Archive
June 2022
Vulnerabilities first published in this month (UTC), newest first.
485 results · Clear filters · Feed
-
Medium 4.0
Improper access control vulnerability in Quick Share prior to version 13.1.2.4 allows attacker to access internal files…
-
Medium 6.2
DLL hijacking vulnerability in KiesWrapper in Samsung Kies prior to version 2.6.4.22043_1 allows attacker to execute ar…
-
Medium 5.3
Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of c…
-
Medium 4.1
Improper auto-fill algorithm in Samsung Internet prior to version 17.0.1.69 allows physical attackers to guess stored c…
-
Medium 4.0
Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get an user email…
-
Medium 4.3
Improper check in Loader in Samsung Internet prior to 17.0.1.69 allows attackers to spoof address bar via executing scr…
-
Medium 4.0
Implicit Intent hijacking vulnerability in Samsung Account prior to version 13.2.00.6 allows attackers to get email ID.
-
Medium 5.3
Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of c…
-
Medium 5.9
Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the access_to…
-
Medium 4.0
Sensitive information exposure in Sign-out log in Samsung Account prior to version 13.2.00.6 allows attackers to get an…
-
Medium 4.0
Sensitive information exposure in Sign-in log in Samsung Account prior to version 13.2.00.6 allows attackers to get an …
-
Medium 5.5
Exposure of Sensitive Information vulnerability in Samsung Account prior to version 13.2.00.6 allows attacker to access…
-
Medium 5.1
Improper access control vulnerability in My Files prior to version 13.1.00.193 allows attackers to access arbitrary pri…
-
Medium 4.6
Improper authorization in Samsung Pass prior to 1.0.00.33 allows physical attackers to acess account list without authe…
-
Medium 6.2
Improper handling of insufficient permissions vulnerability in addAppPackageNameToAllowList in PersonaManagerService pr…
-
Medium 6.2
Unprotected component vulnerability in DeviceSearchTrampoline in SecSettingsIntelligence prior to SMR Jun-2022 Release …
-
Medium 4.0
Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionEr…
-
Medium 4.0
Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionCo…
-
Medium 4.0
Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in activateVoiceRecogn…
-
Medium 6.2
Implicit Intent hijacking vulnerability in Samsung Account prior to SMR Jun-2022 Release 1 allows attackers to bypass u…
-
Medium 4.0
Improper caller check in AR Emoji prior to SMR Jun-2022 Release 1 allows untrusted applications to use some camera func…
-
Medium 4.0
Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted app…
-
Medium 4.0
Improper access control vulnerability in DofViewer prior to SMR Jun-2022 Release 1 allows attackers to control floating…
-
Medium 4.6
HCL OneTest Server is vulnerable to Cross Origin Resource Sharing: Arbitrary Origin Trusted
Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and serve…
-
Medium 4.7
SourceCodester Prison Management System Inmate sql injection
A vulnerability classified as critical has been found in SourceCodester Prison Management System 1.0. Affected is an unknown function of the file /admin/?page=inmates/view_inmate of the component Inmate Handler. The manipulation of the argument id with the in…
-
Medium 4.7
SourceCodester Prison Management System Visit view_visit.php sql injection
A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /pms/admin/visits/view_visit.php of the component Visit Handler. The manipulation of the argument i…
-
Medium 6.8
Cross-site Scripting (XSS) - Reflected in neorazorx/facturascripts
Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1.
-
Medium 6.2
An improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker…
-
Medium 6.1
bypass of CVE-2021-25640
bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.
-
Medium 4.2
Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator in oauthenticator
OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a gi…
-
Medium 5.9
Use of Uninitialized Variable in trilogy
Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory. Users of the tr…
-
Medium 4.4
BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently e…
-
Medium 4.3
Tracker report renderer and chart widgets leak information in Tuleap
Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users c…
-
Medium 5.5
Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP feature
Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotatio…
-
Medium 5.4
When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all ve…
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 14.9.5, all versions star…
-
Medium 6.5
Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 b…
-
Medium 6.5
Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 b…
-
Medium 5.3
In specific circumstances, trace file buffers in GitLab Runner versions up to 14.3.4, 14.4 to 14.4.2, and 14.5 to 14.5.…
-
Medium 5.3
Unauthenticated homepage note modification
An unauthenticated attacker can send a specially crafted packets to update the “notes” section of the home page of the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 w…