Archive
5 January 2022
Vulnerabilities first published on this day (UTC), newest first.
35 results · Feed
-
Medium —
Cross-site Scripting in Scratch-Svg-Renderer
A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file.
-
Unscored —
Github Read Me Stats commit 3c7220e4f7144f6cb068fd433c774f6db47ccb95 was discovered to contain a reflected cross-site s…
-
Unscored —
An issue was discovered in SdHostDriver in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 b…
-
Unscored —
An issue was discovered in AtaLegacySmm in the kernel 5.0 before 05.08.46, 5.1 before 05.16.46, 5.2 before 05.26.46, 5.…
-
Unscored —
An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 bef…
-
Unscored —
An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 befo…
-
Unscored —
An issue was discovered in SdLegacySmm in Insyde InsydeH2O with kernel 5.1 before 05.15.11, 5.2 before 05.25.11, 5.3 be…
-
Medium 5.9
Hash collision in typelevel jawn
Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applicat…
-
Unscored —
A Stack-based Buffer Overflow Vulnerability exists in HDF5 1.13.1-1 via the H5D__create_chunk_file_map_hyper function i…
-
Unscored —
A Stack-based Buffer Overflow Vulnerability exists in HDF5 1.13.1-1 at at hdf5/src/H5Eint.c, which causes a Denial of S…
-
Unscored —
A heap-based buffer overflow vulnerability exists in HDF5 1.13.1-1 via H5F_addr_decode_len in /hdf5/src/H5Fint.c, which…
-
Low 3.5
Insufficient Session Expiration in shopware
Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. With version 5.7.7 the session validation was adjusted, so that sessions created prior to the latest …
-
Medium 6.8
Open redirect in shopware
Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirected due to incomplete URL handling in the shopware router. This issue has been resolved in version 5.7.7. There is no wo…
-
Medium 4.3
Exposure of whisper participants in discourse
Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta…
-
High 8.0
Improper Preservation of Permissions in containerd
containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the nod…
-
Critical 9.9
Remote Command Execution vulnerability
GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating syst…
-
Unscored —
This module enables you to implement OAuth 2.0 authentication for Drupal. The module doesn't sufficiently verify client…
-
Unscored —
This module enables you to login with an email address. The module doesn't sufficiently check if a user account is acti…
-
High 8.6
IBM PowerVM Hypervisor FW860, FW940, FW950, and FW1010, through a specific sequence of VM management operations could l…
-
Unscored —
Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs;…
-
Unscored —
Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs;…
-
Unscored —
Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs;…
-
High 8.8
DayByDay CRM - Missing Authorization when Changing Password
In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gai…
-
High 7.5
DayByDay CRM - Weak Password Requirements in Update User
In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allo…
-
Medium 5.4
DayByDay CRM - Stored Cross-Site Scripting (XSS) in Task Title
In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they…
-
Medium 4.3
DayByDay CRM - Missing Authorization when Viewing Absences
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not…
-
Medium 4.3
DayByDay CRM - Missing Authorization when Viewing Appointments
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type o…
-
Unscored —
lmdb is unmaintained, use lmdb-rkv instead
The lmdb crate hasn't had any updates since August 2018. Mozilla's [lmdb-rkv](https://github.com/mozilla/lmdb-rs) fork of the crate has received additional maintenance work beyond that and is the best available replacement.
-
Unscored —
Use after free in tcpslice triggers AddressSanitizer, no other confirmed impact.
-
Medium 5.3
A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail …
-
Unscored —
A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base So…
-
Medium 4.6
Bidirectional Override in Dart SDK
Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefarious code passed a code review by appearing benign. An attacker could embed a source that is invisible to a code reviewer …
-
Unscored —
Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator gr…
-
Unscored —
A Pointer Dereference vulnerability exists in GPAC 1.0.1 in unlink_chunk.isra, which causes a Denial of Service (contex…
-
Unscored —
A Null Pointer Dereference vulnerability exitgs in GPAC 1.0.1 in MP4Box via __strlen_avx2, which causes a Denial of Ser…