Lucene search
+L
PrionMost viewed

213680 matches found

Prion
Prion
added 2024/01/05 5:15 p.m.42 views

Design/Logic Flaw

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. AMD CPUs since 2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately there are errors in Xen's handling of...

1.7CVSS5.5AI score0.02501EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2024/01/03 11:15 p.m.42 views

Design/Logic Flaw

Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in ion-java for applications that use ion-java to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the IonValue model and then...

5CVSS7.2AI score0.00827EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2024/01/02 3:15 a.m.42 views

Out-of-bounds

In Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01161830; Issue ID: MOLY01161830 MSV-894...

5CVSS7.2AI score0.00948EPSS
SaveExploits0References1
Prion
Prion
added 2023/12/14 10:15 p.m.42 views

Cross site scripting

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting XSS or further attacks. This flaw is the result of an incomple...

4.9CVSS5.9AI score0.00931EPSS
SaveExploits1References14Affected Software5
Prion
Prion
added 2023/12/12 12:15 p.m.42 views

Information disclosure

A vulnerability has been identified in SIMATIC STEP 7 TIA Portal All versions V19. An information disclosure vulnerability could allow a local attacker to gain access to the access level password of the SIMATIC S7-1200 and S7-1500 CPUs, when entered by a legitimate user in the hardware...

1.7CVSS6.7AI score0.00142EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2023/11/21 6:15 a.m.42 views

Code injection

The BGP daemon bgpd in IP Infusion ZebOS through 7.10.6 allow remote attackers to cause a denial of service by sending crafted BGP update messages containing a malformed attribute...

5CVSS7.2AI score0.01425EPSS
SaveExploits1References4Affected Software6
Prion
Prion
added 2023/11/14 9:15 p.m.42 views

Authentication flaw

VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 from an older version. On an upgraded version of VMware Cloud Director Appliance 10.5, a malicious actor with network access to the appliance can bypass log...

7.5CVSS7.9AI score0.01345EPSS
SaveExploits4References4Affected Software1
Prion
Prion
added 2023/11/02 8:15 a.m.42 views

Design/Logic Flaw

Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor allows an attacker to obtain victim’s domain credentials and Net-NTLM hash which can lead to relay domain attacks. Fixed in A32.20 b570 or above, A32.50 b390 or above...

4.9CVSS5.7AI score0.00301EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2023/10/30 7:15 p.m.42 views

Cross site request forgery (csrf)

baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue...

7.5CVSS9.3AI score0.00347EPSS
SaveExploits0References3Affected Software1
Prion
Prion
added 2023/10/26 6:15 p.m.42 views

Stack overflow

A flaw was discovered in Elasticsearch, affecting the search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service...

5CVSS7.2AI score0.60679EPSS
SaveExploits4References3Affected Software1
Prion
Prion
added 2023/10/13 1:15 p.m.42 views

Code injection

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing...

5CVSS7.5AI score0.00575EPSS
SaveExploits0References3Affected Software1
Prion
Prion
added 2023/10/13 7:15 a.m.42 views

Sql injection

Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier and 2.4.4-p5 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could lead in arbitrary code execution by an admin-privileg...

4.3CVSS7.5AI score0.00829EPSS
SaveExploits0References1Affected Software2
Prion
Prion
added 2023/10/12 6:15 a.m.42 views

Design/Logic Flaw

Templates do not properly consider backticks as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to...

7.5CVSS9.4AI score0.0075EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2023/10/11 4:15 p.m.42 views

Command injection

A command execution vulnerability exists in the validate.so diagpingstart functionality of Yifan YF325 v1.020221108. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability...

7.5CVSS9.5AI score0.01212EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2023/09/25 8:15 p.m.42 views

Input validation

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service DoS attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverab...

5CVSS7.3AI score0.0104EPSS
SaveExploits1References2Affected Software1
Prion
Prion
added 2023/09/15 8:15 p.m.42 views

Double free

OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.20 and prior to version 3.22, shdrverifysignature can make a double free. shdrverifysignature used to verify a TA...

4CVSS6.6AI score0.00373EPSS
SaveExploits1References2Affected Software1
Prion
Prion
added 2023/09/12 5:15 p.m.42 views

Remote code execution

Microsoft Exchange Server Remote Code Execution Vulnerability...

5.2CVSS7.9AI score0.81138EPSS
SaveExploits1References1Affected Software1
Prion
Prion
added 2023/09/12 5:15 p.m.42 views

Privilege escalation

Visual Studio Elevation of Privilege Vulnerability...

7.5CVSS9.4AI score0.01354EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2023/09/05 3:15 p.m.42 views

Design/Logic Flaw

UNSUPPPORTED WHEN ASSIGNED UNSUPPORTED WHEN ASSIGNED When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API...

7.5CVSS9.4AI score0.03281EPSS
SaveExploits0References3Affected Software1
Prion
Prion
added 2023/09/05 7:15 a.m.42 views

Memory corruption

Memory corruption due to improper validation of array index in WLAN HAL when received lmitemNum is out of range...

4.3CVSS7.8AI score0.00116EPSS
SaveExploits0References1
Prion
Prion
added 2023/09/04 3:15 a.m.42 views

Input validation

In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local esclation of privileges with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08017365; Issue ID: ALPS08017365...

4CVSS6.4AI score0.00102EPSS
SaveExploits0References1Affected Software3
Prion
Prion
added 2023/08/23 5:15 p.m.42 views

Design/Logic Flaw

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file such as an ordinary .JPG file and also a folder that has the same name as the benign file, and the...

4.4CVSS7.9AI score0.97894EPSS
SaveExploits49References5Affected Software1
Prion
Prion
added 2023/08/22 7:16 p.m.42 views

Design/Logic Flaw

An issue was discovered in Binutils addr2line before 2.39.3, function parsemodule contains multiple out of bound reads which may cause a denial of service or other unspecified impacts...

4.4CVSS7.4AI score0.00464EPSS
SaveExploits1References1Affected Software1
Prion
Prion
added 2023/08/17 8:15 p.m.42 views

Code injection

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution...

7.5CVSS7.5AI score0.9507EPSS
SaveExploits24References3Affected Software1
Prion
Prion
added 2023/08/14 5:15 a.m.42 views

Hardcoded credentials

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database. A malicious agent with the ability to execute operating system commands on the device can leverage this vulnerability to read, modify, or...

7.5CVSS9.6AI score0.00474EPSS
SaveExploits0References1Affected Software23
Prion
Prion
added 2023/08/10 6:15 p.m.42 views

Cross site request forgery (csrf)

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for...

5CVSS5.4AI score0.00608EPSS
SaveExploits0References3Affected Software1
Prion
Prion
added 2023/08/09 7:15 a.m.42 views

Hardcoded credentials

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing to decrypt an encrypted web application login password...

3.3CVSS5.1AI score0.00454EPSS
SaveExploits0References1Affected Software6
Prion
Prion
added 2023/08/08 1:15 a.m.42 views

Cross site scripting

SAP business One allows - version 10.0, allows an attacker to insert malicious code into the content of a web page or application and gets it delivered to the client, resulting to Cross-site scripting. This could lead to harmful action affecting the Confidentiality, Integrity and Availability of...

4.9CVSS5.6AI score0.00398EPSS
SaveExploits0References2Affected Software1
Prion
Prion
added 2023/08/03 11:15 a.m.42 views

Race condition

In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition...

4CVSS6.3AI score0.00626EPSS
SaveExploits0References1Affected Software16
Prion
Prion
added 2023/07/27 12:15 a.m.42 views

Code injection

The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited...

6.8CVSS8.5AI score0.1895EPSS
SaveExploits0References6Affected Software6
Prion
Prion
added 2023/07/18 9:15 p.m.42 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

3.3CVSS4.6AI score0.01372EPSS
SaveExploits0References5Affected Software2
Prion
Prion
added 2023/07/13 3:15 a.m.42 views

Hardcoded credentials

The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'uruploadprofilepic' function in versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with...

6.5CVSS9.4AI score0.01691EPSS
SaveExploits2References5Affected Software1
Prion
Prion
added 2023/07/13 1:15 a.m.42 views

Authentication flaw

The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions...

7.5CVSS9.5AI score0.50195EPSS
SaveExploits2References3Affected Software2
Prion
Prion
added 2023/07/12 5:15 a.m.42 views

Authorization

The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for...

6.5CVSS8.5AI score0.02233EPSS
SaveExploits2References2Affected Software1
Prion
Prion
added 2023/07/11 10:15 p.m.42 views

Design/Logic Flaw

A vulnerability has been discovered in the Citrix Secure Access client for Windows which, if exploited, could allow an attacker with access to an endpoint with Standard User Account that has the vulnerable client installed to escalate their local privileges to that of NT AUTHORITY\SYSTEM...

4.3CVSS7.5AI score0.00202EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2023/06/29 4:15 p.m.42 views

Command injection

An OS command injection vulnerability in D-Link DIR-823G firmware version 1.02B05 allows unauthorized attackers to execute arbitrary operating system commands via a crafted GET request to EXCUSHELL...

7.5CVSS9.7AI score0.31396EPSS
SaveExploits1References2Affected Software1
Prion
Prion
added 2023/06/09 7:15 p.m.42 views

Code injection

schemaelement defeats protective searchpath changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code...

5.8CVSS7.2AI score0.0119EPSS
SaveExploits0References3Affected Software3
Prion
Prion
added 2023/06/09 11:15 a.m.42 views

Code injection

There exists an vulnerability causing an abort to be called in gRPC. The following headers cause gRPC's C++ implementation to abort when called via http2: te: x x != trailers :scheme: x x != http, https grpclbclientstats: x x == anything On top of sending one of those headers, a later header must...

5CVSS7.3AI score0.00412EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2023/06/05 10:15 p.m.42 views

Code injection

On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart...

5CVSS7.4AI score0.00616EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2023/06/02 5:15 p.m.42 views

Design/Logic Flaw

Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be displayed as having a valid signature. Thunderbird versions from 68 to 102.7.0 were affected by this bug. This vulnerability affects Thunderbird 102.7.1...

4.3CVSS6AI score0.00372EPSS
SaveExploits0References2Affected Software1
Prion
Prion
added 2023/05/30 8:15 p.m.42 views

Input validation

A user can supply malicious HTML and JavaScript code that will be executed in the client browser...

4.9CVSS5.5AI score0.03083EPSS
SaveExploits3References2Affected Software1
Prion
Prion
added 2023/05/21 9:15 p.m.42 views

Design/Logic Flaw

When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: it is readable by other users on Linux or UNIX, a similar issue to CVE-2022-41946...

1.7CVSS5.6AI score0.00494EPSS
SaveExploits1References1Affected Software1
Prion
Prion
added 2023/05/11 8:15 p.m.42 views

Code injection

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names not value associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limit...

4CVSS4.5AI score0.00744EPSS
SaveExploits0References4Affected Software1
Prion
Prion
added 2023/05/11 4:15 p.m.42 views

Input validation

Angle brackets are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input...

7.5CVSS8.5AI score0.01037EPSS
SaveExploits0References4Affected Software1
Prion
Prion
added 2023/05/10 12:15 p.m.42 views

Design/Logic Flaw

When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read returns an error. In rare deployment cases error thrown by the Read function, this could lead to a predictable shared secret. The tkn20 and blindrsa components did not...

6.4CVSS8AI score0.00386EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2023/05/09 6:15 p.m.42 views

Security feature bypass

Secure Boot Security Feature Bypass Vulnerability...

4CVSS7.9AI score0.10561EPSS
SaveExploits0References1Affected Software10
Prion
Prion
added 2023/05/09 1:15 p.m.42 views

Path traversal

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The filename in the upload feature of the web based management of the affected device is susceptible to a path traversal vulnerability. This could allow an authenticated privileged remote attacke...

3.3CVSS4.4AI score0.00684EPSS
SaveExploits0References1Affected Software2
Prion
Prion
added 2023/05/05 5:15 p.m.42 views

Design/Logic Flaw

An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/afnetrom.c, there is a use-after-free because accept is also allowed for a successfully connected AFNETROM socket. However, in order for an attacker to exploit this, the system must have netrom routing configured or the...

4CVSS6.4AI score0.0027EPSS
SaveExploits0References2Affected Software1
Prion
Prion
added 2023/05/03 12:15 a.m.42 views

Design/Logic Flaw

Use after free in OS Inputs in Google Chrome on ChromeOS prior to 113.0.5672.63 allowed a remote attacker who convinced a user to enage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. Chromium security severity: Medium...

6.8CVSS8.9AI score0.00763EPSS
SaveExploits0References7Affected Software3
Prion
Prion
added 2023/05/02 9:15 a.m.42 views

Command injection

UNSUPPORTED WHEN ASSIGNED The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in...

6.5CVSS8.8AI score0.93076EPSS
SaveExploits12References4Affected Software1
Total number of security vulnerabilities5000