Lucene search
+L
PrionMost viewed

213680 matches found

Prion
Prion
•added 2022/06/01 8:15 p.m.•42 views

Remote code execution

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs,...

9.3CVSS8.3AI score0.99374EPSS
SaveExploits63References2Affected Software4
Prion
Prion
•added 2022/05/27 2:15 p.m.•42 views

Cross site scripting

A vulnerability in the web applications of Cisco UCS Director could allow an authenticated, remote attacker to conduct a cross-site scripting attack on an affected system. This vulnerability is due to unsanitized user input. An attacker could exploit this vulnerability by submitting custom...

3.5CVSS4.8AI score0.00548EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2022/05/02 12:16 p.m.•42 views

Privilege escalation

A Improper Privilege Management vulnerability in SUSE Rancher allows write access to the Catalog for any user when restricted-admin role is enabled. This issue affects: SUSE Rancher Rancher versions prior to 2.5.13; Rancher versions prior to 2.6.4...

5.5CVSS5.5AI score0.00599EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2022/04/21 7:15 p.m.•42 views

Sql injection

A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to improper validation of...

5.5CVSS8.2AI score0.00808EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2022/04/19 9:15 p.m.•42 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: FTS. Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

4CVSS4.8AI score0.02052EPSS
SaveExploits0References3Affected Software3
Prion
Prion
•added 2022/04/19 9:15 p.m.•42 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to...

4CVSS6.1AI score0.01407EPSS
SaveExploits0References2Affected Software1
Prion
Prion
•added 2022/04/12 5:15 a.m.•42 views

Sql injection

An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate, aggregate, and extra methods are subject to SQL injection in column aliases via a crafted dictionary with dictionary expansion as the passed kwargs...

7.5CVSS9.4AI score0.18661EPSS
SaveExploits3References9Affected Software2
Prion
Prion
•added 2022/04/01 11:15 p.m.•42 views

Security feature bypass

It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 https://access.redhat.com/errata/RHSA-2020:4676 erratum released as part of Red Hat Enterprise Linux 8.3 failed to include the fix for the qemu-kvm component issue CVE-2020-10756, which was previously corrected in...

2.1CVSS6.6AI score0.0051EPSS
SaveExploits0References3Affected Software1
Prion
Prion
•added 2022/04/01 11:15 p.m.•42 views

Remote code execution

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources...

7.5CVSS9.4AI score0.99939EPSS
SaveExploits36References6Affected Software28
Prion
Prion
•added 2022/03/23 11:15 a.m.•42 views

Design/Logic Flaw

BIND 9.16.11 - 9.16.26, 9.17.0 - 9.18.0 and versions 9.16.11-S1 - 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSEWAIT status for an indefinite period of time, even after the client has terminated the connection...

4.3CVSS5.7AI score0.02703EPSS
SaveExploits0References5Affected Software3
Prion
Prion
•added 2022/02/04 11:15 p.m.•43 views

Stack overflow

Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would trigger a division by zero in BiasAndClamp implementation. There is no check that the biassize is non zero. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on...

4CVSS6.6AI score0.00757EPSS
SaveExploits1References3Affected Software1
Prion
Prion
•added 2022/01/28 10:15 p.m.•42 views

Design/Logic Flaw

There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis...

4.3CVSS5.3AI score0.83645EPSS
SaveExploits1References9Affected Software8
Prion
Prion
•added 2022/01/19 12:15 p.m.•42 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Privileges. Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromi...

4CVSS4AI score0.01399EPSS
SaveExploits0References4Affected Software2
Prion
Prion
•added 2022/01/10 2:12 p.m.•42 views

Input validation

An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution...

4.6CVSS8AI score0.00392EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2021/12/13 6:15 p.m.•42 views

Hardcoded credentials

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant...

6.8CVSS6.7AI score0.02456EPSS
SaveExploits0References14Affected Software8
Prion
Prion
•added 2021/12/10 10:15 a.m.•42 views

Default configuration

Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message...

9.3CVSS9.7AI score0.99999EPSS
SaveExploits359References52Affected Software102
Prion
Prion
•added 2021/12/06 4:15 p.m.•42 views

Design/Logic Flaw

The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user...

5CVSS7.5AI score0.71532EPSS
SaveExploits5References2Affected Software1
Prion
Prion
•added 2021/11/10 5:15 p.m.•42 views

Memory corruption

A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges. The attacker must have network access to the...

10CVSS9.7AI score0.19087EPSS
SaveExploits1References1Affected Software1
Prion
Prion
•added 2021/09/01 12:15 p.m.•42 views

Design/Logic Flaw

Wireless devices running certain Arcadyan-derived firmware such as KPN Experia WiFi 1.00.15 do not properly sanitise user input to the syslog configuration form. An authenticated remote attacker could leverage this to alter the device configuration and achieve remote code execution. This can be...

9CVSS8.3AI score0.9998EPSS
SaveExploits6References2Affected Software1
Prion
Prion
•added 2021/08/12 9:15 p.m.•42 views

Design/Logic Flaw

Belledonne Belle-sip before 4.5.20, as used in Linphone and other products, can crash via an invalid From header in a SIP message...

5CVSS7.6AI score0.01294EPSS
SaveExploits0References2Affected Software1
Prion
Prion
•added 2021/08/05 8:15 p.m.•42 views

Remote code execution

Neo4j through 3.4.18 with the shell server enabled exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains...

7.5CVSS9.8AI score0.13386EPSS
SaveExploits1References1Affected Software1
Prion
Prion
•added 2021/07/14 6:15 p.m.•42 views

Remote code execution

Microsoft Exchange Server Remote Code Execution Vulnerability...

10CVSS8.3AI score0.99999EPSS
SaveExploits16References3Affected Software1
Prion
Prion
•added 2021/07/12 3:15 p.m.•42 views

Cross site request forgery (csrf)

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer...

5CVSS5.3AI score0.75353EPSS
SaveExploits1References16Affected Software22
Prion
Prion
•added 2021/06/15 10:15 p.m.•42 views

Type confusion

Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

6.8CVSS8.6AI score0.64701EPSS
SaveExploits1References6Affected Software2
Prion
Prion
•added 2021/06/09 2:15 a.m.•42 views

Path traversal

For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal...

5CVSS5.9AI score0.7848EPSS
SaveExploits2References24Affected Software4
Prion
Prion
•added 2021/05/11 7:15 p.m.•42 views

Security feature bypass

Microsoft Exchange Server Security Feature Bypass Vulnerability...

6.5CVSS7.9AI score0.99782EPSS
SaveExploits11References3Affected Software1
Prion
Prion
•added 2021/04/22 10:15 p.m.•42 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

4CVSS4.8AI score0.01141EPSS
SaveExploits0References2Affected Software1
Prion
Prion
•added 2021/04/22 10:15 p.m.•42 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 5.7.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

4CVSS4.8AI score0.02461EPSS
SaveExploits0References7Affected Software3
Prion
Prion
•added 2021/03/30 3:15 p.m.•42 views

Design/Logic Flaw

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty io.netty:netty-codec-http2 before version 4.1.61.Final there is a vulnerability that enables request smuggling. The...

4.3CVSS6.5AI score0.18891EPSS
SaveExploits0References59Affected Software16
Prion
Prion
•added 2021/03/25 3:15 p.m.•42 views

Null pointer dereference

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signaturealgorithms extension where it was present in the initial ClientHello, but includes a signaturealgorithmscert extension then a NU...

4.3CVSS6.5AI score0.62906EPSS
SaveExploits3References28Affected Software68
Prion
Prion
•added 2021/03/20 10:15 p.m.•42 views

Integer overflow

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error with a resultant integer underflow affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information...

3.6CVSS5.5AI score0.00577EPSS
SaveExploits0References9Affected Software4
Prion
Prion
•added 2021/02/23 11:15 p.m.•42 views

Design/Logic Flaw

Brave is an open source web browser with a focus on privacy and security. In Brave versions 1.17.73-1.20.103, the CNAME adblocking feature added in Brave 1.17.73 accidentally initiated DNS requests that bypassed the Brave Tor proxy. Users with adblocking enabled would leak DNS requests from Tor...

4.3CVSS6.1AI score0.0226EPSS
SaveExploits0References5Affected Software1
Prion
Prion
•added 2021/01/20 3:15 p.m.•42 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

6.8CVSS4.8AI score0.02157EPSS
SaveExploits0References3Affected Software1
Prion
Prion
•added 2020/12/26 4:15 a.m.•42 views

Design/Logic Flaw

lib/codebook.c in libvorbis before 1.3.6, as used in StepMania 5.0.12 and other products, has insufficient array bounds checking via a crafted OGG file. NOTE: this may overlap CVE-2018-5146...

4.3CVSS7.6AI score0.12054EPSS
SaveExploits1References1Affected Software2
Prion
Prion
•added 2020/12/17 7:15 p.m.•42 views

Unrestricted file upload

The contact-form-7 aka Contact Form 7 plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters...

10CVSS9.8AI score0.89626EPSS
SaveExploits4References5Affected Software1
Prion
Prion
•added 2020/11/16 1:15 a.m.•42 views

Design/Logic Flaw

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportuni...

6.8CVSS8AI score0.01574EPSS
SaveExploits0References5Affected Software2
Prion
Prion
•added 2020/10/21 3:15 p.m.•42 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: FTS. Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

4CVSS4.9AI score0.02653EPSS
SaveExploits0References9Affected Software4
Prion
Prion
•added 2020/10/12 11:15 a.m.•42 views

Buffer overflow

A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service DoS and potentially execute arbitrary code by sending a malicious request to the firewall. This vulnerability affected SonicOS Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 versio...

7.5CVSS9.8AI score0.24563EPSS
SaveExploits0References1Affected Software2
Prion
Prion
•added 2020/06/17 11:15 a.m.•42 views

Double free

The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free...

6.4CVSS8.9AI score0.13195EPSS
SaveExploits1References11Affected Software1
Prion
Prion
•added 2020/05/14 2:15 p.m.•42 views

Code injection

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator...

4.3CVSS6AI score0.06301EPSS
SaveExploits3References4Affected Software1
Prion
Prion
•added 2020/05/07 9:15 p.m.•42 views

Open redirect

In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability. Users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is check...

5.8CVSS6.2AI score0.0079EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2020/04/30 11:15 p.m.•42 views

Design/Logic Flaw

In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously...

5.5CVSS7.9AI score0.13625EPSS
SaveExploits3References5Affected Software2
Prion
Prion
•added 2020/04/15 2:15 p.m.•42 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

5.5CVSS5.5AI score0.03014EPSS
SaveExploits0References11Affected Software6
Prion
Prion
•added 2020/02/27 9:15 p.m.•42 views

Null pointer dereference

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.uploadprogress.cleanup is set to 0 disabled, and the file upload fails, the upload procedure would try to clean up data that does...

4.3CVSS8AI score0.03598EPSS
SaveExploits1References8Affected Software4
Prion
Prion
•added 2020/01/14 11:15 p.m.•42 views

Remote code execution

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'...

10CVSS9.7AI score0.99222EPSS
SaveExploits5References2Affected Software1
Prion
Prion
•added 2020/01/03 1:15 a.m.•42 views

Buffer overflow

libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow...

7.5CVSS8.7AI score0.04212EPSS
SaveExploits0References8Affected Software4
Prion
Prion
•added 2019/11/14 8:15 p.m.•42 views

Input validation

Improper invalidation for page table updates by a virtual guest operating system for multiple IntelR Processors may allow an authenticated user to potentially enable denial of service of the host system via local access...

4.9CVSS6.3AI score0.00915EPSS
SaveExploits0References16Affected Software23
Prion
Prion
•added 2019/11/14 7:15 p.m.•42 views

Design/Logic Flaw

TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access...

2.1CVSS6.3AI score0.03133EPSS
SaveExploits0References30Affected Software38
Prion
Prion
•added 2019/10/29 7:15 p.m.•42 views

Memory corruption

RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade package's name field. If an authenticated user installs a malicious package then a directory could be created and the developer shell could be enabled...

6.5CVSS8.5AI score0.01675EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2019/10/16 6:15 p.m.•42 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Encryption. Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromi...

4CVSS6.1AI score0.01885EPSS
SaveExploits0References6Affected Software3
Total number of security vulnerabilities5000