Archive
11 July 2022
Vulnerabilities first published on this day (UTC), newest first.
31 results · Clear filters · Feed
-
Medium 4.4
KubeEdge Websocket Client in package Viaduct: DoS from large response message
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, a large response received by the viaduct WSClient can cause a DoS from memory exhaustion…
-
Medium 4.4
KubeEdge Cloud Stream and Edge Stream DoS from large stream message
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the Cloud Stream server and the Edge Stream server reads the entire message into memory …
-
Medium 4.4
KubeEdge CloudCore Router memory exhaustion
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the CloudCore Router does not impose a limit on the size of responses to requests made b…
-
Medium 4.9
KubeEdge DoS when signing the CSR from EdgeCore
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, EdgeCore may be susceptible to a DoS attack on CloudHub if an attacker was to send a wel…
-
Medium 4.5
KubeEdge Cloud AdmissionController component DoS
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, several endpoints in the Cloud AdmissionController may be susceptible to a DoS attack if…
-
Medium 6.5
KubeEdge Edge ServiceBus module DoS
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the ServiceBus server on the edge side may be susceptible to a DoS attack if an HTTP req…
-
Medium 4.7
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, cont…
-
Medium 4.8
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, cont…
-
Medium 5.1
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, cont…
-
Medium 6.7
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, cont…
-
Medium 5.3
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, cont…
-
Medium 5.3
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, cont…
-
Medium 5.3
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.4, and Dell BSAFE Micro Edition Suite, versions before 4.4, cont…
-
Medium 6.8
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, co…
-
Medium 5.9
No security checking for UnsafeAccess.getInstance() in UnsafeAccessor
UnsafeAccessor (UA) is a bridge to access jdk.internal.misc.Unsafe & sun.misc.Unsafe. Normally, if UA is loaded as a named module, the internal data of UA is protected by JVM and others can only access UA via UA's standard API. The main application can set up…
-
Medium 6.8
IBM SiteProtector Appliance 3.1.1 contains hard-coded credentials, such as a password or cryptographic key, which it us…
-
Medium 4.0
IBM SiteProtector Appliance 3.1.1 allows web pages to be stored locally which can be read by another user on the system…
-
Medium 5.6
Incorrect defaults can cause attackers to bypass rate limitations
Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers.
-
Medium 6.2
Improper authorization vulnerability in Knoxguard prior to SMR Jul-2022 Release 1 allows local attacker to disable keyg…
-
Medium 4.0
Exposure of Sensitive Information in Telephony service prior to SMR Jul-2022 Release 1 allows local attacker to access …
-
Medium 5.1
Use of improper permission in InputManagerService prior to SMR Jul-2022 Release 1 allows unauthorized access to the ser…
-
Medium 4.0
Exposure of Sensitive Information in CSC application prior to SMR Jul-2022 Release 1 allows local attacker to access wi…
-
Medium 4.0
Exposure of Sensitive Information in Messaging application prior to SMR Jul-2022 Release 1 allows local attacker to acc…
-
Medium 6.2
A possible race condition vulnerability in score driver prior to SMR Jul-2022 Release 1 can allow local attackers to in…
-
Medium 4.0
Improper input validation in Contacts Storage prior to SMR Jul-2022 Release 1 allows attacker to access arbitrary file.
-
Medium 6.2
Improper access control vulnerability in TelephonyUI prior to SMR Jul-2022 Release 1 allows attackers to change preferr…
-
Medium 4.0
Unprotected dynamic receiver in Wearable Manager Service prior to SMR Jul-2022 Release 1 allows attacker to launch arbi…
-
Medium 4.0
Implicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows attackers to access some…
-
Medium 4.0
Improper authorization in isemtelephony prior to SMR Jul-2022 Release 1 allows attacker to obtain CID without ACCESS_FI…
-
Medium 5.5
Plaintext Storage of a password in CODESYS V3 OPC DA Server
The CODESYS OPC DA Server prior V3.5.18.20 stores PLC passwords as plain text in its configuration file so that it is visible to all authorized Microsoft Windows users of the system.
-
Medium 6.5
Authentication Bypass by Spoofing in microweber/microweber
Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20.