Archive
9 March 2022
Vulnerabilities first published on this day (UTC), newest first.
184 results · Feed
-
Low 3.3
Media Foundation Information Disclosure Vulnerability
Media Foundation Information Disclosure Vulnerability
-
Medium 4.7
Windows Hyper-V Denial of Service Vulnerability
Windows Hyper-V Denial of Service Vulnerability
-
Medium 5.5
Windows Media Center Update Denial of Service Vulnerability
Windows Media Center Update Denial of Service Vulnerability
-
High 7.0
Xbox Live Auth Manager for Windows Elevation of Privilege Vulnerability
Xbox Live Auth Manager for Windows Elevation of Privilege Vulnerability
-
Unscored —
In preloader (usb), there is a possible permission bypass due to a missing proper image authentication. This could lead…
-
Unscored —
In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local esc…
-
Unscored —
In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local esc…
-
Unscored —
In btif, there is a possible memory corruption due to incorrect error handling. This could lead to local escalation of …
-
Unscored —
In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local esc…
-
Unscored —
In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local esc…
-
Unscored —
In ims service, there is a possible AT command injection due to a missing permission check. This could lead to local es…
-
Unscored —
In ims service, there is a possible unexpected application behavior due to incorrect privilege assignment. This could l…
-
Unscored —
In connsyslogger, there is a possible symbolic link following due to improper link resolution. This could lead to local…
-
Unscored —
In vpu, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalat…
-
Unscored —
In ims service, there is a possible escalation of privilege due to a missing permission check. This could lead to local…
-
Unscored —
In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local escal…
-
Unscored —
In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local escal…
-
Unscored —
A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an app…
-
Unscored —CVE-2021-33851 Scanner template
A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an app…
-
Critical 9.8
Directory Traversal Read/Write/Delete at PluginServlet
It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) PluginServlet has directory traversal vulnerabilities at the "/api/appInternals/1.0/plugin/pmx" API. The affected endpoint does not have any input validation of the user's inp…
-
Medium 4.7
Reflected Cross-site Scripting at DsaDataTest
It was discovered that the /DsaDataTest endpoint is susceptible to Cross-site scripting (XSS) attack. It was noted that the Metric parameter does not have any input checks on the user input that allows an attacker to craft its own malicious payload to trigger…
-
Critical 9.4
Directory Traversal Write/Delete/Partial Read at AgentConfigurationServlet
It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentConfigurationServlet has directory traversal vulnerabilities at the "/api/appInternals/1.0/agent/configuration" API. The affected endpoint does not have any input validat…
-
Medium 5.3
Directory Traversal Partial Write at AgentDaServlet
It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDaServlet has directory traversal vulnerabilities at the "/api/appInternals/1.0/agent/da/pcf" API. The affected endpoint does not have any validation of the user's input …
-
High 7.8
Local privilege escalation due to misconfigured write permission on .debug_command.config file
It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json string that contains a list of IDs and pre-configured commands. The config file is subsequently used by the "/api/appIntern…
-
Critical 9.8
Remote Code Execution at AgentControllerServlet
It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) has Remote Code Execution vulnerabilities in multiple instances of the API requests. The affected endpoints do not have any input validation of the user's input that allowed a m…
-
Critical 9.1
Directory Traversal Delete/Read at AgentDiagnosticServlet
It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDiagnosticServlet has directory traversal vulnerability at the "/api/appInternals/1.0/agent/diagnostic/logs" API. The affected endpoint does not have any input validation…
-
Unscored —
A flaw was found in the io-workqueue implementation in the Linux kernel versions prior to 5.15-rc1. The kernel can pani…
-
Unscored —
SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs,…
-
Unscored —
A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_ne…
-
Unscored —
A flaw was found in the permissions of a log file created by kexec-tools. This flaw allows a local unprivileged user to…
-
High 8.1
login-proxy sends password to attacker-provided domain
A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build service allowed attackers to present users with a expected login form that then sends the clear text credentials to an attacker specified server. This…
-
Medium 5.3
Sensitive Data Disclosure Vulnerability
Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details about the Web Help Desk installation.
-
Unscored —
Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure…
-
Medium 5.5
ICSA-22-062-01 IPCOMM ipDIO
Persistent cross-site scripting (XSS) in the web interface of ipDIO allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into specific fields. The XSS payload will be executed when a legitimate user attempts to…
-
High 8.0
ICSA-22-062-01 IPCOMM ipDIO
The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section where the information is displayed. Injection …
-
High 8.8
ICSA-22-062-01 IPCOMM ipDIO
The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the specific web section where the information is displayed. I…
-
Medium 6.3
ICSA-22-062-01 IPCOMM ipDIO
Persistent cross-site scripting in the web interface of ipDIO allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into a specific parameter. The XSS payload will be executed when a legitimate user attempts t…
-
Critical 9.8
The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allow…
KEV Mar 25, 2022 -
Medium 4.3
Stack overflow in document extractor in Mattermost
A stack overflow bug in the document extractor in Mattermost Server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted Apple Pages document.
-
Medium 5.3
Stack overflow in SAML login in Mattermost
A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted POST body.