Archive
12 May 2022
Vulnerabilities first published on this day (UTC), newest first.
41 results · Clear filters · Feed
-
Medium 4.2
HCL Sametime is vulnerable to clickjacking
This vulnerability allows users to execute a clickjacking attack in the meeting's chat.
-
Medium 6.8
HCL Sametime is vulnerable to arbitrary HTTP requests
The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this service is used by the “meetings”-function where users can specify an external URL where the online m…
-
Medium 5.3
HCL Sametime is vulnerable to an information disclosure
Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may or may not be sensitive and does not automatically mean a breach is likely to occur. Overall, any information that cou…
-
Medium 6.3
An SSL certificate host verification vulnerability affects HCL Verse for Android
Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a pro…
-
Medium 6.1
Sysaid – Sysaid Local File Inclusion (LFI)
Sysaid – Sysaid Local File Inclusion (LFI) – An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/examples/index.html" path. in the "Insert/Edit Embedded Media" window Choose Type : iFrame and File/URL : [here is the LFI] Solutio…
-
Medium 5.5
Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS)
Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS) - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting vulnerability. For an attacker to exploit this Cross-Site Scripting vulnerability…
-
Medium 6.8
Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control
Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects him to the service portal or EndUserPortal.JSP, then he needs to change the pat…
-
Medium 4.6
Sysaid – sysaid Open Redirect
Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location: /CommunitySSORedirect.jsp?redirectURL=https://google.com. Unvalidated redirects and forwards are possible when a w…
-
Medium 6.5CVE-2022-22971 Public exploit
Allocation of Resources Without Limits or Throttling in Spring Framework
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.
-
Medium 6.1CVE-2022-28818 EPSS 45%
ColdFusion Reflected Cross-Site Scripting could lead to Arbitrary Code Execution
ColdFusion versions CF2021U3 (and earlier) and CF2018U13 are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be execut…
-
Medium 4.3
A hard-coded password vulnerability exists in the console infactory functionality of InHand Networks InRouter302 V3.5.3…
-
Medium 6.3
An information disclosure vulnerability exists in the router configuration export functionality of InHand Networks InRo…
-
Medium 5.4
A cross-site scripting (xss) vulnerability exists in the info.jsp functionality of InHand Networks InRouter302 V3.5.4. …
-
Medium 5.0
An out of bounds read vulnerability exists in the malware scan functionality of ESTsoft Alyac 2.5.7.7. A specially-craf…
-
Medium 5.5
Unchecked return value in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially ena…
-
Medium 6.7
Unintended intermediary in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user …
-
Medium 6.7
Out-of-bounds write in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to p…
-
Medium 5.5
Processor optimization removal or modification of security-critical code for some Intel(R) Processors may allow an auth…
-
Medium 5.5
Observable behavioral discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable inform…
-
Medium 5.5
Improper access control for some 3rd Generation Intel(R) Xeon(R) Scalable Processors before BIOS version MR7, may allow…
-
Medium 6.8
Hardware debug modes and processor INIT setting that allow override of locks for some Intel(R) Processors in Intel(R) B…
-
Medium 4.6
Sensitive information in resource not removed before reuse in firmware for some Intel(R) SSD and Intel(R) Optane(TM) SS…
-
Medium 4.7
Race condition in firmware for some Intel(R) Optane(TM) SSD, Intel(R) Optane(TM) SSD DC and Intel(R) SSD DC Products ma…
-
Medium 4.6
Protection mechanism failure in firmware for some Intel(R) SSD, Intel(R) SSD DC and Intel(R) Optane(TM) SSD Products ma…
-
Medium 6.8
Exposure of sensitive system information due to uncleared debug information in firmware for some Intel(R) SSD DC, Intel…
-
Medium 6.8
Insufficient control flow management in firmware for some Intel(R) SSD, Intel(R) Optane(TM) SSD and Intel(R) SSD DC Pro…
-
Medium 4.7
Race condition within a thread in firmware for some Intel(R) Optane(TM) SSD and Intel(R) SSD DC Products may allow a pr…
-
Medium 6.7
Improper buffer access in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation …
-
Medium 6.7
Improper buffer restrictions in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escal…
-
Medium 6.7
Improper input validation in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalati…
-
Medium 6.7
Improper input validation in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged u…
-
Medium 5.5
Uncontrolled resource consumption in the Linux kernel drivers for Intel(R) SGX may allow an authenticated user to poten…
-
Medium 5.5
Improper input validation for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable denial…
-
Medium 5.5
Improper access control for some Intel(R) Xeon(R) Processors may allow an authenticated user to potentially enable info…
-
Medium 4.6
Insecure default variable initialization of Intel(R) RealSense(TM) ID Solution F450 before version 2.6.0.74 may allow a…
-
Medium 4.2
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to SQL injection. A remote attacker could send …
-
Medium 4.3
Multiple Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android
A vulnerability affecting F-Secure SAFE browser was discovered. An attacker can potentially exploit Javascript window.open functionality in SAFE Browser which could lead address bar spoofing attacks.
-
Medium 4.3
Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android
A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing attack with address bar spoofing as the address bar was not correct if navigation fails in a loop.
-
Medium 4.4
In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible
-
Medium 4.6
In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possible