Archive
11 July 2022
Vulnerabilities first published on this day (UTC), newest first.
205 results · Feed
-
Medium 4.4
KubeEdge Websocket Client in package Viaduct: DoS from large response message
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, a large response received by the viaduct WSClient can cause a DoS from memory exhaustion…
-
Medium 4.4
KubeEdge Cloud Stream and Edge Stream DoS from large stream message
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the Cloud Stream server and the Edge Stream server reads the entire message into memory …
-
Medium 4.4
KubeEdge CloudCore Router memory exhaustion
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the CloudCore Router does not impose a limit on the size of responses to requests made b…
-
Medium 4.9
KubeEdge DoS when signing the CSR from EdgeCore
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, EdgeCore may be susceptible to a DoS attack on CloudHub if an attacker was to send a wel…
-
Medium 4.5
KubeEdge Cloud AdmissionController component DoS
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, several endpoints in the Cloud AdmissionController may be susceptible to a DoS attack if…
-
Medium 6.5
KubeEdge Edge ServiceBus module DoS
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the ServiceBus server on the edge side may be susceptible to a DoS attack if an HTTP req…
-
High 7.5
Valinor error messages leading to potential data exfiltration
Valinor is a PHP library that helps to map any input into a strongly-typed value object structure. Prior to version 0.12.0, Valinor can use `Throwable#getMessage()` when it should not have permission to do so. This is a problem with cases such as an SQL excep…
-
Critical 9.1
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, co…
-
Medium 4.7
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, cont…
-
Medium 4.8
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, cont…
-
Medium 5.1
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, cont…
-
Medium 6.7
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, cont…
-
Medium 5.3
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, cont…
-
Medium 5.3
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, cont…
-
Medium 5.3
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.4, and Dell BSAFE Micro Edition Suite, versions before 4.4, cont…
-
Medium 6.8
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, co…
-
High 7.1
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, co…
-
Medium 5.9
No security checking for UnsafeAccess.getInstance() in UnsafeAccessor
UnsafeAccessor (UA) is a bridge to access jdk.internal.misc.Unsafe & sun.misc.Unsafe. Normally, if UA is loaded as a named module, the internal data of UA is protected by JVM and others can only access UA via UA's standard API. The main application can set up…
-
Unscored —
EGT-Kommunikationstechnik UG Mediacenter before v2.0 was discovered to contain a cross-site scripting (XSS) vulnerabili…
-
Medium 6.8
IBM SiteProtector Appliance 3.1.1 contains hard-coded credentials, such as a password or cryptographic key, which it us…
-
Medium 4.0
IBM SiteProtector Appliance 3.1.1 allows web pages to be stored locally which can be read by another user on the system…
-
Unscored —
URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port param…
-
Unscored —
Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via cra…
-
Unscored —
An issue was discovered in Druva 6.9.0 for MacOS, allows attackers to gain escalated local privileges via the inSyncDec…
-
Unscored —
An issue was discovered in Druva 6.9.0 for macOS, allows attackers to gain escalated local privileges via the inSyncUpg…
-
Medium 5.6
Incorrect defaults can cause attackers to bypass rate limitations
Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers.
-
High 8.8CVE-2022-31138 Public exploit
OS Command Injection in mailcow
mailcow is a mailserver suite. Prior to mailcow-dockerized version 2022-06a, an extended privilege vulnerability can be exploited by manipulating the custom parameters regexmess, skipmess, regexflag, delete2foldersonly, delete2foldersbutnot, regextrans2, pipe…
-
Unscored —
There is a buffer overflow vulnerability in eSE620X vESS V100R001C10SPC200 and V100R001C20SPC200. An attacker can explo…
-
Unscored —
Improper permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability will af…
-
Unscored —
Improper permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability will af…
-
Unscored —
Vulnerability of pointers being incorrectly used during data transmission in the video framework. Successful exploitati…
-
Unscored —
The SystemUI module has a vulnerability in permission control. If this vulnerability is successfully exploited, users a…
-
Unscored —
The application security module has a vulnerability in permission assignment. Successful exploitation of this vulnerabi…
-
Unscored —
The system module has a read/write vulnerability. Successful exploitation of this vulnerability may affect data confide…
-
Unscored —
The fingerprint module has a vulnerability of overflow in arithmetic addition. Successful exploitation of this vulnerab…
-
Unscored —
The NFC module has a buffer overflow vulnerability. Successful exploitation of this vulnerability may cause exceptions …
-
Unscored —
The NFC module has a buffer overflow vulnerability. Successful exploitation of this vulnerability may cause exceptions …
-
Unscored —
The AT commands of the USB port have an out-of-bounds read vulnerability. Successful exploitation of this vulnerability…
-
Unscored —
The frame scheduling module has a null pointer dereference vulnerability. Successful exploitation of this vulnerability…
-
Unscored —
The frame scheduling module has a null pointer dereference vulnerability. Successful exploitation of this vulnerability…