Archive
22 December 2021
Vulnerabilities first published on this day (UTC), newest first.
117 results · Feed
-
Critical 9.9
An OS command injection vulnerability exists in the Web Manager Diagnostics: Traceroute functionality of Lantronix Prem…
-
Unscored —
A null pointer dereference vulnerability exists in gpac 1.1.0 via the lsr_read_anim_values_ex function, which causes a …
-
Unscored —
This modules enables users to login via email address. This module does not sufficiently check user status when authent…
-
Unscored —
Projectsworlds Online Shopping System PHP 1.0 is vulnerable to SQL injection via the id parameter in cart_remove.php.
-
Unscored —
In ProjectWorlds Online Shopping System PHP 1.0, a CSRF vulnerability in cart_remove.php allows a remote attacker to re…
-
Unscored —
Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended actio…
-
Unscored —
Projectsworlds Online Book Store PHP v1.0 is vulnerable to SQL injection via the "bookisbn" parameter in cart.php.
-
Unscored —
In ProjectWorlds Online Book Store PHP 1.0 a CSRF vulnerability in admin_delete.php allows a remote attacker to delete …
-
Unscored —
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the appointment_no parameter in paymen…
-
Unscored —
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in add_patient.php…
-
Unscored —
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in admin_home.php.
-
Unscored —
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the email parameter in hms-staff.php.
-
Unscored —
An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Servic…
-
Unscored —
A null pointer dereference vulnerability exists in gpac 1.1.0 in the lsr_read_id.part function, which causes a segmenta…
-
Unscored —
An Invalid pointer reference vulnerability exists in gpac 1.1.0 via the gf_svg_node_del function, which causes a segmen…
-
Unscored —
A stack overflow vulnerability exists in gpac 1.1.0 via the gf_bifs_dec_proto_list function, which causes a segmentatio…
-
Medium 4.3
IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive i…
-
Unscored —
An infinite loop vulnerability exists in nasm 2.16rc0 via the gpaste_tokens function.
-
Unscored —
A Null Pointer Dereference vulnerability existfs in nasm 2.16rc0 via asm/preproc.c.
-
Unscored —
Certain Starcharge products are affected by Improper Input Validation. The affected products include: Nova 360 Cabinet …
-
Unscored —
Certain Starcharge products are vulnerable to Directory Traversal via main.cgi. The affected products include: Nova 360…
-
Unscored —
ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the pas…
-
Unscored —
An issue was discovered in Opmantek Open-AudIT after 3.5.0. Without authentication, a vulnerability in code_igniter/app…
-
Medium 4.6
Denial-of-Service (DoS) Vulnerability
A vulnerability affecting F-Secure antivirus engine was discovered whereby scanning MS outlook .pst files can lead to denial-of-service. The vulnerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the an…
-
Critical 9.8
Command Injection in node-windows
lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter.
-
Unscored —
An issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows attackers to execute rem…
-
Unscored —
An issue was discovered in Quest KACE Desktop Authority before 11.2. /dacomponentui/profiles/profileitems/outlooksettin…
-
Unscored —
Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery…
-
Unscored —
XXE can occur in Quest KACE Desktop Authority before 11.2 because the log4net configuration file might be controlled by…
-
Unscored —
An invalid free vulnerability exists in gpac 1.1.0 via the gf_svg_delete_attribute_value function, which causes a segme…
-
Unscored —
An invalid memory address dereference vulnerability exists in gpac 1.1.0 via the svg_node_start function, which causes …
-
Unscored —
An invalid free vulnerability exists in gpac 1.1.0 via the gf_sg_command_del function, which causes a segmentation faul…
-
Critical 10.0
An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7…
-
Critical 10.0
An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7…
-
Unscored —CVE-2021-44733 Public exploit
A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs …
-
High 7.3
Potential integer underflow upon receiving STUN message in PJSIP
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the he…
-
High 7.3
Out-of-bounds read when parsing RTCP BYE message in PJSIP
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming RTCP BYE message contains a reason's length, this dec…