Archive
January 2022
Vulnerabilities first published in this month (UTC), newest first.
87 results · Clear filters · Feed
-
Low 3.3CVE-2021-44715 EPSS 15%
Adobe Acrobat Reader DC Out-of-Bounds Read Information Disclosure Vulnerability
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory s…
-
Low 3.1
Adobe Acrobat Reader DC add-on (AxAcroPDFLib.AxAcroPDF) for Internet Explorer LoadFile NTLMv2 SSO Auth leak vulnerability
Acrobat Reader DC ActiveX Control versions 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenticated attacker could leverage this vulnerability to obtain N…
-
Low 3.3
Adobe Acrobat Reader DC JP2 File Parsing Use-After-Free Information Disclosure Vulnerability
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could lead to disclosure of sensitive memory. An atta…
-
Low 3.3
Adobe Acrobat Pro DC NULL Pointer Dereference could lead to Application-denial-of-service
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vul…
-
Low 3.3
Adobe Acrobat Pro DC NULL Pointer Dereference could lead to Application-denial-of-service
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vul…
-
Low 3.3
Adobe Illustrator TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe Illustrator versions 25.4.2 (and earlier) and 26.0.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. E…
-
Low 3.3
Adobe Illustrator JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe Illustrator versions 25.4.2 (and earlier) and 26.0.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. E…
-
Low 3.3
Adobe Bridge JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability
Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an use-after-free vulnerability in the processing of Format event actions that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability…
-
Low 3.3
Adobe Bridge TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. E…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley Conte…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley Conte…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View …
-
Low 3.3
Adobe InDesign JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability
Adobe InDesign version 16.4 (and earlier) is affected by a use-after-free vulnerability in the processing of a JPEG2000 file that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. E…
-
Low 3.3
Adobe InCopy JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability
Adobe InCopy version 16.4 (and earlier) is affected by a use-after-free vulnerability in the processing of a JPEG2000 file that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exp…
-
Low 3.7
Possible view of the setup pages by unauthenticated users if config file already exists
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
KEV Feb 22, 2022 -
Low 3.3
Incorrect permissions of [/var/run/zabbix] forces dac_override
During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level
-
Low 3.3
Password stored in plain text by Jenkins Publish Over SSH Plugin
Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
Low 3.7
Observable Discrepancy and Observable Timing Discrepancy in Jenkins Configuration as Code Plugin
Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token allowing attackers to use statistical methods to obtain a valid authentication token.
-
Low 2.5
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
-
Low 2.0
Path Traversal in nemo-toolkit
NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any directory when admin privileges are available.
-
Low —
Prototype Pollution in node-forge debug API.
### Impact The `forge.debug` API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist,…
-
Low —
Prototype Pollution in node-forge util.setPath API
### Impact `forge.util.setPath` had a potential prototype pollution issue if called with untrusted keys. This API was not used by forge itself. ### Patches The `forge.util.setPath` API and related functions were removed in 0.10.0. ### Workarounds Don't call `…
-
Low —
URL parsing in node-forge could lead to undesired behavior.
### Impact The regex used for the `forge.util.parseUrl` API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior. ### Patches `forge.util.parseUrl` and other very old related URL APIs were removed …
-
Low 2.6
ICSMA-22-006-01 Philips Engage Software
The affected product is vulnerable to an improper access control, which may allow an authenticated user to gain unauthorized access to sensitive data.
-
Low 3.9
Abitrary file access vulnerability in Samsung Email prior to 6.1.60.16 allows attacker to read isolated data in sandbox.
-
Low 2.8
Improper session management vulnerability in Samsung Health prior to 6.20.1.005 prevents logging out from Samsung Healt…