Lucene search
+L
PrionMost viewed

213680 matches found

Prion
Prion
•added 2023/03/29 7:15 p.m.•42 views

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...

4.4CVSS7.8AI score0.0077EPSS
SaveExploits0References2Affected Software1
Prion
Prion
•added 2023/03/22 9:15 p.m.•42 views

Code injection

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To carry out this attack, the attacker requires credentials wit...

6.5CVSS8.5AI score0.06681EPSS
SaveExploits2References3Affected Software1
Prion
Prion
•added 2023/03/22 9:15 p.m.•42 views

Design/Logic Flaw

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalat...

4.3CVSS7.4AI score0.0788EPSS
SaveExploits14References5Affected Software1
Prion
Prion
•added 2023/02/23 8:15 p.m.•42 views

Design/Logic Flaw

An allocation of resources without limits or throttling vulnerability exists in curl v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this...

4.3CVSS7.4AI score0.01703EPSS
SaveExploits1References6Affected Software3
Prion
Prion
•added 2023/02/09 5:15 p.m.•42 views

Code injection

Some Dahua embedded products have a vulnerability of unauthorized modification of the device timestamp. By sending a specially crafted packet to the vulnerable interface, an attacker can modify the device system time...

5CVSS5.2AI score0.00438EPSS
SaveExploits0References1Affected Software97
Prion
Prion
•added 2023/02/08 8:15 p.m.•42 views

Type confusion

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1STRING but the public structure definition for GENERALNAME incorrectly specified the type of the x400Address field as ASN1TYPE. This field is subsequentl...

4CVSS7.6AI score0.59501EPSS
SaveExploits0References7Affected Software3
Prion
Prion
•added 2023/02/07 9:15 p.m.•42 views

Design/Logic Flaw

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions Cipher.updateinto would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects such as bytes to b...

6.4CVSS6.5AI score0.01301EPSS
SaveExploits1References2Affected Software1
Prion
Prion
•added 2023/02/01 3:15 a.m.•42 views

Unrestricted file upload

A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length header in an HTTP PUT message sent to URL /officescan/console/html/cgi/fcgiOfcDDA.exe, an unauthenticated remote attacker can upload arbitrary files to the SampleSubmission directory...

6.4CVSS9.3AI score0.59585EPSS
SaveExploits0References1
Prion
Prion
•added 2023/01/04 10:15 p.m.•42 views

Input validation

Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's DateTime.fromRFC2822 has quadratic N^2 complexity on some specific inputs. This causes a noticeable slowdown for inputs with...

5CVSS7.5AI score0.04923EPSS
SaveExploits1References6Affected Software1
Prion
Prion
•added 2022/12/22 8:15 p.m.•42 views

Design/Logic Flaw

When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This vulnerability affects Firefox 98, Firefox ESR 91.7, and Thunderbird 91.7...

4.3CVSS5.2AI score0.00655EPSS
SaveExploits0References4Affected Software3
Prion
Prion
•added 2022/12/20 7:15 p.m.•42 views

Design/Logic Flaw

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when parsing a specially crafted STUN message with unknown attribute. The vulnerability affects...

7.5CVSS9.3AI score0.01026EPSS
SaveExploits0References3Affected Software2
Prion
Prion
•added 2022/12/07 1:15 a.m.•42 views

Design/Logic Flaw

Guests can trigger deadlock in Linux netback driver This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packe...

1.7CVSS6.2AI score0.00213EPSS
SaveExploits0References6Affected Software2
Prion
Prion
•added 2022/10/28 2:15 a.m.•42 views

Race condition

Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition...

7.5CVSS9.6AI score0.00871EPSS
SaveExploits0References2
Prion
Prion
•added 2022/10/19 11:15 a.m.•42 views

Authentication flaw

Asus RT-N12E 2.0.0.39 is affected by an incorrect access control vulnerability. Through system.asp / startapply.htm, an attacker can change the administrator password without any authentication...

5CVSS7.7AI score0.00953EPSS
SaveExploits1References3Affected Software1
Prion
Prion
•added 2022/10/18 2:15 p.m.•42 views

Authentication flaw

An authentication bypass using an alternate path or channel CWE-288 in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform...

7.5CVSS9.7AI score0.99984EPSS
SaveExploits25References3Affected Software3
Prion
Prion
•added 2022/07/20 3:15 p.m.•42 views

Code injection

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the PFE of Juniper Networks Junos OS on PTX Series and QFX10k Series allows an adjacent unauthenticated attacker to gain access to sensitive information. PTX1000 and PTX10000 Series, and QFX10000 Series and PTX5000...

3.3CVSS4.7AI score0.70235EPSS
SaveExploits15References1Affected Software1
Prion
Prion
•added 2022/07/07 9:15 p.m.•42 views

Design/Logic Flaw

In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario...

4CVSS5.2AI score0.01173EPSS
SaveExploits0References4Affected Software2
Prion
Prion
•added 2022/06/17 8:15 p.m.•42 views

Command injection

ASUS RT-N53 3.0.0.4.376.3754 has a command injection vulnerability in the SystemCmd parameter of the apply.cgi interface...

7.5CVSS9.6AI score0.19147EPSS
SaveExploits1References1Affected Software1
Prion
Prion
•added 2022/06/14 10:15 a.m.•42 views

Double free

Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music...

7.2CVSS7.9AI score0.0045EPSS
SaveExploits0References1
Prion
Prion
•added 2022/06/01 8:15 p.m.•42 views

Remote code execution

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs,...

9.3CVSS8.3AI score0.99374EPSS
SaveExploits63References2Affected Software4
Prion
Prion
•added 2022/05/27 2:15 p.m.•42 views

Cross site scripting

A vulnerability in the web applications of Cisco UCS Director could allow an authenticated, remote attacker to conduct a cross-site scripting attack on an affected system. This vulnerability is due to unsanitized user input. An attacker could exploit this vulnerability by submitting custom...

3.5CVSS4.8AI score0.00548EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2022/05/02 12:16 p.m.•42 views

Privilege escalation

A Improper Privilege Management vulnerability in SUSE Rancher allows write access to the Catalog for any user when restricted-admin role is enabled. This issue affects: SUSE Rancher Rancher versions prior to 2.5.13; Rancher versions prior to 2.6.4...

5.5CVSS5.5AI score0.00599EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2022/04/21 7:15 p.m.•42 views

Sql injection

A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to improper validation of...

5.5CVSS8.2AI score0.00808EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2022/04/12 5:15 a.m.•42 views

Sql injection

An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate, aggregate, and extra methods are subject to SQL injection in column aliases via a crafted dictionary with dictionary expansion as the passed kwargs...

7.5CVSS9.4AI score0.18661EPSS
SaveExploits3References9Affected Software2
Prion
Prion
•added 2022/04/01 11:15 p.m.•42 views

Security feature bypass

It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 https://access.redhat.com/errata/RHSA-2020:4676 erratum released as part of Red Hat Enterprise Linux 8.3 failed to include the fix for the qemu-kvm component issue CVE-2020-10756, which was previously corrected in...

2.1CVSS6.6AI score0.0051EPSS
SaveExploits0References3Affected Software1
Prion
Prion
•added 2022/04/01 11:15 p.m.•42 views

Remote code execution

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources...

7.5CVSS9.4AI score0.99939EPSS
SaveExploits36References6Affected Software28
Prion
Prion
•added 2022/03/23 11:15 a.m.•42 views

Design/Logic Flaw

BIND 9.16.11 - 9.16.26, 9.17.0 - 9.18.0 and versions 9.16.11-S1 - 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSEWAIT status for an indefinite period of time, even after the client has terminated the connection...

4.3CVSS5.7AI score0.02703EPSS
SaveExploits0References5Affected Software3
Prion
Prion
•added 2022/02/04 11:15 p.m.•43 views

Stack overflow

Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would trigger a division by zero in BiasAndClamp implementation. There is no check that the biassize is non zero. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on...

4CVSS6.6AI score0.00757EPSS
SaveExploits1References3Affected Software1
Prion
Prion
•added 2022/01/28 10:15 p.m.•42 views

Design/Logic Flaw

There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis...

4.3CVSS5.3AI score0.83645EPSS
SaveExploits1References9Affected Software8
Prion
Prion
•added 2022/01/10 2:12 p.m.•42 views

Input validation

An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution...

4.6CVSS8AI score0.00392EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2021/12/13 6:15 p.m.•42 views

Hardcoded credentials

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant...

6.8CVSS6.7AI score0.02456EPSS
SaveExploits0References14Affected Software8
Prion
Prion
•added 2021/12/10 10:15 a.m.•42 views

Default configuration

Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message...

9.3CVSS9.7AI score0.99999EPSS
SaveExploits359References52Affected Software102
Prion
Prion
•added 2021/12/06 4:15 p.m.•42 views

Design/Logic Flaw

The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user...

5CVSS7.5AI score0.71532EPSS
SaveExploits5References2Affected Software1
Prion
Prion
•added 2021/11/10 5:15 p.m.•42 views

Memory corruption

A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges. The attacker must have network access to the...

10CVSS9.7AI score0.19087EPSS
SaveExploits1References1Affected Software1
Prion
Prion
•added 2021/09/01 12:15 p.m.•42 views

Design/Logic Flaw

Wireless devices running certain Arcadyan-derived firmware such as KPN Experia WiFi 1.00.15 do not properly sanitise user input to the syslog configuration form. An authenticated remote attacker could leverage this to alter the device configuration and achieve remote code execution. This can be...

9CVSS8.3AI score0.9998EPSS
SaveExploits6References2Affected Software1
Prion
Prion
•added 2021/08/12 9:15 p.m.•42 views

Design/Logic Flaw

Belledonne Belle-sip before 4.5.20, as used in Linphone and other products, can crash via an invalid From header in a SIP message...

5CVSS7.6AI score0.01294EPSS
SaveExploits0References2Affected Software1
Prion
Prion
•added 2021/08/05 8:15 p.m.•42 views

Remote code execution

Neo4j through 3.4.18 with the shell server enabled exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains...

7.5CVSS9.8AI score0.13386EPSS
SaveExploits1References1Affected Software1
Prion
Prion
•added 2021/07/12 3:15 p.m.•42 views

Cross site request forgery (csrf)

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer...

5CVSS5.3AI score0.75353EPSS
SaveExploits1References16Affected Software22
Prion
Prion
•added 2021/06/09 2:15 a.m.•42 views

Path traversal

For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal...

5CVSS5.9AI score0.7848EPSS
SaveExploits2References24Affected Software4
Prion
Prion
•added 2021/03/30 3:15 p.m.•42 views

Design/Logic Flaw

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty io.netty:netty-codec-http2 before version 4.1.61.Final there is a vulnerability that enables request smuggling. The...

4.3CVSS6.5AI score0.18891EPSS
SaveExploits0References59Affected Software16
Prion
Prion
•added 2021/02/23 11:15 p.m.•42 views

Design/Logic Flaw

Brave is an open source web browser with a focus on privacy and security. In Brave versions 1.17.73-1.20.103, the CNAME adblocking feature added in Brave 1.17.73 accidentally initiated DNS requests that bypassed the Brave Tor proxy. Users with adblocking enabled would leak DNS requests from Tor...

4.3CVSS6.1AI score0.0226EPSS
SaveExploits0References5Affected Software1
Prion
Prion
•added 2020/12/26 4:15 a.m.•42 views

Design/Logic Flaw

lib/codebook.c in libvorbis before 1.3.6, as used in StepMania 5.0.12 and other products, has insufficient array bounds checking via a crafted OGG file. NOTE: this may overlap CVE-2018-5146...

4.3CVSS7.6AI score0.12054EPSS
SaveExploits1References1Affected Software2
Prion
Prion
•added 2020/12/17 7:15 p.m.•42 views

Unrestricted file upload

The contact-form-7 aka Contact Form 7 plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters...

10CVSS9.8AI score0.89626EPSS
SaveExploits4References5Affected Software1
Prion
Prion
•added 2020/11/16 1:15 a.m.•42 views

Design/Logic Flaw

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportuni...

6.8CVSS8AI score0.01574EPSS
SaveExploits0References5Affected Software2
Prion
Prion
•added 2020/10/12 11:15 a.m.•42 views

Buffer overflow

A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service DoS and potentially execute arbitrary code by sending a malicious request to the firewall. This vulnerability affected SonicOS Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 versio...

7.5CVSS9.8AI score0.24563EPSS
SaveExploits0References1Affected Software2
Prion
Prion
•added 2020/06/17 11:15 a.m.•42 views

Double free

The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free...

6.4CVSS8.9AI score0.13195EPSS
SaveExploits1References11Affected Software1
Prion
Prion
•added 2020/05/14 2:15 p.m.•42 views

Code injection

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator...

4.3CVSS6AI score0.06301EPSS
SaveExploits3References4Affected Software1
Prion
Prion
•added 2020/05/07 9:15 p.m.•42 views

Open redirect

In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability. Users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is check...

5.8CVSS6.2AI score0.0079EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2020/02/27 9:15 p.m.•42 views

Null pointer dereference

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.uploadprogress.cleanup is set to 0 disabled, and the file upload fails, the upload procedure would try to clean up data that does...

4.3CVSS8AI score0.03598EPSS
SaveExploits1References8Affected Software4
Prion
Prion
•added 2020/01/14 11:15 p.m.•42 views

Remote code execution

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'...

10CVSS9.7AI score0.99222EPSS
SaveExploits5References2Affected Software1
Total number of security vulnerabilities5000