Archive
July 2022
Vulnerabilities first published in this month (UTC), newest first.
1,993 results · Feed
-
Unscored —
An attacker with root account privileges can load any legitimately signed firmware image into the Audio Co-Processor (A…
-
Unscored —
Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to i…
-
Unscored —
Toybox v0.8.7 was discovered to contain a NULL pointer dereference via the component httpd.c. This vulnerability can le…
-
Unscored —
Piwigo v12.2.0 was discovered to contain SQL injection vulnerability via the Search function.
-
High 7.5
Potential Timing Attack Vector in @fastify/bearer-auth
@fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. Ac…
-
Low 3.0
IBM Security Verify Identity Manager 10.0 contains sensitive information in the source code repository that could be us…
-
Medium 5.1
IBM Security Verify Identity Manager 10.0 uses weaker than expected cryptographic algorithms that could allow an attack…
-
Medium 5.3
IBM Security Verify Identity Manager 10.0 uses an inadequate account lockout setting that could allow a remote attacker…
-
Low 3.8
IBM Security Verify Identity Manager 10.0 could allow a privileged user to upload a malicious file by bypassing extensi…
-
Medium 4.3
Guest accounts can list all public channels
The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels.
-
Medium 4.3
Malicious imports can lead to Denial of Service
The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the server by importing large files via the Slack import REST API.
-
Medium 6.5
Team members could access sensitive information of other users via an API call
Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.
-
Medium 6.5
IBM Security Verify Information Queue 10.0.2 could allow an authenticated user to cause a denial of service with a spec…
-
Medium 6.1
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to …
-
Low 3.7
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information c…
-
Medium 5.4
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTTP header …
-
Medium 6.5
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose highly sensiti…
-
Medium 4.3
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose sensitive info…
-
Medium 5.7
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker…
-
Medium 4.3
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 does not sufficiently monitor…
-
Medium 5.4
IBM Engineering Lifecycle Optimization - Publishing 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This v…
-
Unscored —
In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be t…
-
Medium 5.9
relay_cgi.cgi on Dingtian DT-R002 2CH relay devices with firmware 3.1.276A allows an attacker to replay HTTP post reque…
-
Unscored —
In convert2rhel, there's an ansible playbook named ansible/run-convert2rhel.yml which passes the Red Hat Subscription M…
-
Unscored —
A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-ba…
-
High 7.7
ProxyAgent vulnerable to MITM
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally …
-
Unscored —
A reflected DOM-Based XSS vulnerability has been discovered in the Help directory of Veeam Management Pack for Microsof…
-
Unscored —CVE-2022-32223 Public exploit
Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulner…
-
Unscored —
A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by heap overflow …
-
Medium 4.3
Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aeheur.dll component can crash the scanning engine. The exploit can be triggered remotely by an attacker.
-
Unscored —CVE-2022-30024 Public exploit
A buffer overflow in the httpd daemon on TP-Link TL-WR841N V12 (firmware version 3.16.9) devices allows an authenticate…
-
Unscored —
Electronic mall system 1.0_build20200203 is affected vulnerable to SQL Injection.
-
Unscored —
Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not validate the user-provided URL within the crtcmode functio…
-
Unscored —
On Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 devices, the RPC endpoint crtc_fw_upgrade provides a means of p…
-
Unscored —
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC e…
-
Unscored —
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC e…
-
Unscored —
Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not properly sanitize user-controlled parameters within the cr…
-
Unscored —
Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the D…
-
Unscored —
Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the c…
-
Unscored —
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC e…