Archive
18 November 2021
Vulnerabilities first published on this day (UTC), newest first.
73 results · Feed
-
High 7.5
HTTP Request Smuggling in github.com/hyperledger/fabric
A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This bug can be leveraged by constructing a message whose header is invalid to the interface Order. This b…
-
Medium 5.5
Denial of Service in Go-Ethereum
Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered. They will crash with "runtime error: invalid memory address or nil pointer dereference" and arise a SEGV signal.
-
High 7.5
NULL Pointer Dereference in HyperLedger Fabric
A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'forwardToLeader'. This bug has been admitted and fixed by the de…
-
Unscored —
In apusys, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of …
-
Unscored —
In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privil…
-
Unscored —
In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privil…
-
Unscored —
In apusys, there is a possible memory corruption due to incorrect error handling. This could lead to local escalation o…
-
Unscored —
In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privil…
-
Unscored —
In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local informatio…
-
Unscored —
In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local informatio…
-
Unscored —
In ccu, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege…
-
Unscored —
In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local informatio…
-
Unscored —
In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation o…
-
Unscored —
In apusys, there is a possible out of bounds write due to a stack-based buffer overflow. This could lead to local escal…
-
Unscored —
In edma driver, there is a possible memory corruption due to a use after free. This could lead to local escalation of p…
-
Unscored —
In mdlactl driver, there is a possible memory corruption due to an incorrect bounds check. This could lead to local esc…
-
Unscored —
In mdlactl driver, there is a possible memory corruption due to a use after free. This could lead to local escalation o…
-
Unscored —
In flv extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local inform…
-
Unscored —
In asf extractor, there is a possible out of bounds read due to an integer overflow. This could lead to local informati…
-
Unscored —
In asf extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local inform…
-
Unscored —
In asf extractor, there is a possible out of bounds read due to an integer overflow. This could lead to local informati…
-
Unscored —
In asf extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local inform…
-
Unscored —
In ape extractor, there is a possible out of bounds read due to a missing bounds check. This could lead to local inform…
-
Unscored —
In Browser app, there is a possible information disclosure due to a missing permission check. This could lead to local …
-
High 8.8
WordPress WP Reset PRO Premium plugin <= 5.98 - Authenticated Database Reset vulnerability
Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe the entire database regardless of their authorization. It leads to a complete website reset and takeover.
-
High 8.8
WordPress WP Reset PRO Premium Plugin <= 5.98 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in WebFactory Ltd. WP Reset PRO plugin <= 5.98 versions.
-
Medium 6.5
Unsafe HTTP Redirect in Puppet Agent and Puppet Server
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
-
Medium 6.5
Silent Configuration Failure in Puppet Agent
A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.
-
Unscored —
A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged
-
Unscored —
A flaw was discovered in Continuous Delivery for Puppet Enterprise (CD4PE) that results in a user with lower privileges…
-
Medium 6.9
OSIsoft PI Web API
A remote authenticated attacker with write access to a PI Server could trick a user into interacting with a PI Web API endpoint and redirect them to a malicious website. As a result, a victim may disclose sensitive information to the attacker or be provided w…
-
High 7.5
NULL pointer exception in the IEEE 802.11 dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of se…
-
High 7.5
NULL pointer exception in the IPPUSB dissector in Wireshark 3.4.0 to 3.4.9 allows denial of service via packet injectio…