Archive
25 February 2022
Vulnerabilities first published on this day (UTC), newest first.
88 results · Feed
-
Unscored —
The interface of a certain HarmonyOS module has a UAF vulnerability. Successful exploitation of this vulnerability may …
-
Unscored —
Some Huawei products have an integer overflow vulnerability. Successful exploitation of this vulnerability may lead to …
-
High 8.1
Gabia Firstmall remote code execution vulnerability
This issues due to insufficient verification of the various input values from user’s input. The vulnerability allows remote attackers to execute malicious code in Firstmall via navercheckout_add function.
-
High 7.5
ICSA-22-053-02 GE Proficy CIMPLICITY-Cleartext
The affected product is vulnerable due to cleartext transmission of credentials seen in the CIMPLICITY network, which can be easily spoofed and used to log in to make operational changes to the system.
-
High 7.5
ICSA-22-053-01 GE Proficy CIMPLICITY-IPM
Exploitation of this vulnerability may result in local privilege escalation and code execution. GE maintains exploitation of this vulnerability is only possible if the attacker has login access to a machine actively running CIMPLICITY, the CIMPLICITY server i…
-
High 7.8
ICSA-22-055-01 FATEK Automation FvDesigner
The affected product is vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary code
-
High 7.8
ICSA-22-055-01 FATEK Automation FvDesigner
The affected product is vulnerable to an out-of-bounds read while processing project files, which allows an attacker to craft a project file that would allow arbitrary code execution.
-
High 7.8
ICSA-22-055-01 FATEK Automation FvDesigner
The affected product is vulnerable to an out-of-bounds write while processing project files, which allows an attacker to craft a project file that would allow arbitrary code execution.
-
Medium 5.9
Use-after-free vulnerability in ESET products for Linux
Use-after-free in eset_rtp kernel module used in ESET products for Linux allows potential attacker to trigger denial-of-service condition on the system.
-
Medium 6.2
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the smbcd dae…
-
Unscored —
JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1,…
-
Unscored —
JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon.
-
Unscored —
In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possib…
-
Unscored —
In JetBrains IntelliJ IDEA before 2021.2.4, local code execution (without permission from a user) upon opening a projec…
-
Unscored —
JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page.
-
Unscored —
In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions.
-
Unscored —CVE-2022-24342 Public exploit
In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible.
-
Unscored —
In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the e…
-
Unscored —
In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible.
-
Unscored —
JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS.
-
Unscored —
JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS.
-
Unscored —
In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissio…
-
Unscored —
In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to …
-
Unscored —
JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent …
-
Unscored —
In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server.
-
Unscored —
In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible.
-
Unscored —
In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie.
-
Unscored —
In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible.
-
Unscored —
In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible.
-
Medium 5.3
Improper Locking in JetBrains Kotlin
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
-
Unscored —
In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS.
-
Unscored —
In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions.
-
Unscored —
HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201-1, and v202201-2 were configured to log inbound HTTP reque…
-
Unscored —
In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address.
-
Unscored —
An authenticated user can upload an XML file containing an XSS via the ITSM module of EyesOfNetwork 5.3.11, resulting i…
-
High 7.5
Write access to VMO data through copy-on-write in Fuchsia
An issue exists in Fuchsia where VMO data can be modified through access to copy-on-write snapshots. A local attacker could modify objects in the VMO that they do not have permission to. We recommend upgrading past commit d97c05d2301799ed585620a9c5c739d36e7b5…
-
Medium 5.0
Privilege escalation through command injection in fscrypt
The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control over mountpoint paths could potentially escalate their privileg…
-
Medium 5.5
Local Denial of Service in fscrypt PAM module
The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prev…
-
Medium 5.5
Denial of Service in fscrypt
fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt 0.3.3 or above and adjusting the permissions on existing fscrypt meta…
-
Medium 4.3
Business Logic Errors in dolibarr/dolibarr
Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.