Archive
9 February 2022
Vulnerabilities first published on this day (UTC), newest first.
276 results · Feed
-
Unscored —
S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier R…
-
Unscored —
When a user opens a manipulated JPEG file format (.jpg, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterp…
-
Critical 9.8
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 an…
KEV Aug 18, 2022 -
Unscored —
SAP NetWeaver AS ABAP (Workplace Server) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787, al…
-
Unscored —
When a user opens a manipulated Adobe Illustrator file format (.ai, ai.x3d) received from untrusted sources in SAP 3D V…
-
Unscored —
When a user opens a manipulated Tagged Image File Format (.tiff, 2d.x3d)) received from untrusted sources in SAP 3D Vis…
-
Unscored —
Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may ex…
-
Unscored —
SAP ERP HCM Portugal - versions 600, 604, 608, does not perform necessary authorization checks for a report that reads …
-
Unscored —
Due to improper error handling in SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL6…
-
Unscored —
In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53,…
-
Unscored —
SAP Adaptive Server Enterprise (ASE) - version 16.0, installation makes an entry in the system PATH environment variabl…
-
High 7.5
swift-nio-http2 vulnerable to denial of service via ALTSVC or ORIGIN frames
A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical error after …
-
High 7.5
swift-nio-http2 vulnerable to denial of service via mishandled HPACK variable length integer encoding
A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HPACK-encoded header block. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. There are a number of implemen…
-
High 7.5
swift-nio-http2 vulnerable to denial of service via invalid HTTP/2 HEADERS frame length
A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical er…
-
Low 3.7
Retained exploded messages in Keybase clients for macOS and Windows
The Keybase Clients for macOS and Windows before version 5.9.0 fails to properly remove exploded messages initiated by a user. This can occur if the receiving user switches to a non-chat feature and places the host in a sleep state before the sending user exp…
-
Medium 4.7
Zoom Chat Susceptible to Zip Bombing
The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks in the following product versions: Android before version 5.8.6, iOS before version 5.9.0, Linux before version 5.8.6, macOS before version 5.7.3, and Windows before versio…
-
Medium 4.3
An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 be…
-
Medium 4.2
Incorrect Permission Assignment for Critical Resource in CRI-O
An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel n…
-
Unscored —
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause Denial of Service…
-
Unscored —
A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installa…
-
Unscored —
A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communi…
-
Unscored —
A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communi…
-
Unscored —
A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the se…
-
Unscored —
A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists tha…
-
Unscored —
A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could induce users to perform unintended actions…
-
Unscored —
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker …
-
Unscored —
A CWE-798: Use of Hard-coded Credentials vulnerability exists. If an attacker were to obtain the TLS cryptographic key …
-
Unscored —
A CWE-862: Missing Authorization vulnerability exists that could cause information exposure when an attacker sends a sp…
-
Unscored —
A CWE-665: Improper Initialization vulnerability exists that could cause information exposure when an attacker sends a …
-
Unscored —CVE-2022-24315 EPSS 19%
A CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service when an attacker repeatedly sends…
-
Unscored —CVE-2022-24314 EPSS 18%
A CWE-125: Out-of-bounds Read vulnerability exists that could cause memory leaks potentially resulting in denial of ser…
-
Unscored —CVE-2022-24313 EPSS 45%
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overfl…
-
Unscored —
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modificatio…
-
Unscored —
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modificatio…
-
Unscored —
A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to …
-
High 7.8
Improper restriction of XML external entity for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an …
-
Medium 5.5
Uncaught exception in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user t…
-
High 7.5
Improper restriction of XML external entity reference in DSP Builder Pro for Intel(R) Quartus(R) Prime Pro Edition befo…
-
Medium 5.5
Out-of-bounds read in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user t…
-
Medium 5.5
Improper access control in the Intel(R) Smart Campus Android application before version 6.1 may allow authenticated use…