Archive
2 June 2022
Vulnerabilities first published on this day (UTC), newest first.
8 results · Clear filters · Feed
-
Critical 9.4
A CWE-798: Use of Hard-coded Credentials vulnerability exists that could allow arbitrary code to be executed when root …
-
Critical 9.3
Owl Labs Meeting Owl 5.2.0.15 allows attackers to control the device via a backdoor password (derived from the serial n…
-
Critical —
Login timing attack in ibexa/core
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enou…
-
Critical —
Login timing attack in ezsystems/ezpublish-kernel
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enou…
-
Critical 9.8
Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. A remote unauthenticated att…
-
Critical —
Login timing attack in ezsystems/ezplatform-kernel
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enou…
-
Critical 9.1
Arbitrary file write in dragonfly
An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. This vulnerability is exploited via a crafted URL.
-
Critical —
Embedded Malicious Code in ctx
The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.items() when instantiating Ctx objects.