Archive
12 January 2022
Vulnerabilities first published on this day (UTC), newest first.
67 results · Feed
-
Unscored —
Unisys ClearPath MCP TCP/IP Networking Services 59.1, 60.0, and 62.0 has an Infinite Loop.
-
High 7.8
Cortex XDR Agent: An Uncontrolled Search Path Element Leads to Local Privilege Escalation (PE) Vulnerability
A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables an authenticated local user to execute programs with elevated privileges. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR …
-
Medium 6.7
Cortex XDR Agent: Unintended Program Execution When Using Live Terminal Session
An untrusted search path vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker with file creation privilege in the Windows root directory (such as C:\) to store a program that can then be unintentionally executed by ano…
-
Medium 5.0
Cortex XDR Agent: File Information Exposure Vulnerability When Generating Support File
A file information exposure vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker to read the contents of arbitrary files on the system with elevated privileges when generating a support file. This issue impacts: Cortex…
-
Medium 6.1
Cortex XDR Agent: Local Arbitrary File Deletion Vulnerability
An improper link resolution before file access vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables a local user to delete arbitrary system files and impact the system integrity or cause a denial of service conditi…
-
Unscored —
MartDevelopers Inc iResturant v1.0 allows Stored XSS by placing a payload in the username field during a login attempt.…
-
Unscored —
In Sourcecodetester Printable Staff ID Card Creator System 1.0 after compromising the database via SQLi, an attacker ca…
-
Unscored —
Zoho ManageEngine O365 Manager Plus before Build 4416 allows remote code execution via BCP file overwrite through the C…
-
Unscored —
Zoho ManageEngine CloudSecurityPlus before Build 4117 allows remote code execution through the updatePersonalizeSetting…
-
High 8.8
Unrestricted Upload of File with Dangerous Type in crater-invoice/crater
crater is vulnerable to Unrestricted Upload of File with Dangerous Type
-
Unscored —
Zoho ManageEngine M365 Manager Plus before Build 4419 allows remote command execution when updating proxy settings thro…
-
Medium 5.4
Cross-site Scripting in django-cms
Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (XSS) vulnerability. The vulnerability allows an attacker to execute arbitrary JavaScript code in the …
-
Unscored —
GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream o…
-
Medium 6.3
Authorization Bypass Through User-Controlled Key in weseek/growi
growi is vulnerable to Authorization Bypass Through User-Controlled Key
-
High 7.4
Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore
orchardcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 6.3
Missing Authorization in snipe/snipe-it
snipe-it is vulnerable to Missing Authorization
-
Low 3.7
Observable Discrepancy and Observable Timing Discrepancy in Jenkins Configuration as Code Plugin
Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token allowing attackers to use statistical methods to obtain a valid authentication token.
-
Medium 4.3
Cross-Site Request Forgery in Jenkins Mailer Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.
-
Medium 4.3
Incorrect Permission Assignment for Critical Resource in Jenkins Mailer Plugin
A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.
-
Unscored —
A heap-based buffer overflow vulnerability exists in GPAC v1.0.1 in the gf_isom_dovi_config_get function in MP4Box, whi…
-
Unscored —
A Segmentation fault caused by a floating point exception exists in Gpac through 1.0.1 using mp4box via the naludmx_enq…
-
Unscored —
A Segmentation fault exists casued by null pointer dereference exists in Gpac through 1.0.1 via the naludmx_create_avc_…
-
Unscored —
A Segmentation fault casued by heap use after free vulnerability exists in Gpac through 1.0.1 via the mpgviddmx_process…
-
Unscored —
A Segmentation fault caused by null pointer dereference vulnerability eists in Gpac through 1.0.2 via the avc_parse_sli…
-
Unscored —
A null pointer deference vulnerability exists in gpac through 1.0.1 via the naludmx_parse_nal_avc function in reframe_n…
-
Unscored —
A Segmentation fault caused by a null pointer dereference vulnerability exists in Gpac through 1.0.1 via the gf_avc_par…
-
High 8.2
Permissions granted to applications can be hidden from the user at install time
Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app …