Archive
8 March 2022
Vulnerabilities first published on this day (UTC), newest first.
74 results · Feed
-
Unscored —
Ericsson Network Manager (ENM) before 21.2 has incorrect access-control behavior (that only affects the level of access…
-
Unscored —
Acer Care Center 4.00.30xx before 4.00.3042 contains a local privilege escalation vulnerability. The user process commu…
-
Unscored —
Acer QuickAccess 2.01.300x before 2.01.3030 and 3.00.30xx before 3.00.3038 contains a local privilege escalation vulner…
-
Unscored —
Trend Micro Password Manager (Consumer) installer version 5.0.0.1262 and below is vulnerable to an Uncontrolled Search …
-
Unscored —
An installer search patch element vulnerability in Trend Micro Portable Security 3.0 Pro, 3.0 and 2.0 could allow a loc…
-
High 7.3
Server-Side Request Forgery (SSRF) and URL Redirection to Untrusted Site ('Open Redirect') in alltube
alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is miti…
-
Medium 5.3
Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 2
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affected. If you use service custom variables in role restrictions, and you regularly decommission service…
-
High 7.5
Regular expression denial of service in Rust's regex crate
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations…
-
Medium 4.3
Advanced permissions is not respected for subfolders in Nextcloud server
Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolders, for example, a u…
-
Medium 5.3
User enumeration setting not respected in Nextcloud server
Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumeration settings by the administrator. This allowed a user to enumerate other users on the instance, even…
-
Low 2.4
Nextcloud Talk app exposes chat messages on lockscreen
Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen state when a call was incoming. If an attacker got physical access to the locked phone, and the victi…
-
Medium 4.7
Geolocation preview links can be set to arbitrary links in nextcloud talk
Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation preview in the Nextcloud Talk application due to a lack of validation on the link. This could result in an open-redirect, but…
-
Unscored —
Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the …
-
Unscored —
A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by th…
-
Unscored —
A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Lin…
-
Unscored —
A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCP…
-
Unscored —
A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission s…
-
Low 1.9
Information Exposure vulnerability in Galaxy Watch3 Plugin prior to version 2.2.09.22012751 allows attacker to access p…
-
Low 1.9
Information Exposure vulnerability in Watch Active2 Plugin prior to version 2.2.08.22012751 allows attacker to access p…
-
Low 1.9
Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access pa…
-
Low 1.9
Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.22012751 allows attacker to access pa…
-
Low 1.9
Information Exposure vulnerability in Galaxy S3 Plugin prior to version 2.2.03.22012751 allows attacker to access passw…
-
Medium 6.2
Improper access control vulnerability in Samsung Account prior to version 13.1.0.1 allows attackers to access to the au…
-
Medium 4.0
Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applicat…
-
Low 1.9
Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.220126741 allows attackers to access …
-
Medium 4.0
An use after free vulnerability in sdp driver prior to SMR Mar-2022 Release 1 allows kernel crash.
-
Low 3.3
Improper use of SMS buffer pointer in Shannon baseband prior to SMR Mar-2022 Release 1 allows OOB read.
-
Medium 4.2
A vulnerable design in fingerprint matching algorithm prior to SMR Mar-2022 Release 1 allows physical attackers to perf…
-
Medium 5.3
OOB read vulnerability in hdcp2 device node prior to SMR Mar-2022 Release 1 allow an attacker to view Kernel stack memo…
-
Medium 6.5
Improper boundary check in UWB stack prior to SMR Mar-2022 Release 1 allows arbitrary code execution.
-
Medium 4.0
Improper authentication in One UI Home prior to SMR Mar-2022 Release 1 allows attacker to generate pinned-shortcut with…
-
Medium 4.1
Improper authentication in Samsung Lock and mask apps setting prior to SMR Mar-2022 Release 1 allows attacker to change…
-
Medium 5.5
PendingIntent hijacking vulnerability in Weather application prior to SMR Mar-2022 Release 1 allows local attackers to …
-
Medium 5.5
PendingIntent hijacking vulnerability in Wearable Manager Installer prior to SMR Mar-2022 Release 1 allows local attack…
-
Medium 4.2
Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows phys…
-
High 7.9
Improper access control vulnerability in dynamic receiver in ApkInstaller prior to SMR MAR-2022 Release allows unauthor…
-
Medium 4.4
An Improper access control vulnerability in StRetailModeReceiver in Wear OS 3.0 prior to Firmware update MAR-2022 Relea…
-
Medium 4.1
Unprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app withou…
-
Medium 5.9
Security misconfiguration of RKP in kernel prior to SMR Mar-2022 Release 1 allows a system not to be protected by RKP.
-
Unscored —
SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messa…