Archive
2 February 2021
Vulnerabilities first published on this day (UTC), newest first.
54 results · Feed
-
Medium 4.5
Privilege escalation through unquoted service binary path on Cloudflare WARP for Windows
Cloudflare WARP for Windows allows privilege escalation due to an unquoted service path. A malicious user or process running with non-administrative privileges can become an administrator by abusing the unquoted service path issue. Since version 1.2.2695.1, t…
-
Unscored —
In RT regmap driver, there is a possible memory corruption due to type confusion. This could lead to local denial of se…
-
Unscored —
In kisd, there is a possible memory corruption due to a heap buffer overflow. This could lead to local escalation of pr…
-
Unscored —
In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of priv…
-
Unscored —
In kisd, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of pri…
-
Unscored —
In netdiag, there is a possible command injection due to improper input validation. This could lead to local escalation…
-
Unscored —
In netdiag, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation …
-
Unscored —
In netdiag, there is a possible command injection due to improper input validation. This could lead to local escalation…
-
Unscored —
In netdiag, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation …
-
Unscored —
In netdiag, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalati…
-
Unscored —
In kisd, there is a possible out of bounds read due to improper input validation. This could lead to local escalation o…
-
Unscored —
In aee, there is a possible memory corruption due to a stack buffer overflow. This could lead to local escalation of pr…
-
Unscored —
In mobile_log_d, there is a possible command injection due to a missing bounds check. This could lead to local escalati…
-
Unscored —
In mobile_log_d, there is a possible command injection due to improper input validation. This could lead to local escal…
-
Unscored —
In display driver, there is a possible memory corruption due to a use after free. This could lead to local escalation o…
-
Medium 6.1
Reflected Cross-site Scripting (XSS) on version-compare and page-compare tools
ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and page-compare due to invalid JCR characters that are not handled correctly. An attacker could potentially exploit this vulnerabilit…
-
High 7.5
Unbounded connection acceptance in http4s-blaze-server
Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, …
-
High 7.5
Unbounded connection acceptance leads to file handle exhaustion
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, ac…
-
Unscored —CVE-2020-24490 Public exploit
Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adj…
-
Unscored —
Out of bound read in BIOS firmware for 8th, 9th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 Series…
-
Medium 5.3
"catalog's registry v2 api exposed on unauthenticated path in Harbor"
In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path.
-
Unscored —CVE-2021-3395 Public exploit
A cross-site scripting (XSS) vulnerability in Pryaniki 6.44.3 allows remote authenticated users to upload an arbitrary …
-
Unscored —
Improper input validation in the firmware for Intel(R) Server Board M10JNP2SB before version 7.210 may allow a privileg…
-
Unscored —
In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS).
-
Unscored —
A missing bounds check in WhatsApp for Android prior to v2.21.1.13 and WhatsApp Business for Android prior to v2.21.1.1…
-
Unscored —
HCL Digital Experience 9.5 containers include vulnerabilities that could expose sensitive data to unauthorized parties …
-
Medium 5.5
Unquoted Windows binary path in Traccar
Traccar is an open source GPS tracking system. In Traccar before version 4.12 there is an unquoted Windows binary path vulnerability. Only Windows versions are impacted. Attacker needs write access to the filesystem on the host machine. If Java path includes …
-
Unscored —
HCL Digital Experience 8.5, 9.0, and 9.5 exposes information about the server to unauthorized users.
-
Medium 4.7
Subdomain checking of whitelisted domains could allow unintended redirects
OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelis…
-
Medium 6.8
Cryptographic Issues
The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. Thi…
-
High 7.4
Command Injection Vulnerability in Mechanize
Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using …
-
Critical 9.8
Prototype pollution in dotty
Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution.
-
High 8.0
TIBCO EBX Cross Site Scripting (XSS)
The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) attack on the affected system. Affected relea…
-
Critical 9.8
Command Injection
This affects all versions of package freediskspace. The vulnerability arises out of improper neutralization of arguments in line 71 of freediskspace.js.
-
Medium 5.9
Podman Origin Validation Error
Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. Thi…
-
Medium 6.8
privilege escalation in Moby
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has acce…
-
Medium 6.5
Docker daemon crash during image pull of malicious image
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.
-
Critical 9.1
Path Traversal in loklak
loklak is an open-source server application which is able to collect messages from various sources, including twitter. The server contains a search index and a peer-to-peer index sharing interface. All messages are stored in an elasticsearch index. In loklak …
-
Unscored —
An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rc…
-
Unscored —
In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the f…