Archive
22 April 2022
Vulnerabilities first published on this day (UTC), newest first.
24 results · Clear filters · Feed
-
Medium 6.7
A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X…
-
Medium 6.7
During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI …
-
Medium 5.0
A denial of service vulnerability was reported in Lenovo Thin Installer prior to version 1.3.0039 that could trigger a …
-
Medium 6.7
A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook mode…
-
Medium 6.7
A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, Thin…
-
Medium 6.7
A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, an…
-
Medium 6.7CVE-2021-3972 Public exploit
A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS …
-
Medium 6.7
A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook device…
-
Medium 6.7
A potential vulnerability in LenovoVariable SMI Handler due to insufficient validation in some Lenovo Notebook models B…
-
Medium 6.8
Versions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify…
-
Medium 5.0
A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow config…
-
Medium 5.5
A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.20.10282 that could allow an at…
-
Medium —
SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc
xml2rfc allows `script` elements in SVG sources. In HTML output having these script elements can lead to XSS attacks. Sample XML snippet: ``` <artwork type="svg" src="data:image/svg+xml,%3Csvg viewBox='0 0 10 10' xmlns='http://www.w3.org/2000/svg'%3E%3Cscript…
-
Medium 5.4
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users …
-
Medium 4.3
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report pages that they should…
-
Medium 4.6
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain credentials from a user's brows…
-
Medium 5.4
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting, caused by improper validation of…
-
Medium 4.3
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attack…
-
Medium 6.5
IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb att…
-
Medium 6.3CVE-2022-1439 Scanner template
Reflected XSS on demo.microweber.org/demo/module/ in microweber/microweber
Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a payla…
-
Medium 4.3
Uffizio GPS Tracker Cross-site Request Forgery
All versions of Uffizio GPS Tracker may allow an attacker to perform unintended actions on behalf of a user.
-
Medium 5.3
Johnson Controls Metasys SCT Pro
The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request.
-
Medium 5.3
Heap-based Buffer Overflow in radareorg/radare2
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause…
-
Medium 5.4
ASUS RT-AX88U - Stored XSS
ASUS RT-AX88U has insufficient filtering for special characters in the HTTP header parameter. A remote attacker with general user privilege can exploit this vulnerability to inject JavaScript and perform Stored Cross-Site Scripting (XSS) attacks.