Archive
7 January 2022
Vulnerabilities first published on this day (UTC), newest first.
23 results · Clear filters · Feed
-
Medium 4.3
Log entry injection in Spring Framework
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against add…
-
Medium 4.3CVE-2021-35247 Exploited
Improper Input Validation Vulnerability in Serv-U
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as t…
KEV Jan 21, 2022 -
Medium 5.3
Improper access control vulnerability in S Assistant prior to version 7.5 allows attacker to remotely get senstive info…
-
Medium 4.4
A vulnerability using PendingIntent in Bixby Routines prior to version 3.1.21.8 in Android R(11.0) and 2.6.30.5 in Andr…
-
Medium 4.4
A vulnerability using PendingIntent in Reminder prior to version 12.2.05.0 in Android R(11.0) and 12.3.02.1000 in Andro…
-
Medium 5.7
Improper authentication vulnerability in Samsung Internet prior to 16.0.2.19 allows attackers to bypass secret mode pas…
-
Medium 5.5
A missing input validation before memory copy in TIMA trustlet prior to SMR Jan-2022 Release 1 allows attackers to copy…
-
Medium 4.4
An implicit Intent hijacking vulnerability in Dialer prior to SMR Jan-2022 Release 1 allows unprivileged applications t…
-
Medium 4.0
Keeping sensitive data in unprotected BluetoothSettingsProvider prior to SMR Jan-2022 Release 1 allows untrusted applic…
-
Medium 4.0
Improper authorization in TelephonyManager prior to SMR Jan-2022 Release 1 allows attackers to get IMSI without READ_PR…
-
Medium 4.0
Implicit Intent hijacking vulnerability in ActivityMetricsLogger prior to SMR Jan-2022 Release 1 allows attackers to ge…
-
Medium 6.1
Incorrect implementation of Knox Guard prior to SMR Jan-2022 Release 1 allows physically proximate attackers to tempora…
-
Medium 4.0
Unprotected dynamic receiver in SecSettings prior to SMR Jan-2022 Release 1 allows untrusted applications to launch arb…
-
Medium 4.0
(Applicable to China models only) Unprotected WifiEvaluationService in TencentWifiSecurity application prior to SMR Jan…
-
Medium 5.0CVE-2022-22265 Exploited
An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary …
KEV Sep 18, 2023 -
Medium 5.3
IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could disclose sensitive version information in HTTP response header…
-
Medium 5.9
IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 uses weaker than expected cryptographic algorithms that could allow …
-
Medium 5.3
Improper Access Control in chocobozzz/peertube
peertube is vulnerable to Improper Access Control
-
Medium 4.8
Server-Side Request Forgery (SSRF) in chocobozzz/peertube
peertube is vulnerable to Server-Side Request Forgery (SSRF)
-
Medium 4.2
Reflected XSS Vulnerability in TFTP
A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, …
-
Medium 6.5
Out-of-bounds Read in Pillow
path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.
-
Medium 6.5
Improper Initialization in Pillow
path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.
-
Medium 6.1CVE-2021-44528 Scanner template
actionpack Open Redirect in Host Authorization Middleware
A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to …