Archive
February 2022
Vulnerabilities first published in this month (UTC), newest first.
398 results · Clear filters · Feed
-
Medium 4.3
Open Redirect in microweber/microweber
Open Redirect in Packagist microweber/microweber prior to 1.2.11.
-
Medium 6.7
Possible out of bound access of DCI resources due to lack of validation process and resource allocation in Snapdragon A…
-
Medium 6.7
Possible out of bound write due to lack of boundary check for the maximum size of buffer when sending a DCI packet to r…
-
Medium 5.5
Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff v…
-
Medium 5.5
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff…
-
Medium 5.3
Ping Identity PingFederate Password Reset and Password Change Mishandling with an authentication policy in parallel reset flows
When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password.
-
Medium 6.8CVE-2022-0020 Public exploit
Cortex XSOAR: Stored Cross-Site Scripting (XSS) Vulnerability in Web Interface
A stored cross-site scripting (XSS) vulnerability in Palo Alto Network Cortex XSOAR web interface enables an authenticated network-based attacker to store a persistent javascript payload that will perform arbitrary actions in the Cortex XSOAR web interface on…
-
Medium 4.7
GlobalProtect App: Insufficiently Protected Credentials Vulnerability on Linux
An insufficiently protected credentials vulnerability exists in the Palo Alto Networks GlobalProtect app on Linux that exposes the hashed credentials of GlobalProtect users that saved their password during previous GlobalProtect app sessions to other local us…
-
Medium 6.1
GlobalProtect App: Information Exposure Vulnerability When Connecting to GlobalProtect Portal With Single Sign-On Enabled
An information exposure vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows and MacOS where the credentials of the local user account are sent to the GlobalProtect portal when the Single Sign-On feature is enabled in the GlobalProtect …
-
Medium 6.5
PAN-OS: URL Category Exceptions Match More URLs Than Intended in URL Filtering
PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules) regardless of their associated URL category. This is done by creating a custom URL category list or…
-
Medium 4.3
Cisco Prime Service Catalog Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to improper enforcement of Administrator privil…
-
Medium 4.4
Cisco DNA Center Information Disclosure Vulnerability
A vulnerability in the audit log of Cisco DNA Center could allow an authenticated, local attacker to view sensitive information in clear text. This vulnerability is due to the unsecured logging of sensitive information on an affected system. An attacker with …
-
Medium 5.8
Cisco Umbrella Secure Web Gateway File Inspection Bypass Vulnerability
A vulnerability in the Cisco Umbrella Secure Web Gateway service could allow an unauthenticated, remote attacker to bypass the file inspection feature. This vulnerability is due to insufficient restrictions in the file inspection feature. An attacker could ex…
-
Medium 5.5
Integer Overflow or Wraparound in TensorFlow
### Impact The Grappler component of TensorFlow is vulnerable to a denial of service via `CHECK`-failure (assertion failure) in [constant folding](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/…
-
Medium —
Signatures are mistakenly recognized to be valid in jsrsasign
In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.
-
Medium —
User object created with invalid provider data in GoTrue
### Impact _What kind of vulnerability is it? Who is impacted?_ Under certain circumstances a valid user object would have been created with invalid provider metadata. This vulnerability affects everyone running an instance of GoTrue as a service. We advise y…
-
Medium 4.7
Zoom Chat Susceptible to Zip Bombing
The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks in the following product versions: Android before version 5.8.6, iOS before version 5.9.0, Linux before version 5.8.6, macOS before version 5.7.3, and Windows before versio…
-
Medium 4.3
An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 be…
-
Medium 4.2
Incorrect Permission Assignment for Critical Resource in CRI-O
An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel n…
-
Medium 5.5
Uncaught exception in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user t…
-
Medium 5.5
Out-of-bounds read in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user t…
-
Medium 5.5
Improper access control in the Intel(R) Smart Campus Android application before version 6.1 may allow authenticated use…
-
Medium 5.5
Access of uninitialized pointer in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authent…
-
Medium 5.5
Improper access control in the Intel(R) Capital Global Summit Android application may allow an authenticated user to po…
-
Medium 5.5
Out-of-bounds read in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user t…
-
Medium 5.7
Improper input validation in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products befo…
-
Medium 5.5
Incorrect default permissions for the Intel(R) RXT for Chromebook application, all versions, may allow an authenticated…
-
Medium 5.7
Improper conditions check in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products befo…
-
Medium 5.4
Out of bounds read under complex microarchitectural condition in memory subsystem for some Intel Atom(R) Processors may…
-
Medium 5.5
Improper conditions check in the Intel(R) IPP Crypto library before version 2021.2 may allow an authenticated user to p…
-
Medium 5.5
Improper access control in the Intel(R) RealSense(TM) DCM before version 20210625 may allow an authenticated user to po…
-
Medium 5.7
Improper input validation for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and Killer(TM) WiFi in W…
-
Medium 5.5
Out-of-bounds read in some Intel(R) Core(TM) processors with Radeon(TM) RX Vega M GL integrated graphics before version…
-
Medium 6.5
Improper input validation for some Intel(R) Wireless Bluetooth(R) products and Killer(TM) Bluetooth(R) products in Wind…
-
Medium 4.6
Insufficiently protected credentials in USB provisioning for Intel(R) AMT SDK before version 16.0.3, Intel(R) SCS befor…
-
Medium 5.5
Improper isolation of shared resources in network on chip for the Intel(R) 82599 Ethernet Controllers and Adapters may …
-
Medium 5.5
Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticate…
-
Medium 6.5
Improper input validation in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may …
-
Medium 6.5
Improper Validation of Specified Index, Position, or Offset in Input in software for some Intel(R) PROSet/Wireless Wi-F…
-
Medium 6.5
Null pointer dereference in subsystem for Intel(R) AMT before versions 15.0.35 may allow an authenticated user to poten…