Lucene search
+L
PrionMost viewed

213680 matches found

Prion
Prion
added 2022/01/05 12:15 a.m.42 views

Directory traversal

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it...

5CVSS6AI score0.02408EPSS
SaveExploits0References5Affected Software2
Prion
Prion
added 2021/12/23 8:15 p.m.42 views

Authorization

An unauthenticated remote attacker can access mySCADA myPRO Versions 8.20.0 and prior without any form of authentication or authorization...

7.5CVSS9.7AI score0.01549EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2021/12/17 8:15 p.m.42 views

Buffer overflow

DISPUTED Buffer overflow in the arrayfrompyobj function of fortranobject.c in NumPy 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can onl...

2.1CVSS5.4AI score0.00368EPSS
SaveExploits1References2Affected Software1
Prion
Prion
added 2021/12/15 3:15 p.m.42 views

Spoofing

We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader. An attacker...

6CVSS6.8AI score0.10295EPSS
SaveExploits1References5
Prion
Prion
added 2021/11/17 8:15 p.m.42 views

Input validation

Improper input validation in software for some IntelR PROSet/Wireless WiFi and KillerTM WiFi in Windows 10 may allow an unauthenticated user to potentially enable denial of service via adjacent access...

6.1CVSS6.5AI score0.00386EPSS
SaveExploits0References1Affected Software15
Prion
Prion
added 2021/11/15 9:15 p.m.42 views

Design/Logic Flaw

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvari function...

6.5CVSS7.2AI score0.02733EPSS
SaveExploits0References5Affected Software2
Prion
Prion
added 2021/11/08 6:15 a.m.42 views

Code injection

Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field...

5CVSS7.7AI score0.0328EPSS
SaveExploits0References7Affected Software2
Prion
Prion
added 2021/11/01 4:15 a.m.42 views

Design/Logic Flaw

DISPUTED An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by...

5.1CVSS8.4AI score0.12881EPSS
SaveExploits4References18Affected Software3
Prion
Prion
added 2021/10/20 11:17 a.m.42 views

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Roles. Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

4CVSS2.9AI score0.01387EPSS
SaveExploits0References2Affected Software1
Prion
Prion
added 2021/10/14 8:15 p.m.42 views

Memory corruption

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was...

5CVSS7.2AI score0.11796EPSS
SaveExploits0References9Affected Software15
Prion
Prion
added 2021/10/11 8:15 a.m.42 views

Code injection

MediaWiki before 1.36.2 allows a denial of service resource consumption because of lengthy query processing time. Visiting Special:Contributions can sometimes result in a long running SQL query because PoolCounter protection is mishandled...

5CVSS6.7AI score0.01807EPSS
SaveExploits0References7Affected Software2
Prion
Prion
added 2021/09/24 7:15 p.m.42 views

Design/Logic Flaw

Vulnerability in Oracle Linux component: OSwatcher. Supported versions that are affected are 7 and 8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Linux executes to compromise Oracle Linux. Successful attacks of this vulnerability c...

7.2CVSS7.9AI score0.00334EPSS
SaveExploits0References2Affected Software2
Prion
Prion
added 2021/09/16 3:15 p.m.42 views

Input validation

apescapequotes may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier...

7.5CVSS9.4AI score0.39402EPSS
SaveExploits0References15Affected Software6
Prion
Prion
added 2021/09/15 10:15 p.m.42 views

Authentication flaw

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets...

10CVSS9.5AI score0.99556EPSS
SaveExploits9References3Affected Software18
Prion
Prion
added 2021/08/24 7:15 p.m.42 views

Integer overflow

An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this...

6.8CVSS7.9AI score0.75994EPSS
SaveExploits2References15Affected Software7
Prion
Prion
added 2021/08/16 8:15 a.m.42 views

Input validation

A crafted method sent through HTTP/2 will bypass validation and be forwarded by modproxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48...

5CVSS7.5AI score0.46179EPSS
SaveExploits1References13Affected Software5
Prion
Prion
added 2021/08/13 4:15 p.m.42 views

Command injection

Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi...

10CVSS9.8AI score0.97599EPSS
SaveExploits1References2Affected Software1
Prion
Prion
added 2021/08/12 9:15 p.m.42 views

Integer overflow

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a denial of service in boostedtreescreatequantilestreamresource by using negative arguments. The implementation does not validate that numstreams only contains non-negative numbers. I...

2.1CVSS5.5AI score0.00154EPSS
SaveExploits0References2Affected Software1
Prion
Prion
added 2021/08/05 9:15 p.m.42 views

Directory traversal

Authenticated Directory Traversal in WordPress Download Manager = 3.1.24 allows authenticated Contributor+ users to obtain sensitive configuration file information, as well as allowing Author+ users to perform XSS attacks, by setting Download template to a file containing configuration informatio...

4CVSS5.9AI score0.01331EPSS
SaveExploits1References1Affected Software1
Prion
Prion
added 2021/08/02 4:15 a.m.42 views

Design/Logic Flaw

In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation does not necessarily occur before a store operation that has an attacker-controlled...

2.1CVSS5.5AI score0.0046EPSS
SaveExploits0References6Affected Software3
Prion
Prion
added 2021/07/16 9:15 p.m.42 views

Remote code execution

A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or...

7.5CVSS9.2AI score0.47717EPSS
SaveExploits1References1Affected Software4
Prion
Prion
added 2021/07/14 3:15 p.m.42 views

Design/Logic Flaw

Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert all versions prior to V15.0 SP1, including all versions of Unity Pro, EcoStruxure Process Expert all versions, including all versions of EcoStruxure Hybrid DCS, and SCADAPack RemoteConnect for x70, all version...

3.6CVSS7.2AI score0.00216EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2021/07/09 2:15 p.m.42 views

Authentication flaw

An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management RMM 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated arbitrary file upload leadin...

10CVSS7.6AI score0.60348EPSS
SaveExploits1References4Affected Software1
Prion
Prion
added 2021/06/29 5:15 p.m.42 views

Authorization

Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service DoS attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker c...

5CVSS7.5AI score0.06001EPSS
SaveExploits0References9Affected Software2
Prion
Prion
added 2021/06/22 6:15 p.m.42 views

Authorization

An improper authorization vulnerability in Palo Alto Networks Cortex XSOAR enables a remote unauthenticated attacker with network access to the Cortex XSOAR server to perform unauthorized actions through the REST API. This issue impacts: Cortex XSOAR 6.1.0 builds later than 1016923 and earlier th...

7.5CVSS9.4AI score0.01406EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2021/06/21 4:15 p.m.42 views

Code injection

A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service ReDOS occurs if the application is provided and checks a crafted invalid SVG string...

5CVSS7.3AI score0.02813EPSS
SaveExploits1References4Affected Software1
Prion
Prion
added 2021/06/15 10:15 p.m.42 views

Design/Logic Flaw

Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page...

6.8CVSS8.2AI score0.03582EPSS
SaveExploits0References10Affected Software4
Prion
Prion
added 2021/06/10 7:15 a.m.42 views

Stack overflow

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in modauthdigest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make i...

6.8CVSS8AI score0.53471EPSS
SaveExploits0References12Affected Software6
Prion
Prion
added 2021/05/11 8:15 p.m.42 views

Design/Logic Flaw

The 802.11 standard that underpins Wi-Fi Protected Access WPA, WPA2, and WPA3 and Wired Equivalent Privacy WEP doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames which is mandatory as part of 802.11...

2.9CVSS5.8AI score0.03537EPSS
SaveExploits2References10Affected Software7
Prion
Prion
added 2021/05/11 8:15 p.m.42 views

Design/Logic Flaw

An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second or subsequent broadcast fragments even when sent in plaintext and process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets...

3.3CVSS6.8AI score0.03515EPSS
SaveExploits0References4Affected Software13
Prion
Prion
added 2021/05/10 11:15 p.m.42 views

Directory traversal

A directory traversal vulnerability exists in Kyocera Printer d-COPIA253MF plus. Successful exploitation of this vulnerability could allow an attacker to retrieve or view arbitrary files from the affected server...

5CVSS5.9AI score0.36765EPSS
SaveExploits0References1
Prion
Prion
added 2021/05/04 4:15 p.m.42 views

Improper access control

Dell dbutil23.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required...

4.6CVSS7.6AI score0.79249EPSS
SaveExploits18References3
Prion
Prion
added 2021/05/02 8:15 a.m.42 views

Design/Logic Flaw

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions 1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fi...

4.3CVSS6.4AI score0.35963EPSS
SaveExploits1References2Affected Software1
Prion
Prion
added 2021/04/29 3:15 p.m.42 views

Path traversal

A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version = 1.02 and WSR-2533DHP3 firmware version = 1.24 could allow unauthenticated remote attackers to bypass authentication...

7.5CVSS8.1AI score0.99983EPSS
SaveExploits5References3Affected Software2
Prion
Prion
added 2021/04/22 9:15 p.m.42 views

Race condition

A vulnerability has been identified in APOGEE PXC Compact BACnet All versions V3.5.5, APOGEE PXC Compact P2 Ethernet All versions V2.8.20, APOGEE PXC Modular BACnet All versions V3.5.5, APOGEE PXC Modular P2 Ethernet All versions V2.8.20, Nucleus NET All versions V5.2, Nucleus Source Code Version...

6.8CVSS8AI score0.07194EPSS
SaveExploits0References2Affected Software1
Prion
Prion
added 2021/03/26 9:15 p.m.42 views

Design/Logic Flaw

In FreeBSD 12.1-STABLE before r364644, 11.4-STABLE before r364651, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p13, improper handling in the kernel causes a use-after-free bug by sending large user messages from multiple threads on the same SCTP socket. The...

4.9CVSS5.9AI score0.00399EPSS
SaveExploits0References13Affected Software9
Prion
Prion
added 2021/03/24 9:15 p.m.42 views

Design/Logic Flaw

Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information, intercept protected network traffic,...

9CVSS9.7AI score0.01382EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2021/03/19 4:15 a.m.42 views

Heap overflow

An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654...

7.5CVSS9.4AI score0.02345EPSS
SaveExploits0References2Affected Software1
Prion
Prion
added 2021/03/10 4:15 p.m.42 views

Design/Logic Flaw

In bindServiceLocked of ActiveServices.java, there is a possible foreground service launch due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android...

4.6CVSS7.6AI score0.00127EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2021/03/03 6:15 p.m.42 views

Code injection

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DN...

5.1CVSS7.3AI score0.32362EPSS
SaveExploits1References12Affected Software8
Prion
Prion
added 2021/01/20 3:15 p.m.42 views

Design/Logic Flaw

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 8.0.22 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks...

6.3CVSS4.3AI score0.01722EPSS
SaveExploits0References3Affected Software1
Prion
Prion
added 2020/12/14 8:15 p.m.42 views

Code injection

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service...

4.3CVSS5.5AI score0.03898EPSS
SaveExploits0References16Affected Software16
Prion
Prion
added 2020/12/10 10:15 p.m.42 views

Out-of-bounds

In affected versions of TensorFlow under certain cases, loading a saved model can result in accessing uninitialized memory while building the computation graph. The MakeEdge function creates an edge between one output tensor of the src node given by outputindex and the input slot of the dst node...

2.1CVSS4AI score0.00216EPSS
SaveExploits1References2Affected Software1
Prion
Prion
added 2020/11/18 5:15 p.m.42 views

Code injection

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file...

5.1CVSS7.9AI score0.02342EPSS
SaveExploits0References5Affected Software2
Prion
Prion
added 2020/10/12 11:15 a.m.42 views

Cross site scripting

A stored cross-site scripting XSS vulnerability exists in the SonicOS SSLVPN web interface. A remote unauthenticated attacker is able to store and potentially execute arbitrary JavaScript code in the firewall SSLVPN portal. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen ...

4.3CVSS6AI score0.01243EPSS
SaveExploits0References1Affected Software2
Prion
Prion
added 2020/09/16 3:15 p.m.42 views

Directory traversal

The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where the installer loads or the current working directory take precedence over the intended executables. An attacker having permission to add fil...

4.4CVSS7.4AI score0.0053EPSS
SaveExploits0References3Affected Software1
Prion
Prion
added 2020/08/17 7:15 p.m.42 views

Remote code execution

A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or...

6.8CVSS6.7AI score0.04926EPSS
SaveExploits0References1Affected Software1
Prion
Prion
added 2020/08/14 5:15 p.m.42 views

Design/Logic Flaw

In Composer-Setup for Windows before version 6.0.0, if the developer's computer is shared with other users, a local attacker may be able to exploit the following scenarios. 1. A local regular user may modify the existing C:\ProgramData\ComposerSetup\bin\composer.bat in order to get elevated comma...

4.4CVSS8AI score0.00409EPSS
SaveExploits0References2Affected Software1
Prion
Prion
added 2020/08/06 4:15 p.m.42 views

Sql injection

CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter 'wayfinderseqid' in wayfindermeetinginput.jsp is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injectin...

10CVSS9.9AI score0.14014EPSS
SaveExploits5References2Affected Software1
Prion
Prion
added 2020/07/20 4:15 p.m.42 views

Design/Logic Flaw

All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system. A remote, authenticated attacker may be able to leverage this information for reconnaissance efforts. Rockwell Automation recommends enabling built in security features found within...

4CVSS4.6AI score0.53024EPSS
SaveExploits3References3
Total number of security vulnerabilities5000