Archive
February 2022
Vulnerabilities first published in this month (UTC), newest first.
429 results · Clear filters · Feed
-
High 7.0
BD Pyxis Products - Hardcoded Credentials
Hardcoded credentials are used in specific BD Pyxis products. If exploited, threat actors may be able to gain access to the underlying file system and could potentially exploit application files for information that could be used to decrypt application creden…
-
High 8.4
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functi…
KEV Aug 21, 2024 -
High 7.5
A CWE-787: Out-of-bounds Write vulnerability exists that could cause denial of service when an attacker sends a special…
-
High 7.5
A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attac…
-
High 7.5
A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web…
-
High 8.3
Mitsubishi Electric Factory Automation Products Path Traversal
Multiple Mitsubishi Electric Factory Automation products have a vulnerability that allows an attacker to execute arbitrary code.
-
High 8.3
Mitsubishi Electric Factory Automation Engineering Products Unquoted Search Path or Element
Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use this vulnerability to obtain information, modify information, and cause a denial-of-service condition.
-
High 8.4
An improper boundary check in eden_runtime hal service prior to SMR Feb-2022 Release 1 allows arbitrary memory write an…
-
High 8.6
Improper input validation in Exynos baseband prior to SMR Feb-2022 Release 1 allows attackers to send arbitrary NAS sig…
-
High 7.1
Unprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitra…
-
High 7.5
Denial of Service (DoS)
This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. **Note:** This is a bypass of CVE-2020-8136 (https://security.snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-1290382).
-
High 7.5
Drupal core access bypass vulnerability
Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.
-
High 7.5
Exposure of Resource to Wrong Sphere in Drupal Core
Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x version…
-
High 8.8
Deserialization of untrusted data in the Hessian Component of Apache Cayenne 4.1 with older Java versions
Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence (ROP) feature is a web services-based technology that provides object persistence and query functionality to 'remote' appl…
-
High 8.4
Possible use after free scenario in compute offloads to DSP while multiple calls spawn a dynamic process in Snapdragon …
-
High 8.4
Possible null pointer dereference due to lack of WDOG structure validation during registration in Snapdragon Auto, Snap…
-
High 8.4
Possible integer overflow due to improper fragment datatype while calculating number of fragments in a request message …
-
High 7.8
Improper validation of data length received from DMA buffer can lead to memory corruption. in Snapdragon Auto, Snapdrag…
-
High 8.4
Lack of null check while freeing the device information buffer in the Bluetooth HFP protocol can lead to a NULL pointer…
-
High 7.5
Possible assertion due to improper size validation while processing the DownlinkPreemption IE in an RRC Reconfiguration…
-
High 7.8
Improper validation of maximum size of data write to EFS file can lead to memory corruption in Snapdragon Auto, Snapdra…
-
High 7.8
Possible out of bounds write due to improper validation of number of GPIOs configured in an internal parameters array i…
-
High 8.4
Improper validation of input when provisioning the HDCP key can lead to memory corruption in Snapdragon Auto, Snapdrago…
-
High 7.8
Improper size validation of QXDM commands can lead to memory corruption in Snapdragon Compute, Snapdragon Consumer IOT,…
-
High 8.1
OS Command Injection in microweber/microweber
OS Command Injection in Packagist microweber/microweber prior to 1.2.11.
-
High 7.4
Exposure of sensitive information in Action Pack
Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local stat…
-
High 7.5
Dependency verification bypass in Gradle
Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This occurs whe…
-
High 7.0
GlobalProtect App: Improper Link Resolution Vulnerability Leads to Local Privilege Escalation
An improper link resolution before file access ('link following') vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that enables a local attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileg…
-
High 7.4
GlobalProtect App: Privilege Escalation Vulnerability When Using Connect Before Logon
An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that enables a local attacker to escalate to SYSTEM or root privileges when authenticating with Connect Bef…
-
High 8.8
ThinkPHP Remote Code Execution (RCE) vulnerability
A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obtain server control privileges.
-
High 8.4
Use of Out-of-range Pointer Offset in vim/vim
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.
-
High 7.0
Improper Validation of Integrity Check Value in TensorFlow
### Impact The implementation of [`tf.sparse.split`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/sparse_split_op.cc#L26-L102) does not fully validate the input arguments. Hence, a malicious us…
-
High —
Cross Site Request Forgery in concrete5/concrete5
A cross-site request forgery vulnerability exists in Concrete CMS <v9 that could allow an attacker to make requests on behalf of other users.
-
High 7.8
SecuwaySSL OS command injection vulnerability
An OS command injection was found in SecuwaySSL, when special characters injection on execute command with runCommand arguments.
-
High 8.4
Vulnerability in TP-LinK TL-WR841N wireless router
The vulnerability exists in TP-Link TL-WR841N V11 3.16.9 Build 160325 Rel.62500n wireless router due to transmission of authentication information in cleartextbase64 format. Successful exploitation of this vulnerability could allow a remote attacker to interc…
-
High 8.1
tobesoft nexacro arbitrary file creation vulnerability
improper input validation vulnerability in nexacro permits copying file to the startup folder using rename method.
-
High 7.5
swift-nio-http2 vulnerable to denial of service via ALTSVC or ORIGIN frames
A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical error after …
-
High 7.5
swift-nio-http2 vulnerable to denial of service via mishandled HPACK variable length integer encoding
A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HPACK-encoded header block. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. There are a number of implemen…
-
High 7.5
swift-nio-http2 vulnerable to denial of service via invalid HTTP/2 HEADERS frame length
A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical er…
-
High 7.8
Improper restriction of XML external entity for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an …