views

Design/Logic Flaw

The web interface of Maipu MP1800X-50 7.5.3.14R devices allows remote attackers to obtain sensitive information via the form/formDeviceVerGet URI, such as system id, hardware model, hardware version, bootloader version, software version, software image file, compilation time, and system uptime...

5CVSS6.3AI score0.99876EPSS
SaveExploits21References1Affected Software1
Prion
Prion
•added 2020/06/23 10:15 p.m.•44 views

Authentication flaw

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication spark.authenticate via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even...

9.3CVSS9.5AI score0.29157EPSS
SaveExploits0References6Affected Software2
Prion
Prion
•added 2020/06/17 10:15 p.m.•44 views

Design/Logic Flaw

In ISC BIND9 versions BIND 9.11.14 - 9.11.19, BIND 9.14.9 - 9.14.12, BIND 9.16.0 - 9.16.3, BIND Supported Preview Edition 9.11.14-S1 - 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an...

4CVSS5.1AI score0.02105EPSS
SaveExploits0References8Affected Software5
Prion
Prion
•added 2020/02/24 10:15 p.m.•44 views

Design/Logic Flaw

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse...

5.8CVSS7.1AI score0.09386EPSS
SaveExploits0References19Affected Software19
Prion
Prion
•added 2019/03/05 11:29 p.m.•44 views

Remote code execution

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0604...

6.5CVSS9.5AI score0.99825EPSS
SaveExploits30References2Affected Software3
Prion
Prion
•added 2019/01/16 7:30 p.m.•44 views

Code injection

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: PS. Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to...

4CVSS6AI score0.02887EPSS
SaveExploits0References6Affected Software1
Prion
Prion
•added 2018/10/17 1:31 a.m.•44 views

Design/Logic Flaw

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Logging. Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise...

3.5CVSS5AI score0.02453EPSS
SaveExploits0References6Affected Software3
Prion
Prion
•added 2018/09/14 7:29 a.m.•44 views

Code injection

An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

7.5CVSS9.5AI score0.01658EPSS
SaveExploits1References1Affected Software1
Prion
Prion
•added 2018/07/13 8:29 p.m.•44 views

Code injection

The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property IP, as well as the management of access rights for such IP, including improperly specified HDL syntax allows use of an EDA tool as a decryption oracle. The methods are flawed and, in the most...

4.6CVSS7.4AI score0.00455EPSS
SaveExploits0References2
Total number of security vulnerabilities5000