Archive
February 2022
Vulnerabilities first published in this month (UTC), newest first.
1,963 results · Feed
-
Unscored —
In cmdq driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local infor…
-
Unscored —
In vow driver, there is a possible out of bounds write due to a stack-based buffer overflow. This could lead to local e…
-
Unscored —
In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio…
-
Unscored —
In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio…
-
Unscored —
In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio…
-
Unscored —
In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio…
-
Unscored —
In system service, there is a possible permission bypass due to a missing permission check. This could lead to local es…
-
High 8.4
Vulnerability in TP-LinK TL-WR841N wireless router
The vulnerability exists in TP-Link TL-WR841N V11 3.16.9 Build 160325 Rel.62500n wireless router due to transmission of authentication information in cleartextbase64 format. Successful exploitation of this vulnerability could allow a remote attacker to interc…
-
High 8.1
tobesoft nexacro arbitrary file creation vulnerability
improper input validation vulnerability in nexacro permits copying file to the startup folder using rename method.
-
Unscored —
Solution Manager (Diagnostics Root Cause Analysis Tools) - version 720, allows an administrator to execute code on all …
-
Unscored —
Due to improper HTML encoding in input control summary, an authorized attacker can execute XSS vulnerability in SAP Bus…
-
Unscored —
A high privileged user who has access to transaction SM59 can read connection details stored with the destination for h…
-
Unscored —
SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53,…
-
Unscored —
S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier R…
-
Unscored —
When a user opens a manipulated JPEG file format (.jpg, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterp…
-
Critical 9.8
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 an…
KEV Aug 18, 2022 -
Unscored —
SAP NetWeaver AS ABAP (Workplace Server) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787, al…
-
Unscored —
When a user opens a manipulated Adobe Illustrator file format (.ai, ai.x3d) received from untrusted sources in SAP 3D V…
-
Unscored —
When a user opens a manipulated Tagged Image File Format (.tiff, 2d.x3d)) received from untrusted sources in SAP 3D Vis…
-
Unscored —
Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may ex…
-
Unscored —
SAP ERP HCM Portugal - versions 600, 604, 608, does not perform necessary authorization checks for a report that reads …
-
Unscored —
Due to improper error handling in SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL6…
-
Unscored —
In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53,…
-
Unscored —
SAP Adaptive Server Enterprise (ASE) - version 16.0, installation makes an entry in the system PATH environment variabl…
-
High 7.5
swift-nio-http2 vulnerable to denial of service via ALTSVC or ORIGIN frames
A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical error after …
-
High 7.5
swift-nio-http2 vulnerable to denial of service via mishandled HPACK variable length integer encoding
A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HPACK-encoded header block. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. There are a number of implemen…
-
High 7.5
swift-nio-http2 vulnerable to denial of service via invalid HTTP/2 HEADERS frame length
A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical er…
-
Low 3.7
Retained exploded messages in Keybase clients for macOS and Windows
The Keybase Clients for macOS and Windows before version 5.9.0 fails to properly remove exploded messages initiated by a user. This can occur if the receiving user switches to a non-chat feature and places the host in a sleep state before the sending user exp…
-
Medium 4.7
Zoom Chat Susceptible to Zip Bombing
The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks in the following product versions: Android before version 5.8.6, iOS before version 5.9.0, Linux before version 5.8.6, macOS before version 5.7.3, and Windows before versio…
-
Medium 4.3
An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 be…
-
Medium 4.2
Incorrect Permission Assignment for Critical Resource in CRI-O
An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel n…
-
Unscored —
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause Denial of Service…
-
Unscored —
A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installa…
-
Unscored —
A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communi…
-
Unscored —
A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communi…
-
Unscored —
A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the se…
-
Unscored —
A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists tha…
-
Unscored —
A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could induce users to perform unintended actions…
-
Unscored —
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker …
-
Unscored —
A CWE-798: Use of Hard-coded Credentials vulnerability exists. If an attacker were to obtain the TLS cryptographic key …