Archive
6 November 2019
Vulnerabilities first published on this day (UTC), newest first.
112 results · Feed
-
Unscored —
Thread start can cause invalid memory writes to arbitrary memory location since the argument is passed by user to kerne…
-
Unscored —
Double free issue can happen when sensor power settings is freed by some thread while another thread try to access. in …
-
Unscored —
Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn`t mat…
-
Unscored —
Null-pointer dereference can occur while accessing the super index entry when it is not been allocated in Snapdragon Au…
-
Unscored —
Dereference on uninitialized buffer can happen when parsing FLV clip with corrupted codec specific data in Snapdragon A…
-
Unscored —
Out of bound access due to improper validation of array index cause the index table entry to get corrupt in Snapdragon …
-
Unscored —
Incorrect reading of system image resulting in buffer overflow when size of system image is increased in Snapdragon Aut…
-
Unscored —CVE-2019-10529 Public exploit
Possible use after free issue due to race condition while attempting to mark the entry pages as dirty using function se…
-
Unscored —
Use after free issue in kernel while accessing freed mdlog session info and its attributes after closing the session in…
-
Unscored —
While playing the clip which is nonstandard buffer overflow can occur while parsing in Snapdragon Auto, Snapdragon Comp…
-
Unscored —
Lack of check for a negative value returned for get_clk is wrongly interpreted as valid pointer and lead to use after f…
-
Unscored —
DCI client which might be preemptively freed up might be accessed for transferring packets leading to kernel error in S…
-
Unscored —
Out of bound access while processing a non-standard IE measurement request with length crossing past the size of frame …
-
Unscored —
Payload size is not checked before using it as array index in audio in Snapdragon Auto, Snapdragon Compute, Snapdragon …
-
Unscored —
Possible stack overflow when an index equal to io buffer size is accessed in camera module in Snapdragon Compute, Snapd…
-
Unscored —
Firmware not able to send EXT scan response to host within 1 sec due to resource consumption issue in Snapdragon Auto, …
-
Unscored —
Arbitrary buffer write issue while processing sequence header during HEVC or AVC encoding. in Snapdragon Auto, Snapdrag…
-
Unscored —
Lack of checking a variable received from driver and populating in Firmware data structure leads to buffer overflow in …
-
Unscored —
ADSP can be compromised since it`s a general-purpose CPU processing untrusted data in Snapdragon Auto, Snapdragon Compu…
-
Unscored —
Null pointer dereference can occur while parsing invalid chunks while playing the nonstandard clip in Snapdragon Auto, …
-
Unscored —
-
Medium 6.5
Typo3 Improper Access Control
TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint services.
-
Medium 6.1
Typo3 XSS in RemoveXSS function
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the RemoveXSS function.
-
Unscored —
makepasswd 1.10 default settings generate insecure passwords
-
Medium 6.5
Typo3 Arbitrary File Delete
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver.
-
Medium 6.5
Typo3 Arbitrary Information Disclosure
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 database.
-
Medium 6.5
Typo3 Information Disclosure
TYPO3 before 4.5.4 allows Information Disclosure in the backend.
-
Medium 5.4
Typo3 XSS Vulnerabilities
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the tcemain flash message.
-
Unscored —
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers t…
-
Medium 5.4
Typo3 XSS Vulnerability
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the browse_links wizard.
-
Unscored —
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers t…
-
Critical 9.8
Typo3 Authentication Bypass
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted request.
-
Unscored —
Rbot Reaction plugin allows command execution
-
Medium 6.5
Typo3 Information Disclosure
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend.
-
Unscored —
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers t…
-
Unscored —
Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber accoun…
-
Unscored —
Progress Sitefinity CMS before 10.1 allows XSS via /Pages Parameter : Page Title, /Content/News Parameter : News Title,…
-
Unscored —
LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operator()(Sass::Binary_Expression*) in eval.cpp.
-
Unscored —
LibSass before 3.6.3 allows a heap-based buffer over-read in Sass::weaveParents in ast_sel_weave.cpp.
-
Unscored —
LibSass before 3.6.3 allows a NULL pointer dereference in Sass::Parser::parseCompoundSelector in parser_selectors.cpp.