Lucene search
+L
PrionMost viewed

213680 matches found

Prion
Prion
•added 2022/08/29 11:15 p.m.•40 views

Command injection

Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain a command injection vulnerability via the ipAddress parameter at 07system08executeping01...

7.5CVSS9.8AI score0.01584EPSS
SaveExploits0References2Affected Software2
Prion
Prion
•added 2022/08/26 4:15 p.m.•40 views

Design/Logic Flaw

It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threa...

4CVSS6.8AI score0.00506EPSS
SaveExploits1References6Affected Software2
Prion
Prion
•added 2022/08/22 8:15 a.m.•40 views

Authorization

A vulnerability was found in CrowdStrike Falcon 6.31.14505.0/6.42.15610/6.44.15806. It has been classified as problematic. Affected is an unknown function of the component Uninstallation Handler. The manipulation leads to missing authorization. It is possible to launch the attack remotely. The...

3.3CVSS3.9AI score0.04894EPSS
SaveExploits5References5Affected Software1
Prion
Prion
•added 2022/08/15 11:21 a.m.•40 views

Format string

OpenZeppelin Contracts is a library for secure smart contract development. The functions ECDSA.recover and ECDSA.tryRecover are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issu...

4CVSS6.5AI score0.00419EPSS
SaveExploits0References3Affected Software2
Prion
Prion
•added 2022/08/05 4:15 p.m.•40 views

Memory corruption

A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem...

6.4CVSS5.8AI score0.0386EPSS
SaveExploits0References3Affected Software1
Prion
Prion
•added 2022/08/01 8:15 p.m.•40 views

Cross site scripting

PyroCMS v3.9 was discovered to contain multiple cross-site scripting XSS vulnerabilities...

5.8CVSS6.1AI score0.005EPSS
SaveExploits0References2Affected Software1
Prion
Prion
•added 2022/07/19 8:15 p.m.•40 views

Code injection

Digital Watchdog DW Spectrum Server 4.2.0.32842 allows attackers to access sensitive infromation via a crafted API call...

5CVSS7.4AI score0.02457EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2022/07/04 9:15 p.m.•40 views

Type confusion

An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nftseteleminit leading to a buffer overflow could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. The attacker can obtain root access, but must start with an...

7.2CVSS7.5AI score0.05496EPSS
SaveExploits16References10Affected Software3
Prion
Prion
•added 2022/06/09 3:15 p.m.•40 views

Double free

A use after free in the Linux kernel File System notify functionality was found in the way user triggers copyinforecordstouser call to fail in copyeventtouser. A local user could use this flaw to crash the system or potentially escalate their privileges on the system...

7.2CVSS7.4AI score0.00327EPSS
SaveExploits0References3Affected Software3
Prion
Prion
•added 2022/05/24 6:15 p.m.•40 views

Buffer overflow

A buffer overflow vulnerability has been detected in the firewall function of the device management web portal. The device runs a CGI binary index.cgi to offer a management web application. Once authenticated with valid credentials in this web portal, a potential attacker could submit any "Addres...

5.5CVSS8.1AI score0.00777EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2022/05/23 11:16 a.m.•40 views

Design/Logic Flaw

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks...

7.5CVSS9.4AI score0.04424EPSS
SaveExploits0References5Affected Software2
Prion
Prion
•added 2022/05/19 6:15 p.m.•40 views

Design/Logic Flaw

The affected ThroughTek P2P products SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module do not sufficiently protect data...

5CVSS7.5AI score0.00625EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2022/05/12 5:15 p.m.•40 views

Information disclosure

Processor optimization removal or modification of security-critical code for some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access...

2.1CVSS5.2AI score0.00355EPSS
SaveExploits0References3Affected Software1
Prion
Prion
•added 2022/05/11 5:15 p.m.•40 views

Input validation

Improper validation of the BIOS directory may allow for searches to read beyond the directory table copy in RAM, exposing out of bounds memory contents, resulting in a potential denial of service...

4.9CVSS5.5AI score0.00217EPSS
SaveExploits0References2Affected Software106
Prion
Prion
•added 2022/05/10 9:15 p.m.•40 views

Denial of service

.NET and Visual Studio Denial of Service Vulnerability...

5CVSS7.4AI score0.05178EPSS
SaveExploits0References4Affected Software5
Prion
Prion
•added 2022/05/09 5:15 p.m.•40 views

Integer overflow

There is a vulnerability in htmldoc 1.9.16. In imageloadjpeg function image.cxx when it calls malloc,'img-width' and 'img-height' they are large enough to cause an integer overflow. So, the malloc function may return a heap blosmaller than the expected size, and it will cause a buffer...

4.3CVSS5.5AI score0.00948EPSS
SaveExploits1References3Affected Software2
Prion
Prion
•added 2022/05/05 5:15 p.m.•40 views

Cross site scripting

On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP, and F5 BIG-IP Guided Configuration GC all versions prior to 9.0, a stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute...

6CVSS6.1AI score0.00899EPSS
SaveExploits0References1Affected Software12
Prion
Prion
•added 2022/05/01 4:15 p.m.•40 views

Code injection

The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service ReDoS by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat of NUMBERFORMATS.PATTERNS1.posPre with a very high value. Note: 1 This package has been deprecated an...

5CVSS7.2AI score0.04927EPSS
SaveExploits1References8Affected Software2
Prion
Prion
•added 2022/04/25 11:15 a.m.•40 views

Default configuration

In Terramaster F4-210, F2-210 TOS 4.2.X 4.2.15-2107141517, an attacker can self-sign session cookies by knowing the target's MAC address and the user's password hash. Guest users disabled by default can be abused using a null/empty hash and allow an unauthenticated attacker to login as guest...

6.8CVSS9AI score0.08289EPSS
SaveExploits3References2Affected Software1
Prion
Prion
•added 2022/04/14 9:15 p.m.•40 views

Path traversal

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the fiel...

5CVSS5.9AI score0.05666EPSS
SaveExploits2References3Affected Software2
Prion
Prion
•added 2022/04/11 8:15 p.m.•40 views

Design/Logic Flaw

A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rhel8 container was incomplete. The vulnerable netty-codec-http maven package was not removed from the image content. This flaw affects...

4.3CVSS6.4AI score0.04935EPSS
SaveExploits0References3Affected Software1
Prion
Prion
•added 2022/04/01 5:15 a.m.•40 views

Input validation

Possible assertion due to improper validation of TCI configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile...

7.8CVSS7.6AI score0.00579EPSS
SaveExploits0References1
Prion
Prion
•added 2022/03/17 1:15 p.m.•40 views

Code injection

Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and...

5CVSS7.4AI score0.0178EPSS
SaveExploits0References5Affected Software2
Prion
Prion
•added 2022/03/10 5:44 p.m.•40 views

Design/Logic Flaw

A flaw was found in the io-workqueue implementation in the Linux kernel versions prior to 5.15-rc1. The kernel can panic when an improper cancellation operation triggers the submission of new io-uring operations during a shortage of free space. This flaw allows a local user with permissions to...

4.9CVSS5.3AI score0.00238EPSS
SaveExploits0References1Affected Software2
Prion
Prion
•added 2022/03/10 5:44 p.m.•40 views

Design/Logic Flaw

A vulnerability was found in kvms390guestsidaop in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4...

4.6CVSS7.3AI score0.00335EPSS
SaveExploits0References4Affected Software14
Prion
Prion
•added 2022/02/18 5:15 a.m.•40 views

Stack overflow

In Expat aka libexpat before 2.4.5, an attacker can trigger stack exhaustion in buildmodel via a large nesting depth in the DTD element...

4.3CVSS7.7AI score0.03295EPSS
SaveExploits0References10Affected Software6
Prion
Prion
•added 2022/02/09 11:15 p.m.•40 views

Authentication flaw

The vulnerability exists in TP-Link TL-WR841N V11 3.16.9 Build 160325 Rel.62500n wireless router due to transmission of authentication information in cleartextbase64 format. Successful exploitation of this vulnerability could allow a remote attacker to intercept credentials and subsequently perfo...

7.5CVSS9.3AI score0.0067EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2022/02/04 11:15 a.m.•40 views

Privilege escalation

Micro-Star International MSI Center = 1.0.31.0 is vulnerable to multiple Privilege Escalation vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLibX64.sys, WinRing0.sys, WinRing0x64.sys drivers components. All the vulnerabilities are triggered by sending specific IOC...

4.6CVSS7.7AI score0.00425EPSS
SaveExploits1References2Affected Software1
Prion
Prion
•added 2022/01/19 12:15 p.m.•40 views

Design/Logic Flaw

Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: General. Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physica...

2.9CVSS2.2AI score0.01553EPSS
SaveExploits0References3Affected Software1
Prion
Prion
•added 2022/01/19 12:15 p.m.•40 views

Buffer overflow

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allow...

5CVSS4.7AI score0.02755EPSS
SaveExploits0References6Affected Software6
Prion
Prion
•added 2021/12/30 10:15 p.m.•40 views

Design/Logic Flaw

Crash in the pcapng file parser in Wireshark 3.6.0 allows denial of service via crafted capture file...

4.3CVSS6.1AI score0.01479EPSS
SaveExploits1References7Affected Software4
Prion
Prion
•added 2021/12/28 8:15 p.m.•40 views

Remote code execution

Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is...

8.5CVSS7.2AI score0.97906EPSS
SaveExploits9References12Affected Software22
Prion
Prion
•added 2021/12/23 3:15 p.m.•40 views

Authentication flaw

Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations...

6.8CVSS9.5AI score0.03193EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2021/12/20 9:15 a.m.•40 views

Code injection

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed by action=mcrundo and action=mcrrestore to view private pages on a private wiki that has at least one page set in $wgWhitelistRead...

5CVSS7.2AI score0.01327EPSS
SaveExploits0References3Affected Software1
Prion
Prion
•added 2021/12/14 4:15 p.m.•40 views

Design/Logic Flaw

A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web browser enables unauthorized attackers to conduct XSS attacks, which might lead to disclose sensitive data...

4.3CVSS6.1AI score0.22224EPSS
SaveExploits3References4Affected Software1
Prion
Prion
•added 2021/11/12 9:15 p.m.•40 views

Cross site scripting

In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS...

4.3CVSS6.5AI score0.01381EPSS
SaveExploits0References3Affected Software2
Prion
Prion
•added 2021/11/05 3:15 p.m.•40 views

Design/Logic Flaw

vim is vulnerable to Use of Uninitialized Variable...

4.6CVSS7.1AI score0.00635EPSS
SaveExploits1References9Affected Software3
Prion
Prion
•added 2021/11/05 10:15 a.m.•40 views

Deserialization of untrusted data

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability...

10CVSS9.7AI score0.97904EPSS
SaveExploits4References4Affected Software1
Prion
Prion
•added 2021/10/26 3:15 p.m.•40 views

Code injection

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various Text options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various Text options are now alway...

4.3CVSS6.1AI score0.08533EPSS
SaveExploits1References18Affected Software20
Prion
Prion
•added 2021/10/20 11:17 a.m.•40 views

Design/Logic Flaw

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Privileges. Supported versions that are affected are 5.7.35 and prior and 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to...

4CVSS4.8AI score0.01427EPSS
SaveExploits0References2Affected Software1
Prion
Prion
•added 2021/10/20 7:15 a.m.•40 views

Heap overflow

A heap-based buffer overflow flaw was found in the Linux kernel FireDTV media card driver, where the user calls the CASENDMSG ioctl. This flaw allows a local user of the host machine to crash the system or escalate privileges on the system. The highest threat from this vulnerability is to...

4.6CVSS6.7AI score0.00473EPSS
SaveExploits0References4Affected Software8
Prion
Prion
•added 2021/10/19 3:15 p.m.•40 views

Memory corruption

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by...

5CVSS8.3AI score0.06745EPSS
SaveExploits0References13Affected Software11
Prion
Prion
•added 2021/10/13 1:15 a.m.•40 views

Remote code execution

Microsoft SharePoint Server Remote Code Execution Vulnerability...

6.5CVSS8.1AI score0.48205EPSS
SaveExploits0References2Affected Software3
Prion
Prion
•added 2021/10/12 6:15 p.m.•40 views

Null pointer dereference

A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ Ticket Granting Server - Request. An authenticated user could use this flaw to crash the samba server...

4CVSS7AI score0.02177EPSS
SaveExploits0References7Affected Software2
Prion
Prion
•added 2021/10/04 9:15 p.m.•40 views

Design/Logic Flaw

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby Docker Engine where the data directory typically /var/lib/docker contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traver...

4.6CVSS6.3AI score0.02848EPSS
SaveExploits3References5Affected Software2
Prion
Prion
•added 2021/10/04 6:15 p.m.•40 views

Integer overflow

Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all versions of Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves modifying the default ziplist...

6CVSS8.2AI score0.1353EPSS
SaveExploits0References9Affected Software4
Prion
Prion
•added 2021/10/04 12:15 p.m.•40 views

Cross site scripting

A reflected cross-site scripting XSS vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console and it is possible to insert a vulnerable malicious button...

4.3CVSS5.9AI score0.09912EPSS
SaveExploits4References3Affected Software1
Prion
Prion
•added 2021/09/29 8:15 p.m.•40 views

Code injection

When curl = 7.20.0 and = 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instea...

4.3CVSS7.3AI score0.03009EPSS
SaveExploits1References15Affected Software15
Prion
Prion
•added 2021/09/15 12:15 p.m.•40 views

Privilege escalation

Win32k Elevation of Privilege Vulnerability...

4.6CVSS8AI score0.01314EPSS
SaveExploits0References1Affected Software2
Prion
Prion
•added 2021/09/09 10:15 p.m.•40 views

Design/Logic Flaw

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted upstream servers. 0.15.1 contains an upgraded envoy binary...

5CVSS8.4AI score0.01638EPSS
SaveExploits0References3Affected Software2
Total number of security vulnerabilities5000