Archive
13 January 2022
Vulnerabilities first published on this day (UTC), newest first.
158 results · Feed
-
Medium 5.4
Halo CMS - Stored Cross-Site Scripting (XSS) in Article's Title
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title. An authenticated attacker can inject arbitrary javascript code that will execute on a victim’s server.
-
Medium —
GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior
### Impact The `GovernorCompatibilityBravo` module may lead to the creation of governance proposals that execute function calls with incorrect arguments due to bad ABI encoding. This happens if the proposal is created using explicit function signatures, e.g. …
-
Low 3.7
Possible view of the setup pages by unauthenticated users if config file already exists
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
KEV Feb 22, 2022 -
Medium 6.3
Stored XSS in host groups configuration window in Zabbix Frontend
An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS …
-
Low 3.3
Incorrect permissions of [/var/run/zabbix] forces dac_override
During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level
-
Critical 9.1
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to esca…
KEV Feb 22, 2022 -
Unscored —
Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key…
-
Medium 6.5
Content Injection
This affects the package Crow before 0.3+4. When using attributes without quotes in the template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting (XSS) vulnerability,…
-
Medium 6.5
Path Traversal
This affects the package Crow before 0.3+4. It is possible to traverse directories to fetch arbitrary files from the server.
-
Unscored —
jpress v4.2.0 admin panel provides a function through which attackers can modify the template and inject some malicious…
-
High 7.5
Improper validation of function pointer type with actual function signature can lead to assertion in Snapdragon Auto, S…
-
High 7.5
Possible null pointer dereference due to improper validation of APE clip in Snapdragon Auto, Snapdragon Compute, Snapdr…
-
High 7.8
Possible integer overflow due to improper validation of command length parameters while processing WMI command in Snapd…
-
Medium 6.2
Lack of validation for third party application accessing the service can lead to information disclosure in Snapdragon A…
-
Medium 6.7
Use after free condition can occur in wired connectivity due to a race condition while creating and deleting folders in…
-
High 7.8
Possible heap overflow due to lack of index validation before allocating and writing to heap buffer in Snapdragon Auto,…
-
High 7.8
Possible buffer overflow while printing the HARQ memory partition detail due to improper validation of buffer size in S…
-
High 7.5
Possible denial of service due to improper validation of DNS response when DNS client requests with PTR, NAPTR or SRV q…
-
High 7.5
Possible denial of service due to out of memory while processing RRC and NAS OTA message in Snapdragon Auto, Snapdragon…
-
High 7.5
Possible denial of service due to incorrectly decoding hex data for the SIB2 OTA message and assigning a garbage value …
-
High 7.5
Possible assertion due to improper validation of symbols configured for PDCCH monitoring in Snapdragon Auto, Snapdragon…
-
Critical 9.3
Improper validation of memory region in Hypervisor can lead to incorrect region mapping in Snapdragon Auto, Snapdragon …
-
High 8.8
DayByDay CRM - Insufficient Session Expiration after Password Change
In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even af…
-
Medium 5.4
DayByDay CRM - Application-Wide Client-Side Template Injection (CSTI)
In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI). A low privileged attacker can input template injection payloads in the application at various locations to execute JavaScript on the cl…
-
Medium 6.1
Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
-
Medium 5.4
Cross-Site Request Forgery (CSRF) in phoronix-test-suite/phoronix-test-suite
phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in phoronix-test-suite/phoronix-test-suite
phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF)
-
High 7.7
flatpak-builder can access files outside the build directory.
Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have t…
-
Unscored —
GPAC v1.1.0 was discovered to contain an invalid memory address dereference via the function gf_list_last(). This vulne…
-
Unscored —
The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the gf_isom_get_payt_count function in …
-
Unscored —
The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the mpgviddmx_process function in refra…
-
Unscored —
The binary MP4Box in Gpac 1.0.1 has a double-free bug in the av1dmx_finalize function in reframe_av1.c, which allows at…
-
Unscored —
A buffer overflow vulnerability exists in Gpac through 1.0.1 via a malformed MP4 file in the svc_parse_slice function i…
-
Unscored —
The binary MP4Box in Gpac from 0.9.0-preview to 1.0.1 has a double-free vulnerability in the gf_text_get_utf8_line func…
-
Unscored —
The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the avc_compute_poc function in av_parsers.c, which …
-
Unscored —
The binary MP4Box in Gpac through 1.0.1 has a double-free vulnerability in the iloc_entry_del funciton in box_code_meta…
-
Unscored —
Segmentation fault vulnerability exists in Gpac through 1.0.1 via the gf_odf_size_descriptor function in desc_private.c…
-
Unscored —
The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the ilst_box_read function in box_code_apple.c, whic…