Archive
February 2022
Vulnerabilities first published in this month (UTC), newest first.
61 results · Clear filters · Feed
-
Low —
personnummer/go vulnerable to Improper Input Validation
This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure. The vulnerability is determined to be low severi…
-
Low —
Chrono has potential segfault issue in SPIFFE authenticator
### Impact Several vulnerabilities have been reported in the `time` and `chrono` crates related to handling of calls to `localtime_r`. You can follow some of the discussions [here](https://github.com/chronotope/chrono/issues/602) and [here](https://github.com…
-
Low 2.2CVE-2022-24924 Public exploit
An improper access control in LiveWallpaperService prior to versions 3.0.9.0 allows to create a specific named system d…
-
Low 3.8
Information disclosure vulnerability in Edge Panel prior to Android S(12) allows physical attackers to access screensho…
-
Low 3.9
PendingIntent hijacking vulnerability in DataUsageReminderReceiver prior to SMR Feb-2022 Release 1 allows local attacke…
-
Low 3.9
PendingIntent hijacking vulnerability in CpaReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access m…
-
Low 3.3
An Improper access control vulnerability in StBedtimeModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Rele…
-
Low 3.9
PendingIntent hijacking vulnerability in KnoxPrivacyNoticeReceiver prior to SMR Feb-2022 Release 1 allows local attacke…
-
Low 3.5
Wocu Monitoring stored Cross-Site Scripting (XSS)
A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports.
-
Low 3.3
GlobalProtect App: Information Exposure Vulnerability When Using Connect Before Logon
An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the connecting GlobalProtect user when authenticating using Connect Before Logon feature. This issue im…
-
Low 3.7
Retained exploded messages in Keybase clients for macOS and Windows
The Keybase Clients for macOS and Windows before version 5.9.0 fails to properly remove exploded messages initiated by a user. This can occur if the receiving user switches to a non-chat feature and places the host in a sleep state before the sending user exp…
-
Low 2.7
ArangoDB - Blind SSRF when Downloading Foxx Service from URL
In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileg…
-
Low 2.6
Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
-
Low 3.0
OCI Manifest Type Confusion Issue
### Impact Systems that rely on digest equivalence for image attestations may be vulnerable to type confusion. ### Patches Upgrade to at least `v2.8.0-beta.1` if you are running `v2.x` release. If you use the code from the `main` branch, update at least to th…
-
Low 2.4
Disclosure of mail addresses
Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each recipient individually. This issue affects: OTRS AG OTRSCustomContactFields 8.0.x version: 8.0.11 an…
-
Low 3.8
Dynamic field error message is vulnerable to XSS
OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the agent interface, malicious code might be exectued in the browser. This issue affects: OTRS AG OTRS 7.0.…
-
Low 3.7
IBM Guardium Data Encryption (GDE) 5.0.0.2 behaves differently or sends different responses under different circumstanc…
-
Low 3.7
An out-of-bounds write vulnerability exists in the URL_decode functionality of Sealevel Systems, Inc. SeaConnect 370W v…
-
Low 3.7
An out-of-bounds write vulnerability exists in the HandleSeaCloudMessage functionality of Sealevel Systems, Inc. SeaCon…
-
Low 3.7
An out-of-bounds write vulnerability exists in the HandleSeaCloudMessage functionality of Sealevel Systems, Inc. SeaCon…
-
Low 2.2
Bypass of Kubernetes API Server proxy TOCTOU
As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part…