Archive
1 January 2022
Vulnerabilities first published on this day (UTC), newest first.
10 results · Feed
-
Medium 5.4
Cross site scripting in dolibarr
admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter.
-
Unscored —
DMP Roadmap before 3.0.4 allows XSS.
-
Unscored —
The giftrans function in giftrans 1.12.2 contains a stack-based buffer overflow because a value inside the input file d…
-
High 8.8CVE-2021-45960 Public exploit
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can l…
-
Unscored —CVE-2021-44852 Public exploit
An issue was discovered in BS_RCIO64.sys in Biostar RACING GT Evo 2.1.1905.1700. A low-integrity process can open the d…
-
Unscored —
The Datalogic DXU service on (for example) DL-Axist devices does not require authentication for configuration changes o…
-
High 7.5
golang.org/x/net/http2 allows uncontrolled memory consumption
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.
-
Unscored —
Misdirected I/O in syscall
Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.
-
High 7.5
Regular expression denial of service vulnerability (ReDoS) in date
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
-
High 7.5
Cookie Prefix Spoofing in CGI::Cookie.parse
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.