Archive
January 2022
Vulnerabilities first published in this month (UTC), newest first.
2,026 results · Feed
-
Unscored —
In vow driver, there is a possible memory corruption due to improper locking. This could lead to local escalation of pr…
-
Unscored —
In kd_camera_hw driver, there is a possible information disclosure due to uninitialized data. This could lead to local …
-
Medium 6.7
In vow driver, there is a possible memory corruption due to improper input validation. This could lead to local escalat…
-
Unscored —
In vow driver, there is a possible memory corruption due to a race condition. This could lead to local escalation of pr…
-
Unscored —
In mdp driver, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of…
-
Unscored —
In wifi driver, there is a possible system crash due to a missing validation check. This could lead to remote denial of…
-
Unscored —
In Modem EMM, there is a possible information disclosure due to a missing data encryption. This could lead to remote in…
-
Unscored —
A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the a…
-
Unscored —
An unauthenticated Named Pipe channel in Controlup Real-Time Agent (cuAgent.exe) before 8.5 potentially allows an attac…
-
High 7.5
Inefficient Regular Expression Complexity in nltk/nltk
nltk is vulnerable to Inefficient Regular Expression Complexity
-
Unscored —
Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via getURL in the…
-
Unscored —
Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via app.launchURL…
-
Unscored —
Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via xfa.host.goto…
-
Unscored —
A hardcoded key in ControlUp Real-Time Agent (cuAgent.exe) before 8.2.5 may allow a potential attacker to run OS comman…
-
Unscored —CVE-2021-43711 EPSS 38%
The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when r…
-
Low 3.3
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0…
KEV Dec 10, 2021 -
High 7.1
Potential product security bypass vulnerability in McAfee Application and Change Control (MACC) prior to version 8.3.4 …
-
Critical 9.1
Sieve file storage vulnerable to path traversal attacks
Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. …
-
Medium —
Apache James IMAP parsing Denial Of Service
In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite loops resulting in expensive CPU computations and OutOfMemory exceptions. This can be used for a Denia…
-
High —
Apache James IMAP vulnerable to a ReDoS
In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1…
-
Medium 5.9
Apache James vulnerable to STARTTLS command injection (IMAP and POP3)
Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information.
-
High —
Apache Geode project log file redaction of sensitive information vulnerability
Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix "sysprop-", "ja…
-
High 7.3
Generation of Error Message Containing Sensitive Information in livehelperchat/livehelperchat
livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information
-
Unscored —
Protection mechanism failure vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C65…
-
Unscored —
Exposure of sensitive information to an unauthorized actor vulnerability in KONICA MINOLTA bizhub series (bizhub C750i …
-
Unscored —
Improper handling of exceptional conditions vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earl…
-
Unscored —
Exposure of sensitive information to an unauthorized actor vulnerability in KONICA MINOLTA bizhub series (bizhub C750i …
-
Unscored —
Incorrect authorization vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C5…
-
Unscored —CVE-2021-43942 EPSS 55%
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScrip…
-
Medium 5.9
Missing release of locks in PJSIP
PJSIP is a free and open source multimedia communication library written in the C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In various parts of PJSIP, when error/failure occurs, it is found that the function re…
-
Unscored —
HDF5 1.13.1-1 is affected by: segmentation fault, which causes a Denial of Service.
-
Unscored —
A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to per…
-
Unscored —
There is an Out-of-bounds read in Smartphones.Successful exploitation of this vulnerability may affect service confiden…
-
Unscored —
There is a Timing design defects in Smartphone.Successful exploitation of this vulnerability may affect service confide…
-
Unscored —
There is a Null pointer dereference in Smartphones.Successful exploitation of this vulnerability may cause the kernel t…
-
Unscored —
There is an Unauthorized file access vulnerability in Smartphones.Successful exploitation of this vulnerability may aff…
-
Unscored —
There is an Uninitialized AOD driver structure in Smartphones.Successful exploitation of this vulnerability may affect …
-
High 7.5
There is a Vulnerability of obtaining broadcast information improperly due to improper broadcast permission settings in…
-
High 7.5
There is an Unauthorized file access vulnerability in Smartphones.Successful exploitation of this vulnerability may aff…
-
Critical 9.8
The screen lock module has a Stack-based Buffer Overflow vulnerability.Successful exploitation of this vulnerability ma…