Archive
11 March 2022
Vulnerabilities first published on this day (UTC), newest first.
89 results · Feed
-
Critical 10.0
Command Injection in Parse server
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that…
-
Low —
Infinite loop in Pillow
JpegImagePlugin may append an EOF marker to the end of a truncated file, so that the last segment of the data will still be processed by the decoder. If the EOF marker is not detected as such however, this could lead to an infinite loop where JpegImagePlugin …
-
Unscored —
An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It mishandles software updates such that local third…
-
Unscored —
An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It sends the following Personally Identifiable Infor…
-
Unscored —
An issue was discovered in Luna Simo PPR1.180610.011/202001031830. A pre-installed app with a package name of com.skyro…
-
Unscored —
An issue was discovered in Softing OPC UA C++ SDK before 5.70. A malformed OPC/UA message abort packet makes the client…
-
Unscored —
An issue was discovered in Softing OPC UA C++ SDK before 5.70. An invalid XML element in the type dictionary makes the …
-
High 8.2
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exp…
-
High 8.2
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exp…
-
High 8.2
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exp…
-
High 8.2
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exp…
-
High 8.2
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exp…
-
Medium 4.3
Improper Input Validation
The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed…
-
Medium 6.1CVE-2021-44667 Public exploit
Cross-site Scripting in Nacos
A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters.
-
Medium 6.5
DoS vulnerability: Malformed Resource Identifiers
Wire-ios is a messaging application using the wire protocol on apple's ios platform. In versions prior to 3.95 malformed resource identifiers may render the iOS Wire Client completely unusable by causing it to repeatedly crash on launch. These malformed resou…
-
Unscored —
In ACE2 ColorOS11, the attacker can obtain the foreground package name through permission promotion, resulting in user …
-
Unscored —
An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for w…
-
Medium 6.8
Hardware allows activation of test or debug logic at runtime for some Intel(R) Trace Hub instances which may allow an u…
-
Medium 6.5
Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user t…
-
Unscored —
Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakag…
-
Unscored —
LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.
-
Medium 5.5
Adobe Photoshop 2022 Out-of-bounds Read could lead to Memory leak
Adobe Photoshop versions 23.1.1 (and earlier) and 22.5.5 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exp…
-
High 7.8
Adobe After Effects Heap-based Buffer Overflow Arbitrary code execution
Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by an Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user int…
-
High 7.8
Adobe Illustrator 2022 Buffer Overflow could lead to Arbitrary code execution
Adobe Illustrator version 26.0.3 (and earlier) is affected by a buffer overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interact…
-
High 7.8
Adobe After Effects Out-of-bounds Write could lead to Arbitrary code execution
Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interactio…
-
High 7.8
Adobe After Effects Stack-based Buffer Overflow Arbitrary code execution
Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user int…
-
High 7.8
Adobe After Effects Stack-based Buffer Overflow Arbitrary code execution
Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user int…
-
Unscored —
UUNIVERGE WA 1020 Ver8.2.11 and prior, UNIVERGE WA 1510 Ver8.2.11 and prior, UNIVERGE WA 1511 Ver8.2.11 and prior, UNIV…
-
Unscored —CVE-2022-0853 Public exploit
A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using Us…
-
Medium 5.3
Moodle Information Disclosure vulnerability
It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected
-
High 7.2
Moodle Blind SQL injection possible via MNet authentication
An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.…
-
Medium 5.4
Moodle stored Cross-site Scripting
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
-
Medium 4.3
Moodle Exposure of Sensitive Information to an Unauthorized Actor
The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administrators by default). Moodle versions 3.10 to 3.10.3 are affected.
-
Unscored —
atune before 0.3-0.8 log in as a local user and run the curl command to access the local atune url interface to escalat…
-
Unscored —
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation …
-
Unscored —
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation …
-
Unscored —
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation …
-
Unscored —
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation …
-
Unscored —
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation …
-
Unscored —
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation …