Archive
18 February 2022
Vulnerabilities first published on this day (UTC), newest first.
14 results · Clear filters · Feed
-
Medium 6.2
Out-of-bounds read in swtpm
swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicato…
-
Medium 5.3
This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It! 20.21.01…
-
Medium 6.5
Path Traversal in LemMinX
A flaw was found in LemMinX in versions prior to 0.19.0. Cache poisoning of external schema files due to directory traversal.
-
Medium 5.5
Exposure of Sensitive Information to an Unauthorized Actor in LemMinX
A flaw was found in LemMinX in versions prior to 0.19.0. Insecure redirect could allow unauthorized access to sensitive information locally if LemMinX is run under a privileged user.
-
Medium 6.5
Airspan Networks Mimosa Use of a Broken or Risky Cryptographic Algorithm
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. As a result, attacker…
-
Medium 4.3
WordPress Perfect Brands for WooCommerce plugin <= 2.0.4 - Server Information Exposure vulnerability
The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure.
-
Medium 4.3
WordPress Perfect Brands for WooCommerce plugin <= 2.0.4 - Set Featured Brand vulnerability
The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4).
-
Medium 5.3
Exposure of Resource to Wrong Sphere in ezsystems/ezplatform-kernel
Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference (IDOR) attacks against image files because the image path and filename can be correctly deduced.
-
Medium 5.9
IBM Guardium Data Encryption (GDE) 5.0.0.2 and 5.0.0.3 could allow a remote attacker to obtain sensitive information, c…
-
Medium 5.9
IBM Maximo Asset Management 7.6.1.2 does not require that users should have strong passwords by default, which makes it…
-
Medium 5.9
Heap-based Buffer Overflow in mruby/mruby
Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.
-
Medium 6.5
Auth bypass in Dark SDK
Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a reques…
-
Medium 6.5CVE-2022-25313 Public exploit
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth…
-
Medium 4.3
Large loops in multiple protocol dissectors in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allow denial of service via…