Archive
7 January 2022
Vulnerabilities first published on this day (UTC), newest first.
102 results · Feed
-
Unscored —
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Special:CheckUserLo…
-
Unscored —
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The WikibaseMediaIn…
-
Unscored —
Z-Wave devices using Silicon Labs 500 and 700 series chipsets, including but not likely limited to the SiLabs UZB-7 ver…
-
Unscored —
Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 v…
-
Unscored —
Z-Wave devices based on Silicon Labs 500 series chipsets using S0 authentication are susceptible to uncontrolled resour…
-
Unscored —
Z-Wave devices based on Silicon Labs 500 series chipsets using CRC-16 encapsulation, including but likely not limited t…
-
Unscored —
Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets do not support encryption, allowing an attacker …
-
Unscored —
A Stack-based buffer overflow in the SonicOS SessionID HTTP response header allows a remote authenticated attacker to c…
-
Unscored —
A Stack-based buffer overflow in the SonicOS HTTP Content-Length response header allows a remote authenticated attacker…
-
Medium 4.2
Reflected XSS Vulnerability in TFTP
A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, …
-
Low 3.0
ANSI escape characters in kubectl output are not being filtered
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
-
Medium 6.5
Out-of-bounds Read in Pillow
path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.
-
Critical 9.8
Arbitrary expression injection in Pillow
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.
-
Medium 6.5
Improper Initialization in Pillow
path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.
-
Unscored —
GPAC 1.0.1 is affected by: Abort failed. The impact is: cause a denial of service (context-dependent).
-
Unscored —
A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the gf_fileio_check function, which could cause a Denial o…
-
Unscored —
A Pointer Derefernce Vulnerbility exists GPAC 1.0.1 the gf_isom_box_size function, which could cause a Denial of Servic…
-
Unscored —
A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the Media_IsSelfContained function, which could cause a De…
-
Unscored —
A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the gf_hinter_finalize function.
-
Medium 6.1CVE-2021-44528 Scanner template
actionpack Open Redirect in Host Authorization Middleware
A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to …
-
Critical 9.8
RCE in H2 Console
The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This…
-
High 7.5CVE-2021-22569 Public exploit
Denial of Service of protobuf-java parsing procedure
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived o…