Archive
24 August 2022
Vulnerabilities first published on this day (UTC), newest first.
66 results · Feed
-
Medium 4.3
This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in macOS Montere…
-
Medium 5.5
A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 1…
-
High 7.8
This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5, watchOS 8.7, iOS 15.6 and iP…
-
High 7.8
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8…
-
High 7.8
This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5, tvOS 15.6, iOS 15.6 and iPad…
-
Medium 5.5
An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Monterey 12.5, macOS Big S…
-
High 7.8
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Monterey 12.5, macO…
-
Critical 9.8
The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, …
-
High 7.8
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8…
-
High 7.8
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5, watchOS 8.7, iOS 15.…
-
Medium 4.3
Kirby CMS 2.5.12 Cross-site Request Forgery
An issue was discovered in Kirby 2.5.12. The delete page functionality suffers from a CSRF flaw. A remote attacker can craft a malicious CSRF page and force the user to delete a page.
-
Medium 5.4
Kirby CMS 2.5.12 Cross-site Scripting
An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages.
-
Unscored —
This module enables you to accept payments from the Elavon payment provider. The module doesn't sufficiently verify tha…
-
Unscored —
An issue was discovered in 72crm 9.0. There is a SQL Injection vulnerability in View the task calendar.
-
Unscored —
72crm 9.0 has an Arbitrary file upload vulnerability.
-
Medium 5.9
ReDoS in uri-template-lite URI.expand function
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method
-
Medium 5.5
ARC Informatique PcVue
The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users
-
Critical 9.9CVE-2022-2234 EPSS 42%
mySCADA myPRO Command Injection
An authenticated mySCADA myPRO 8.26.0 user may be able to modify parameters to run commands directly in the operating system.
-
High 8.1
ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control
Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add or alter data points and corresponding attributes. Once such engineering data is used the data visualization will b…
-
Medium 5.9
ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control
Relative Path Traversal vulnerability in ABB Zenon 8.20 allows the user to access files on the Zenon system and user also can add own log messages and e.g., flood the log entries. An attacker who successfully exploit the vulnerability could access the Zenon r…
-
Medium 6.2
ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control
Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add more network clients that may monitor various activities of the Zenon.
-
Medium 5.3
org.apache.activemq:artemis-core-client Vulnerable to Out-of-Bounds Write
A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of mali…
-
High 7.8
ansible-runner vulnerable to shell command injection
A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets exec…
-
Unscored —
A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures. Internal memory l…
-
Unscored —
A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest coul…
-
Unscored —
A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files wi…
-
Unscored —
The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow a…
-
Unscored —
It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive container…
-
Unscored —
It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery …
-
Unscored —
A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a nu…
-
Unscored —
A flaw was found in the Linux kernel’s implementation of reading the SVC RDMA counters. Reading the counter sysctl pani…
-
Unscored —
A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the se…
-
Unscored —
A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providin…
-
Medium 6.7CVE-2021-4178 Public exploit
fabric8 kubernetes-client vulnerable
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.
-
Unscored —
The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be fr…
-
Unscored —
The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be fr…
-
Unscored —
The method PVRSRVBridgeTLDiscoverStreams allocates puiStreamsInt on the heap, fills the contents of the buffer via TLSe…
-
Unscored —
The method PVRSRVBridgePMRPDumpSymbolicAddr allocates puiMemspaceNameInt on the heap, fills the contents of the buffer …
-
Unscored —
An unprivileged app can trigger PowerVR driver to return an uninitialized heap memory causing information disclosure.Pr…
-
Unscored —
In PVRSRVBridgeHeapCfgHeapConfigName, there is a possible leak of kernel heap content due to uninitialized data. This c…