Archive
February 2022
Vulnerabilities first published in this month (UTC), newest first.
1,963 results · Feed
-
Critical 10.0
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization pro…
-
Medium 5.8
Cisco Umbrella Secure Web Gateway File Inspection Bypass Vulnerability
A vulnerability in the Cisco Umbrella Secure Web Gateway service could allow an unauthenticated, remote attacker to bypass the file inspection feature. This vulnerability is due to insufficient restrictions in the file inspection feature. An attacker could ex…
-
Critical 10.0
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization pro…
-
Unscored —
A reflected cross-site-scripting attack in web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote u…
-
Unscored —
In Stormshield 1.1.0, and 2.1.0 through 2.9.0, an attacker can block a client from accessing the VPN and can obtain sen…
-
Unscored —
Stormshield Network Security (SNS) 1.0.0 through 4.2.3 allows a Denial of Service.
-
Unscored —
Stormshield Network Security (SNS) 3.x has an Integer Overflow in the high-availability component.
-
High 8.8
ThinkPHP Remote Code Execution (RCE) vulnerability
A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obtain server control privileges.
-
Unscored —
In Mahara 21.04 before 21.04.3 and 21.10 before 21.10.1, portfolios created in groups that have not been shared with no…
-
Unscored —
The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending…
-
Critical 9.8
ifme - Insufficient Session Expiration
In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical attacks.
-
Critical 9.8
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
-
High 8.4
Use of Out-of-range Pointer Offset in vim/vim
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.
-
Critical 9.3
NULL Pointer Dereference and Access of Uninitialized Pointer in TensorFlow
### Impact The [code for boosted trees in TensorFlow](https://github.com/tensorflow/tensorflow/blob/e0b6e58c328059829c3eb968136f17aa72b6c876/tensorflow/core/kernels/boosted_trees/stats_ops.cc) is still missing validation. This allows malicious users to read a…
-
High 7.0
Improper Validation of Integrity Check Value in TensorFlow
### Impact The implementation of [`tf.sparse.split`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/sparse_split_op.cc#L26-L102) does not fully validate the input arguments. Hence, a malicious us…
-
Medium 5.5
Integer Overflow or Wraparound in TensorFlow
### Impact The Grappler component of TensorFlow is vulnerable to a denial of service via `CHECK`-failure (assertion failure) in [constant folding](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/…
-
Medium —
Signatures are mistakenly recognized to be valid in jsrsasign
In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.
-
Medium —
User object created with invalid provider data in GoTrue
### Impact _What kind of vulnerability is it? Who is impacted?_ Under certain circumstances a valid user object would have been created with invalid provider metadata. This vulnerability affects everyone running an instance of GoTrue as a service. We advise y…
-
High —
Cross Site Request Forgery in concrete5/concrete5
A cross-site request forgery vulnerability exists in Concrete CMS <v9 that could allow an attacker to make requests on behalf of other users.
-
Unscored —
An Improper Access Control vulnerability exists in Citrix Workspace App for Linux 2012 - 2111 with App Protection insta…
-
Unscored —CVE-2022-0529 Public exploit
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads…
-
Unscored —
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads…
-
Unscored —
In Bluetooth, there is a possible memory corruption due to a logic error. This could lead to local denial of service wi…
-
High 7.8
SecuwaySSL OS command injection vulnerability
An OS command injection was found in SecuwaySSL, when special characters injection on execute command with runCommand arguments.
-
Unscored —
In Bluetooth, there is a possible service crash due to a use after free. This could lead to local escalation of privile…
-
Unscored —
In Bluetooth, there is a possible service crash due to a use after free. This could lead to local escalation of privile…
-
Unscored —
In Bluetooth, there is a possible escalation of privilege due to a missing permission check. This could lead to local e…
-
Unscored —
In Bluetooth, there is a possible information disclosure due to incorrect error handling. This could lead to local info…
-
Unscored —
In Bluetooth, there is a possible escalation of privilege due to a missing permission check. This could lead to local e…
-
Unscored —
In power_hal_manager_service, there is a possible permission bypass due to a stack-based buffer overflow. This could le…
-
Unscored —
In ccu driver, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of…
-
Unscored —
In ccu driver, there is a possible memory corruption due to an incorrect bounds check. This could lead to local escalat…
-
Unscored —
In ion driver, there is a possible information disclosure due to an incorrect bounds check. This could lead to local in…
-
Unscored —
In ion driver, there is a possible information disclosure due to an incorrect bounds check. This could lead to local in…
-
Unscored —
In vcu driver, there is a possible information disclosure due to a use after free. This could lead to local escalation …
-
Unscored —
In Preloader XFLASH, there is a possible escalation of privilege due to an improper certificate validation. This could …
-
Unscored —
In camera driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local inf…
-
Unscored —
In ion driver, there is a possible information disclosure due to an incorrect bounds check. This could lead to local in…
-
Unscored —
In vow driver, there is a possible memory corruption due to a race condition. This could lead to local information disc…
-
Unscored —
In fb driver, there is a possible memory corruption due to a use after free. This could lead to local escalation of pri…