Archive
16 March 2022
Vulnerabilities first published on this day (UTC), newest first.
151 results · Feed
-
Low —
node-ipc behavior change
node-ipc starting in version 11.0.0 and prior to version 12.0.0 includes a message from the maintainer that is written to the user’s desktop. Please review the version changes before proceeding.
-
Low —
Hidden functionality in node-ipc
The package node-ipc version 9.2.2 is vulnerable to hidden functionality that was introduced by the maintainer. The package uses a dependency that writes a file to disk that does not pertain to the functionality of the package and is not included in versions …
-
Unscored —
FISCO-BCOS release-3.0.0-rc2 was discovered to contain an issue where a malicious node, via a malicious viewchange pack…
-
Unscored —
EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin.
-
High 7.5
Denial of service in go-ethereum
Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amount of messages to a node. This is caused by missing memory in the component /ethash/algorithm.go.
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in /ptms/?page=user of Online Project Time Management System v1.0 all…
-
Unscored —
Online Project Time Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter…
-
Critical 9.1
Improper Verification of Cryptographic Signature in wire-server
wire-server provides back end services for Wire, an open source messenger. In versions of wire-server prior to the 2022-01-27 release, it was possible to craft DSA Signatures to bypass SAML SSO and impersonate any Wire user with SAML credentials. In teams wit…
-
Critical 9.8CVE-2022-23812 Public exploit
Malicious Package
This affects the package node-ipc from 10.1.1 and before 10.1.3. This package contains malicious code, that targets users with IP located in Russia or Belarus, and overwrites their files with a heart emoji. **Note**: from versions 11.0.0 onwards, instead of h…
-
Medium 5.4
Cross-site Scripting (XSS)
The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.
-
Unscored —
A cross-site scripting vulnerability is present in Xbtit 3.1. The stored XSS vulnerability occurs because /ajaxchat/sen…
-
Low 3.7
Denial of Service (DoS)
The package node-lmdb before 0.9.7 are vulnerable to Denial of Service (DoS) when defining a non-invokable ToString value, which will cause a crash during type check.
-
Unscored —
A blind SQL injection vulnerability exists in Xbtit 3.1 via the sid parameter in ajaxchat/getHistoryChatData.php file t…
-
Unscored —CVE-2021-41987 EPSS 16%
In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that …
-
Unscored —
RunAsSpc 4.0 uses a universal and recoverable encryption key. In possession of a file encrypted by RunAsSpc, an attacke…
-
Unscored —
SnapCenter versions prior to 4.5 are susceptible to a vulnerability which could allow a local authenticated attacker to…
-
Medium 5.5
Insertion of Sensitive Information into Log File in ansible
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials.…
-
Unscored —
A flaw was found in htmldoc before v1.9.12. Heap buffer overflow in pspdf_prepare_outpages(), in ps-pdf.cxx may lead to…
-
Unscored —
A flaw was found in htmldoc in v1.9.12. Double-free in function pspdf_export(),in ps-pdf.cxx may result in a write-what…
-
Unscored —
An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx…
-
Unscored —CVE-2022-0918 Public exploit
A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access …
-
Unscored —
Buffer Overflow via crafted client request in Accel-PPP v1.12
The telnet_input_char function in opt/src/accel-pppd/cli/telnet.c suffers from a memory corruption vulnerability, whereby user input cmdline_len is copied into a fixed buffer b->buf without any bound checks. If the server connects with a malicious client, cra…
-
Unscored —
In sendSipAccountsRemovedNotification of SipAccountRegistry.java, there is a possible permission bypass due to an unsaf…
-
Unscored —
In gatt_process_notification of gatt_cl.cc, there is a possible out of bounds write due to an incorrect bounds check. T…
-
Unscored —
In onReceive of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to …
-
Unscored —CVE-2021-39706 Public exploit
In onResume of CredentialStorage.java, there is a possible way to cleanup content of credentials storage due to a missi…
-
Unscored —CVE-2021-39704 Public exploit
In deleteNotificationChannelGroup of NotificationManagerService.java, there is a possible way to run foreground service…
-
Unscored —
In updateState of UsbDeviceManager.java, there is a possible unauthorized access of files due to a confused deputy. Thi…
-
Unscored —
In serviceConnection of ControlsProviderLifecycleManager.kt, there is a possible way to keep service running in foregro…
-
Unscored —
In onCreate of RequestManageCredentials.java, there is a possible way for a third party app to install certificates wit…
-
Unscored —
In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This could lead to l…
-
Unscored —
In checkFileUriDestination of DownloadProvider.java, there is a possible way to bypass external storage private directo…
-
Unscored —
In createOrUpdate of BasePermission.java, there is a possible permission bypass due to a logic error in the code. This …
-
Unscored —
In parse of RoleParser.java, there is a possible way for default apps to get permissions explicitly denied by the user …
-
Unscored —
In onUidStateChanged of AppOpsService.java, there is a possible way to access location without a visible indicator due …
-
Unscored —CVE-2021-39692 Public exploit
In onCreate of SetupLayoutActivity.java, there is a possible way to setup a work profile bypassing user consent due to …
-
Unscored —
In multiple functions of odsign_main.cpp, there is a possible way to persist system attack due to a logic error in the …
-
Unscored —
In setDisplayPadding of WallpaperManagerService.java, there is a possible way to cause a persistent DoS due to improper…
-
Unscored —
In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to a race condit…
-
Unscored —CVE-2021-39685 Public exploit
In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag …