Archive
November 2021
Vulnerabilities first published in this month (UTC), newest first.
1,522 results · Feed
-
High 7.8
Adobe InCopy GIF File Parsing Memory Corruption Arbitrary Code Execution
Adobe InCopy version 16.4 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious GIF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in th…
-
High 7.8
Adobe Prelude MXF File Parsing Memory Corruption Arbitrary Code Execution
Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious MXF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in t…
-
High 7.8
Adobe Prelude WAV File Parsing Memory Corruption Arbitrary Code Execution
Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in t…
-
Medium 5.5
Adobe Bridge NULL Pointer Dereference could lead to Application denial-of-service
Adobe Bridge version 11.1.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context o…
-
High 7.8
Adobe Prelude SVG File Parsing Memory Corruption Arbitrary Code Execution
Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious SVG file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in t…
-
Medium 5.5
Adobe Prelude NULL Pointer Dereference Application Denial of Service
Adobe Prelude version 10.1 (and earlier) is affected by a null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of…
-
Medium 5.5
Adobe Prelude NULL Pointer Dereference Application Denial of Service
Adobe Prelude version 10.1 (and earlier) is affected by a null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of…
-
High 7.8
Adobe Prelude M4A File Parsing Memory Corruption Arbitrary Code Execution
Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in t…
-
High 7.8
Adobe Prelude WAV File Parsing Memory Corruption Arbitrary Code Execution
Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in t…
-
High 7.8
Adobe Prelude M4A File Parsing Memory Corruption Arbitrary Code Execution
Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in t…
-
High 7.5CVE-2020-7882 Public exploit
anySign directory traversal vulnerability
Using the parameter of getPFXFolderList function, attackers can see the information of authorization certification and delete the files. It occurs because the parameter contains path traversal characters(ie. '../../../')
-
High 7.5
IpTime C200 IP camera remote code execution vulnerability
ius_get.cgi in IpTime C200 camera allows remote code execution. A remote attacker may send a crafted parameters to the exposed vulnerable web service interface which invokes the arbitrary shell command.
-
Unscored —
A Use-After-Free Remote Vulnerability exists when reading a DWG file using Open Design Alliance Drawings SDK before 202…
-
Unscored —
An Out-of-Bounds Read vulnerability exists when reading a U3D file using Open Design Alliance PRC SDK before 2022.11. T…
-
Unscored —
OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a…
-
Unscored —
OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because t…
-
Unscored —
OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of …
-
Unscored —
OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message.
-
Unscored —
OX App Suite through through 7.10.5 allows XSS via a crafted snippet that has an app loader reference within an app loa…
-
Unscored —
The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary…
-
Unscored —
OX App Suite 7.10.5 allows XSS via an OX Chat system message.
-
Unscored —
OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering.
-
Unscored —
Path traversal in request_uri variable
The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For inst…
-
Unscored —
The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format.
-
Unscored —
OX App Suite 7.10.5 allows XSS via an OX Chat room name.
-
Unscored —
OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandli…
-
Unscored —
OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature.
-
Unscored —
OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file.
-
Unscored —
chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a dev…
-
Unscored —
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl comma…
-
Unscored —
certain VT-d IOMMUs may not work in shared page table mode For efficiency reasons, address translation control structur…
-
Medium 4.1
NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with eleva…
-
Medium 4.1
NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with eleva…
-
Medium 4.1
NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elev…
-
High 7.5
NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elev…
-
High 7.5
NVIDIA GPU and Tegra hardware contain a vulnerability in an internal microcontroller, which may allow a user with eleva…
-
Medium 4.1
NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with eleva…
-
Medium 4.1
NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with eleva…
-
Medium 4.1
NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with eleva…
-
High 7.8
Dell EMC SCG 5.00.00.10 and earlier, contain a sensitive information disclosure vulnerability. A local malicious user m…