Lucene search
+L
PrionMost viewed

213680 matches found

Prion
Prion
added 2022/09/16 10:15 a.m.43 views

Input validation

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks DOS if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

5CVSS8.1AI score0.19653EPSS
SaveExploits1References2Affected Software2
Prion
Prion
added 2022/09/14 6:15 p.m.43 views

Design/Logic Flaw

Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the /.cargo folder on disk, making it available to the Rust projects it builds. To record when an extraction is successful, Cargo writes "ok" to the .cargo-ok file at the...

5.8CVSS8.4AI score0.01046EPSS
SaveExploits0References2Affected Software1
Prion
Prion
added 2022/09/09 3:15 p.m.43 views

Improper access control

An out-of-boundsOOB memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfxkms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 or Dxxx'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial...

1.7CVSS5.8AI score0.0078EPSS
SaveExploits0References4Affected Software2
Prion
Prion
added 2022/08/29 11:15 p.m.43 views

Command injection

Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain a command injection vulnerability via the Ping parameter at pingexec.cgi...

7.5CVSS9.8AI score0.01749EPSS
SaveExploits0References2Affected Software1
Prion
Prion
added 2022/08/26 4:15 p.m.43 views

Design/Logic Flaw

It was found that the CVE-2021-27918, CVE-2021-31525 and CVE-2021-33196 have been incorrectly mentioned as fixed in RHSA for Serverless 1.16.0 and Serverless client kn 1.16.0. These have been fixed with Serverless 1.17.0...

5CVSS7AI score0.03692EPSS
SaveExploits1References2Affected Software1
Prion
Prion
added 2022/08/25 11:15 p.m.43 views

Design/Logic Flaw

Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo. NOTE: this issue exists because of an incomplete fix for CVE-2019-7256...

7.5CVSS9.6AI score0.97136EPSS
SaveExploits19References3Affected Software1
Prion
Prion
added 2022/08/12 3:15 p.m.43 views

Directory traversal

Zimbra Collaboration Suite ZCS 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication i.e., not having an authtoken, an attacker can upload arbitrary files to the system, leading to directory traversal and remote code...

7.5CVSS8.1AI score0.98676EPSS
SaveExploits16References3Affected Software1
Prion
Prion
added 2022/08/02 3:15 p.m.43 views

Input validation

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...

4CVSS8.6AI score0.02168EPSS
SaveExploits1References4Affected Software2
Prion
Prion
added 2022/08/01 3:15 p.m.43 views

Design/Logic Flaw

NLnet Labs Unbound, up to and including version 1.16.1, is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a rogue domain name when the cached delegation information is about to expire. The rogue...

4CVSS6.3AI score0.01052EPSS
SaveExploits0References5Affected Software2
Prion
Prion
added 2022/07/25 3:15 p.m.43 views

Input validation

An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificate. This is not sufficient to verify that the...

5.1CVSS8.2AI score0.01108EPSS
SaveExploits0References2Affected Software1
Prion
Prion
added 2022/07/11 1:15 a.m.43 views

Path traversal

The Niyaz-Mohamed/mosaic repository through 1.0.0 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

6.4CVSS9.3AI score0.01299EPSS
SaveExploits1References1Affected Software1
Prion
Prion
added 2022/06/23 11:15 a.m.43 views

Cross site scripting

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability...

4.3CVSS6.1AI score0.06714EPSS
SaveExploits0References4Affected Software1
Prion
Prion
added 2022/05/21 12:15 a.m.43 views

Type confusion

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the macros that TensorFlow uses for writing assertions e.g., CHECKLT, CHECKGT, etc. have an incorrect logic when comparing sizet and int values. Due to type conversion rules, several of t...

2.1CVSS6.1AI score0.00389EPSS
SaveExploits1References9Affected Software1
Prion
Prion
added 2022/05/06 12:15 p.m.43 views

Information disclosure

Netty is an open-source, asynchronous event-driven network application framework. The package io.netty:netty-codec-http prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local syst...

1.9CVSS6.9AI score0.01777EPSS
SaveExploits2References5Affected Software2
Prion
Prion
added 2022/04/27 4:15 p.m.43 views

Heap overflow

IBM Security Identity Manager IBM Security Verify Password Synchronization Plug-in for Windows AD 10.x is vulnerable to a denial of service, caused by a heap-based buffer overflow in the Password Synch Plug-in. An authenticated attacker could exploit this vulnerability to cause a denial of servic...

4CVSS6.5AI score0.01064EPSS
SaveExploits0References2Affected Software1
Prion
Prion
added 2022/04/27 2:15 a.m.43 views

Design/Logic Flaw

In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles...

5CVSS5.1AI score0.01039EPSS
SaveExploits0References2Affected Software2
Prion
Prion
added 2022/04/01 11:15 p.m.43 views

Code injection

Rockwell Automation Studio 5000 Logix Designer all versions are vulnerable when an attacker who achieves administrator access on a workstation running Studio 5000 Logix Designer could inject controller code undetectable to a user...

6.5CVSS6.9AI score0.0345EPSS
SaveExploits0References1
Prion
Prion
added 2022/03/25 7:15 p.m.43 views

Design/Logic Flaw

A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system...

4.6CVSS7.5AI score0.00379EPSS
SaveExploits0References4Affected Software30
Prion
Prion
added 2022/03/15 5:15 p.m.43 views

Code injection

The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a...

5CVSS7.6AI score0.73188EPSS
SaveExploits2References28Affected Software6
Prion
Prion
added 2022/03/04 7:15 p.m.43 views

Input validation

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB virtual machine control block provided by the L1 guest to spawn/handle a nested guest L2. Due to improper validation of the "virtext" field, this issue could allow a malicious...

7.2CVSS8.3AI score0.00658EPSS
SaveExploits0References4Affected Software24
Prion
Prion
added 2022/02/21 3:15 p.m.43 views

Heap overflow

The Samba vfsfruit module uses extended file attributes EA, xattr to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfsfruit configured allow out-of-bounds heap read and wri...

9CVSS8.8AI score0.73864EPSS
SaveExploits1References5Affected Software22
Prion
Prion
added 2022/02/10 6:15 p.m.43 views

Information disclosure

An information exposure vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows and MacOS where the credentials of the local user account are sent to the GlobalProtect portal when the Single Sign-On feature is enabled in the GlobalProtect portal configuration. This product...

2.6CVSS6.3AI score0.00746EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2021/12/23 8:15 p.m.43 views

Design/Logic Flaw

An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not exposed through the web interface, which cannot be deleted or changed through the regular web interface...

7.5CVSS9.5AI score0.01175EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2021/12/18 12:15 p.m.43 views

Code injection

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue wa...

4.3CVSS7.5AI score0.99999EPSS
SaveExploits21References13Affected Software115
Prion
Prion
added 2021/12/07 7:15 p.m.43 views

Directory traversal

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 except for patched versions iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: /public/plugins//, where is the plugin ID for any installe...

5CVSS7.3AI score0.88503EPSS
SaveExploits45References8Affected Software1
Prion
Prion
added 2021/11/17 6:15 p.m.43 views

Input validation

The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the /src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain...

6.5CVSS8.7AI score0.79823EPSS
SaveExploits5References6Affected Software1
Prion
Prion
added 2021/11/10 1:19 a.m.43 views

Remote code execution

Microsoft Exchange Server Remote Code Execution Vulnerability...

6.5CVSS8.8AI score0.91737EPSS
SaveExploits9References3Affected Software1
Prion
Prion
added 2021/10/20 11:16 a.m.43 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

4CVSS4.8AI score0.02649EPSS
SaveExploits0References5Affected Software2
Prion
Prion
added 2021/10/11 5:15 p.m.43 views

Design/Logic Flaw

A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality...

4CVSS7.2AI score0.01558EPSS
SaveExploits0References4Affected Software1
Prion
Prion
added 2021/10/08 10:15 p.m.43 views

Design/Logic Flaw

Use after free in Safebrowsing in Google Chrome prior to 94.0.4606.71 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page...

6.8CVSS8.8AI score0.01346EPSS
SaveExploits0References6Affected Software3
Prion
Prion
added 2021/10/08 9:15 p.m.43 views

Type confusion

Type confusion in Blink layout in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

6.8CVSS8.7AI score0.00905EPSS
SaveExploits0References4Affected Software2
Prion
Prion
added 2021/09/16 3:15 p.m.43 views

Design/Logic Flaw

A carefully crafted request uri-path can cause modproxyuwsgi to read above the allocated memory and crash DoS. This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 inclusive...

5CVSS8.1AI score0.62887EPSS
SaveExploits0References24Affected Software8
Prion
Prion
added 2021/08/31 5:15 p.m.43 views

Remote code execution

The npm package "tar" aka node-tar before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achiev...

4.4CVSS9.4AI score0.0185EPSS
SaveExploits0References6Affected Software4
Prion
Prion
added 2021/08/25 7:15 p.m.43 views

Design/Logic Flaw

A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure ACI Mode could allow an unauthenticated, remote attacker to cause a queue wedge on a leaf switch, which could result in critical control plane traffic to the device being dropped. This could result in...

5CVSS8.4AI score0.01328EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2021/08/13 12:15 p.m.43 views

Privilege escalation

Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it receives as an argument...

4.6CVSS7.7AI score0.00778EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2021/07/13 1:15 p.m.43 views

Code injection

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise...

5CVSS6.1AI score0.0305EPSS
SaveExploits1References8Affected Software3
Prion
Prion
added 2021/07/02 7:15 p.m.43 views

Design/Logic Flaw

Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

6.8CVSS8.9AI score0.07367EPSS
SaveExploits0References5Affected Software2
Prion
Prion
added 2021/06/18 9:15 p.m.43 views

Design/Logic Flaw

Contiki-NG is an open-source, cross-platform operating system for internet of things devices. It is possible to cause an out-of-bounds write in versions of Contiki-NG prior to 4.6 when transmitting a 6LoWPAN packet with a chain of extension headers. Unfortunately, the written header is not checke...

7.5CVSS9.3AI score0.01064EPSS
SaveExploits1References2Affected Software1
Prion
Prion
added 2021/06/15 9:15 a.m.43 views

Null pointer dereference

Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating...

5CVSS7.4AI score0.51489EPSS
SaveExploits0References12Affected Software6
Prion
Prion
added 2021/06/01 2:15 p.m.43 views

Design/Logic Flaw

There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability...

6.8CVSS8.2AI score0.0199EPSS
SaveExploits1References9Affected Software5
Prion
Prion
added 2021/05/26 3:15 p.m.43 views

Remote code execution

The vSphere Client HTML5 contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with...

10CVSS9.8AI score0.99999EPSS
SaveExploits12References3Affected Software2
Prion
Prion
added 2021/05/06 1:15 p.m.43 views

Race condition

Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a deletepidfile race condition, a local user can delete arbitrary files as root. This involves the -oP and -oPX options...

6.3CVSS6.8AI score0.00976EPSS
SaveExploits4References1Affected Software1
Prion
Prion
added 2021/05/05 7:15 p.m.43 views

Cross site scripting

The “Elementor – Header, Footer & Blocks Template” WordPress Plugin before 1.5.8 has two widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method...

3.5CVSS5.2AI score0.0059EPSS
SaveExploits0References2Affected Software1
Prion
Prion
added 2021/05/05 10:15 a.m.43 views

Default configuration

A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permission...

2.1CVSS3.6AI score0.00268EPSS
SaveExploits0References4Affected Software2
Prion
Prion
added 2021/04/26 5:15 p.m.43 views

Type confusion

Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...

6.8CVSS8.8AI score0.84173EPSS
SaveExploits1References7Affected Software3
Prion
Prion
added 2021/04/13 7:15 p.m.43 views

Design/Logic Flaw

Eaton Intelligent Power Manager IPM prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/utils.js. Successful exploitation can...

7.5CVSS9.6AI score0.00962EPSS
SaveExploits0References1Affected Software3
Prion
Prion
added 2021/04/08 4:15 a.m.43 views

Input validation

A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to improper validation of user-supplied input in the...

10CVSS9.6AI score0.03023EPSS
SaveExploits0References1Affected Software4
Prion
Prion
added 2021/04/02 6:15 p.m.43 views

Arbitrary file deletion

"Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. A user may be unable to fully delete...

2.1CVSS4.8AI score0.0036EPSS
SaveExploits0References6Affected Software7
Prion
Prion
added 2021/03/30 3:15 p.m.43 views

Design/Logic Flaw

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty io.netty:netty-codec-http2 before version 4.1.61.Final there is a vulnerability that enables request smuggling. The...

4.3CVSS6.5AI score0.18891EPSS
SaveExploits0References59Affected Software16
Prion
Prion
added 2021/03/11 4:15 p.m.43 views

Privilege escalation

Windows Container Execution Agent Elevation of Privilege Vulnerability...

4.6CVSS8AI score0.01066EPSS
SaveExploits1References1Affected Software2
Total number of security vulnerabilities5000