Archive
8 December 2021
Vulnerabilities first published on this day (UTC), newest first.
138 results · Feed
-
Medium 6.7
Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile
`Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working with untrusted and apparently harmless `Gemfile`'s, it is not expected that they lead to execution of external code, unless that's explicit…
-
High 7.3
Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.…
-
High 8.0
A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 th…
-
Unscored —
Mahavitaran android application 7.50 and prior are affected by account takeover due to improper OTP validation, allows …
-
Unscored —
The Yubico YubiHSM YubiHSM2 library 2021.08, included in the yubihsm-shell project, does not properly validate the leng…
-
High 7.1
Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its binary files, which allows user…
-
Medium 4.2
Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 thr…
-
Unscored —
### Access Bypass: This module enables you to build forms and surveys in Drupal. The module doesn't sufficiently check …
-
Medium 5.4
An authentication bypass by capture-replay vulnerability [CWE-294] in FortiClient EMS versions 7.0.1 and below and 6.4.…
-
High 7.8
A privilege escalation vulnerability in FortiNAC versions 8.8.8 and below and 9.1.2 and below may allow an admin user t…
-
Unscored —
SQL injection vulnerability was discovered in Aanderaa GeoView Webservice prior to version 2.1.3 that could allow an un…
-
Critical 9.8
Arbitrary file upload vulnerability in FatPipe software
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identi…
KEV Jan 10, 2022 -
Medium 6.5
Instance config inline secret exposure
Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0.21.2, inline secrets defined within a metrics instance config are exposed in plaintext over two end…
-
High 8.0
Prototype Pollution in fabiocaccamo/utils.js
utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
-
High 7.1
An issue was discovered in Allegro Windows (formerly Popsy Windows) before 3.3.4156.1. A standard user can escalate pri…
-
Unscored —
An HTTP request smuggling attack in TP-Link AX10v1 before v1_211117 allows a remote unauthenticated attacker to DoS the…
-
Unscored —
A SQL Injection in the custom filter query component in Genesys intelligent Workload Distribution (IWD) 9.0.017.07 allo…
-
Unscored —
A SQL Injection in the custom filter query component in Genesys intelligent Workload Distribution (IWD) before 9.0.013.…
-
Unscored —CVE-2021-42835 Public exploit
An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint …
-
Low 3.8
Improper export of Android application components vulnerability in Samsung Pay (India only) prior to version 4.1.77 all…
-
Medium 4.0
Intent redirection vulnerability in Samsung Blockchain Wallet prior to version 1.3.02.8 allows attacker to execute priv…
-
Low 2.0
Improper check or handling of exception conditions vulnerability in Samsung Pay (US only) prior to version 4.0.65 allow…
-
Medium 4.0
Insecure storage of device information in Contacts prior to version 12.7.05.24 allows attacker to get Samsung Account I…
-
Medium 4.0
Insecure storage of device information in Samsung Dialer prior to version 12.7.05.24 allows attacker to get Samsung Acc…
-
Medium 5.3
Insecure storage of sensitive information vulnerability in Smart Capture prior to version 4.8.02.10 allows attacker to …
-
Medium 4.0
Insecure caller check in sharevia deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to get…
-
Medium 5.9
Insecure caller check and input validation vulnerabilities in SearchKeyword deeplink logic prior to Samsung Internet 16…
-
Medium 4.0
An improper access control vulnerability in CPLC prior to SMR Dec-2021 Release 1 allows local attackers to access CPLC …
-
Medium 6.4
An improper boundary check in secure_log of LDFW and BL31 prior to SMR Dec-2021 Release 1 allows arbitrary memory write…
-
High 7.7
An improper input validation vulnerability in LDFW prior to SMR Dec-2021 Release 1 allows attackers to perform arbitrar…
-
Medium 6.4
An improper check or handling of exceptional conditions in Exynos baseband prior to SMR Dec-2021 Release 1 allows attac…
-
Medium 4.0
An improper usage of implicit intent in SemRewardManager prior to SMR Dec-2021 Release 1 allows attackers to access BSS…
-
Low 3.3
An improper intent redirection handling in Tags prior to SMR Dec-2021 Release 1 allows attackers to access sensitive in…
-
Low 2.4
An improper privilege management vulnerability in Apps Edge application prior to SMR Dec-2021 Release 1 allows unauthor…
-
Medium 6.1
An improper validation vulnerability in telephony prior to SMR Dec-2021 Release 1 allows attackers to launch certain ac…
-
Medium 6.3
An improper validation vulnerability in FilterProvider prior to SMR Dec-2021 Release 1 allows attackers to write arbitr…
-
Medium 5.3
An improper validation vulnerability in FilterProvider prior to SMR Dec-2021 Release 1 allows local arbitrary code exec…
-
Unscored —
There is a Code Injection vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to …
-
Unscored —
There is a Improper Access Control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may…
-
Unscored —
There is a Incomplete Cleanup vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead…