Lucene search
+L
PrionMost viewed

213680 matches found

Prion
Prion
•added 2023/02/08 8:15 p.m.•46 views

Design/Logic Flaw

A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages fo...

2.6CVSS6.6AI score0.16195EPSS
SaveExploits0References2Affected Software4
Prion
Prion
•added 2023/02/06 8:15 p.m.•46 views

Command injection

Fortra formerly, HelpSystems GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2...

5.8CVSS7.2AI score0.99999EPSS
SaveExploits12References8Affected Software1
Prion
Prion
•added 2022/11/26 2:15 a.m.•46 views

Code injection

In PyTorch before trunk/89695, torch.jit.annotations.parsetypeline can cause arbitrary code execution because eval is used unsafely...

7.5CVSS9.7AI score0.01243EPSS
SaveExploits1References2Affected Software1
Prion
Prion
•added 2022/11/01 6:15 p.m.•46 views

Stack overflow

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate...

5CVSS7.9AI score0.9077EPSS
SaveExploits6References40Affected Software3
Prion
Prion
•added 2022/10/19 11:15 a.m.•46 views

Authentication flaw

Asus RT-N12E 2.0.0.39 is affected by an incorrect access control vulnerability. Through system.asp / startapply.htm, an attacker can change the administrator password without any authentication...

5CVSS7.7AI score0.00989EPSS
SaveExploits1References3Affected Software1
Prion
Prion
•added 2022/10/18 2:15 p.m.•46 views

Authentication flaw

An authentication bypass using an alternate path or channel CWE-288 in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform...

7.5CVSS9.7AI score0.99984EPSS
SaveExploits25References3Affected Software3
Prion
Prion
•added 2022/10/17 9:15 p.m.•46 views

Unrestricted file upload

Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1...

5.8CVSS6.9AI score0.44002EPSS
SaveExploits7References3Affected Software1
Prion
Prion
•added 2022/09/23 7:15 p.m.•46 views

Input validation

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing maliciously crafted web content may lead to arbitrary code execution...

6.8CVSS8.5AI score0.01991EPSS
SaveExploits0References5Affected Software5
Prion
Prion
•added 2022/08/29 11:15 p.m.•46 views

Command injection

Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi...

7.5CVSS9.8AI score0.90902EPSS
SaveExploits1References3Affected Software1
Prion
Prion
•added 2022/07/19 10:15 p.m.•46 views

Design/Logic Flaw

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to...

2.6CVSS5.8AI score0.02575EPSS
SaveExploits0References11Affected Software7
Prion
Prion
•added 2022/06/17 8:15 p.m.•46 views

Command injection

ASUS RT-N53 3.0.0.4.376.3754 has a command injection vulnerability in the SystemCmd parameter of the apply.cgi interface...

7.5CVSS9.6AI score0.19978EPSS
SaveExploits1References1Affected Software1
Prion
Prion
•added 2022/06/02 10:15 p.m.•46 views

Code injection

Owl Labs Meeting Owl 5.2.0.15 allows attackers to deactivate the passcode protection mechanism via a certain c 11 message...

3.3CVSS6.6AI score0.00885EPSS
SaveExploits1References3Affected Software1
Prion
Prion
•added 2022/05/27 2:15 p.m.•46 views

Cross site scripting

A vulnerability in the web applications of Cisco UCS Director could allow an authenticated, remote attacker to conduct a cross-site scripting attack on an affected system. This vulnerability is due to unsanitized user input. An attacker could exploit this vulnerability by submitting custom...

3.5CVSS4.8AI score0.00564EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2022/05/02 12:16 p.m.•46 views

Privilege escalation

A Improper Privilege Management vulnerability in SUSE Rancher allows write access to the Catalog for any user when restricted-admin role is enabled. This issue affects: SUSE Rancher Rancher versions prior to 2.5.13; Rancher versions prior to 2.6.4...

5.5CVSS5.5AI score0.00614EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2022/04/19 9:15 p.m.•46 views

Design/Logic Flaw

Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: General. Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physica...

2.9CVSS2.1AI score0.01777EPSS
SaveExploits0References2Affected Software1
Prion
Prion
•added 2022/03/23 8:15 p.m.•46 views

Design/Logic Flaw

An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1...

7.2CVSS7.5AI score0.00536EPSS
SaveExploits0References6Affected Software3
Prion
Prion
•added 2022/03/04 4:15 p.m.•46 views

Sql injection

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption...

5.1CVSS7AI score0.01901EPSS
SaveExploits0References5Affected Software6
Prion
Prion
•added 2022/02/04 11:15 p.m.•47 views

Stack overflow

Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would trigger a division by zero in BiasAndClamp implementation. There is no check that the biassize is non zero. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on...

4CVSS6.6AI score0.00763EPSS
SaveExploits1References3Affected Software1
Prion
Prion
•added 2022/01/28 10:15 p.m.•46 views

Design/Logic Flaw

There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis...

4.3CVSS5.3AI score0.83645EPSS
SaveExploits1References9Affected Software8
Prion
Prion
•added 2022/01/19 12:15 p.m.•46 views

Buffer overflow

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allow...

5CVSS4.7AI score0.02896EPSS
SaveExploits0References6Affected Software7
Prion
Prion
•added 2021/12/27 10:15 p.m.•46 views

Design/Logic Flaw

MinIO is a Kubernetes native application for cloud storage. Prior to version RELEASE.2021-12-27T07-23-18Z, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version RELEASE.2021-12-27T07-23-18Z changes the...

6.5CVSS8.5AI score0.35462EPSS
SaveExploits3References5Affected Software1
Prion
Prion
•added 2021/10/05 6:15 p.m.•46 views

Design/Logic Flaw

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "publicmode" configurati...

6.8CVSS7AI score0.99933EPSS
SaveExploits1References8Affected Software2
Prion
Prion
•added 2021/09/08 3:15 p.m.•46 views

Code injection

This issue was addressed with improved checks. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Security Update 2021-003 Catalina, macOS Big Sur 11.4, watchOS 7.5. Processing a maliciously crafted image may lead to arbitrary code execution...

6.8CVSS7.7AI score0.01142EPSS
SaveExploits0References5Affected Software6
Prion
Prion
•added 2021/09/07 5:15 p.m.•46 views

Authentication flaw

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution...

7.5CVSS9.9AI score0.9896EPSS
SaveExploits8References3Affected Software1
Prion
Prion
•added 2021/09/01 12:15 p.m.•46 views

Design/Logic Flaw

Wireless devices running certain Arcadyan-derived firmware such as KPN Experia WiFi 1.00.15 do not properly sanitise user input to the syslog configuration form. An authenticated remote attacker could leverage this to alter the device configuration and achieve remote code execution. This can be...

9CVSS8.3AI score0.99983EPSS
SaveExploits6References2Affected Software1
Prion
Prion
•added 2021/08/10 3:15 p.m.•46 views

Design/Logic Flaw

The STARTTLS feature in Exim through 4.94.2 allows response injection buffering during MTA SMTP sending...

5CVSS7.6AI score0.01996EPSS
SaveExploits0References3Affected Software1
Prion
Prion
•added 2021/08/08 8:15 p.m.•46 views

Code injection

drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to cause a denial of service use-after-free and panic by removing a MAX-3421 USB device in certain situations...

4.6CVSS6.3AI score0.00333EPSS
SaveExploits0References3Affected Software2
Prion
Prion
•added 2021/07/15 2:15 p.m.•46 views

Sql injection

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic...

2.6CVSS6.8AI score0.06975EPSS
SaveExploits1References16Affected Software3
Prion
Prion
•added 2021/07/14 6:15 p.m.•46 views

Remote code execution

Microsoft Exchange Server Remote Code Execution Vulnerability...

10CVSS8.3AI score0.99999EPSS
SaveExploits16References3Affected Software1
Prion
Prion
•added 2021/07/09 2:15 p.m.•46 views

Authentication flaw

Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client...

7.5CVSS9.2AI score0.85735EPSS
SaveExploits1References4Affected Software2
Prion
Prion
•added 2021/06/09 6:15 p.m.•46 views

Cross site request forgery (csrf)

FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery CSRF attack. I...

5.8CVSS8.1AI score0.00779EPSS
SaveExploits0References3Affected Software2
Prion
Prion
•added 2021/04/27 6:15 a.m.•46 views

Design/Logic Flaw

DISPUTED Unbound before 1.9.5 allows an assertion failure and denial of service in synthcname. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited...

5CVSS8.3AI score0.01989EPSS
SaveExploits0References3Affected Software2
Prion
Prion
•added 2021/04/26 5:15 p.m.•46 views

Design/Logic Flaw

Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

6.8CVSS8.9AI score0.09307EPSS
SaveExploits0References6Affected Software2
Prion
Prion
•added 2021/04/22 10:15 p.m.•46 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

4CVSS4.8AI score0.0278EPSS
SaveExploits0References7Affected Software3
Prion
Prion
•added 2021/04/02 6:15 p.m.•46 views

Type confusion

A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to...

6.8CVSS8.9AI score0.14479EPSS
SaveExploits0References8Affected Software8
Prion
Prion
•added 2021/04/02 5:15 a.m.•46 views

Memory corruption

An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. videousercopy in drivers/media/v4l2-core/v4l2-ioctl.c has a memory leak for large arguments, aka CID-fb18802a338b...

2.1CVSS6.1AI score0.00369EPSS
SaveExploits0References4Affected Software2
Prion
Prion
•added 2021/03/20 10:15 p.m.•46 views

Integer overflow

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error with a resultant integer underflow affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information...

3.6CVSS5.5AI score0.00577EPSS
SaveExploits0References9Affected Software4
Prion
Prion
•added 2021/02/26 11:15 p.m.•46 views

Input validation

The iconv function in the GNU C Library aka glibc or libc6 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a deni...

2.1CVSS7.1AI score0.04006EPSS
SaveExploits1References7Affected Software3
Prion
Prion
•added 2021/02/02 1:15 p.m.•46 views

Command injection

D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the systemmgr.cgi component, which can lead to remote arbitrary code execution...

7.5CVSS9.9AI score0.99968EPSS
SaveExploits2References3Affected Software1
Prion
Prion
•added 2021/01/20 3:15 p.m.•46 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Stored Procedure. Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. While t...

6.8CVSS6.2AI score0.02157EPSS
SaveExploits0References3Affected Software1
Prion
Prion
•added 2020/10/21 3:15 p.m.•46 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Locking. Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to...

6.8CVSS5.1AI score0.02915EPSS
SaveExploits0References7Affected Software5
Prion
Prion
•added 2020/10/16 5:15 p.m.•46 views

Null pointer dereference

Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the bounded channel incorrectly assumes that Vec::fromiter has allocated capacity that same as the number of iterator elements. Vec::fromiter does not actually guarantee that and may allocate extra...

7.5CVSS9.3AI score0.02776EPSS
SaveExploits1References4Affected Software1
Prion
Prion
•added 2020/10/12 11:15 a.m.•46 views

Buffer overflow

A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service DoS and potentially execute arbitrary code by sending a malicious request to the firewall. This vulnerability affected SonicOS Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 versio...

7.5CVSS9.8AI score0.26869EPSS
SaveExploits0References1Affected Software2
Prion
Prion
•added 2020/09/11 5:15 p.m.•46 views

Security feature bypass

A security feature bypass vulnerability exists in Windows Defender Application Control WDAC which could allow an attacker to bypass WDAC enforcement. An attacker who successfully exploited this vulnerability could execute PowerShell commands that would be blocked by WDAC. To exploit the...

7.2CVSS7.9AI score0.07037EPSS
SaveExploits0References1Affected Software3
Prion
Prion
•added 2020/09/09 4:15 p.m.•46 views

Design/Logic Flaw

In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in ctnetlinkparsetuplefilter in net/netfilter/nfconntracknetlink.c, aka CID-1cc5ef91d2ff...

3.6CVSS5.8AI score0.00566EPSS
SaveExploits1References9Affected Software3
Prion
Prion
•added 2020/06/17 11:15 a.m.•46 views

Double free

The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free...

6.4CVSS8.9AI score0.13195EPSS
SaveExploits1References11Affected Software1
Prion
Prion
•added 2020/05/14 2:15 p.m.•46 views

Code injection

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator...

4.3CVSS6AI score0.06301EPSS
SaveExploits3References4Affected Software1
Prion
Prion
•added 2020/05/07 9:15 p.m.•46 views

Open redirect

In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability. Users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is check...

5.8CVSS6.2AI score0.0079EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2020/05/05 5:15 a.m.•46 views

Race condition

The mptctlioctl function in drivers/message/fusion/mptctl.c in the Linux kernel before 5.4.14 allows local users to hold an incorrect lock during the ioctl operation and trigger a race condition, i.e., a "double fetch" vulnerability, aka CID-28d76df18f0a. NOTE: the vendor states "The security...

4.7CVSS5.4AI score0.00328EPSS
SaveExploits0References9Affected Software1
Prion
Prion
•added 2020/04/15 2:15 p.m.•46 views

Design/Logic Flaw

Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise...

4.3CVSS3.2AI score0.02497EPSS
SaveExploits0References4Affected Software4
Total number of security vulnerabilities5000