Archive
11 February 2022
Vulnerabilities first published on this day (UTC), newest first.
32 results · Clear filters · Feed
-
Medium —
GitHub CLI can execute a git binary from the current directory
### Impact GitHub CLI depends on a `git.exe` executable being found in system `%PATH%` on Windows. However, if a malicious `.\git.exe` or `.\git.bat` is found in the current working directory at the time of running `gh`, the malicious command will be invoked …
-
Medium 5.9
Improper Validation of Certificate with Host Mismatch in mellium.im/xmpp/websocket
In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host nam…
-
Medium 5.7
Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.15-6 allows privileged attackers to trig…
-
Medium 4.2
Improper privilege management vulnerability in Samsung Video Player prior to version 7.3.15.30 allows attackers to exec…
-
Medium 4.4
Improper input validation vulnerability in SettingsProvider prior to Android S(12) allows privileged attackers to trigg…
-
Medium 4.0
Improper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrust…
-
Medium 4.0
Exposure of Sensitive Information vulnerability in Bixby Vision prior to version 3.7.50.6 allows attackers to access in…
-
Medium 4.0
Improper Authorization vulnerability in Link Sharing prior to version 12.4.00.3 allows attackers to open protected acti…
-
Medium 6.2
Improper access control vulnerability in Camera prior to versions 11.1.02.16 in Android R(11), 10.5.03.77 in Android Q(…
-
Medium 4.0
Unprotected component vulnerability in StTheaterModeDurationAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2…
-
Medium 4.0
Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release a…
-
Medium 4.0
Unprotected component vulnerability in StBedtimeModeAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Rele…
-
Medium 4.4
A vulnerability using PendingIntent in Bixby Vision prior to versions 3.7.60.8 in Android S(12), 3.7.50.6 in Andorid R(…
-
Medium 4.3
Improper access control vulnerability in Reminder prior to versions 12.3.01.3000 in Android S(12), 12.2.05.6000 in Andr…
-
Medium 6.4
An improper boundary check in RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code executio…
-
Medium 6.4
An improper input validation in SMC_SRPMB_WSM handler of RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary mem…
-
Medium 5.3
An improper boundary check in audio hal service prior to SMR Feb-2022 Release 1 allows attackers to read invalid memory…
-
Medium 4.4
A vulnerability using PendingIntent in DeX Home and DeX for PC prior to SMR Feb-2022 Release 1 allows attackers to acce…
-
Medium 5.5
Logging of excessive data vulnerability in telephony prior to SMR Feb-2022 Release 1 allows privileged attackers to get…
-
Medium 5.4
TCMAN GIM Cross-Site Scripting (XSS)
The m_txtNom y m_txtCognoms parameters in TCMAN GIM v8.01 allow an attacker to perform persistent XSS attacks. This vulnerability could be used to carry out a number of browser-based attacks including browser hijacking or theft of sensitive data.
-
Medium 4.4
Path Traversal in S-Cart
A Directory Traversal vulnerability exists in S-Cart 6.7 via download in sc-admin/backup.
-
Medium 6.5
Incorrect Authorization in Drupal core
The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
-
Medium 6.5
Cross-Site Request Forgery in Drupal core
The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard …
-
Medium 6.1
Drupal core Cross-site Scripting (XSS) vulnerability
Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions…
-
Medium 6.1
Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor
Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
-
Medium 6.1
Access bypass in Drupal Core 8/9
Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6…
-
Medium 6.5
Improper Authentication in Kazoo Server
An improper authentication vulnerability has been reported to affect QNAP NAS running Kazoo Server. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions …
-
Medium 4.3
Open Redirect in microweber/microweber
Open Redirect in Packagist microweber/microweber prior to 1.2.11.
-
Medium 6.7
Possible out of bound access of DCI resources due to lack of validation process and resource allocation in Snapdragon A…
-
Medium 6.7
Possible out of bound write due to lack of boundary check for the maximum size of buffer when sending a DCI packet to r…
-
Medium 5.5
Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff v…
-
Medium 5.5
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff…