Archive
August 2022
Vulnerabilities first published in this month (UTC), newest first.
2,333 results · Feed
-
Medium 6.2
ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control
Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add more network clients that may monitor various activities of the Zenon.
-
Medium 5.3
org.apache.activemq:artemis-core-client Vulnerable to Out-of-Bounds Write
A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of mali…
-
High 7.8
ansible-runner vulnerable to shell command injection
A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets exec…
-
Unscored —
A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures. Internal memory l…
-
Unscored —
A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest coul…
-
Unscored —
A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files wi…
-
Unscored —
The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow a…
-
Unscored —
It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive container…
-
Unscored —
It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery …
-
Unscored —
A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a nu…
-
Unscored —
A flaw was found in the Linux kernel’s implementation of reading the SVC RDMA counters. Reading the counter sysctl pani…
-
Unscored —
A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the se…
-
Unscored —
A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providin…
-
Medium 6.7CVE-2021-4178 Public exploit
fabric8 kubernetes-client vulnerable
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.
-
Unscored —
The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be fr…
-
Unscored —
The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be fr…
-
Unscored —
The method PVRSRVBridgeTLDiscoverStreams allocates puiStreamsInt on the heap, fills the contents of the buffer via TLSe…
-
Unscored —
The method PVRSRVBridgePMRPDumpSymbolicAddr allocates puiMemspaceNameInt on the heap, fills the contents of the buffer …
-
Unscored —
An unprivileged app can trigger PowerVR driver to return an uninitialized heap memory causing information disclosure.Pr…
-
Unscored —
In PVRSRVBridgeHeapCfgHeapConfigName, there is a possible leak of kernel heap content due to uninitialized data. This c…
-
Unscored —
In PVRSRVBridgeHeapCfgHeapDetails, there is a possible leak of kernel heap content due to uninitialized data. This coul…
-
High 8.8
Improper token validation leading to code execution in Teleport
Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a …
-
Unscored —CVE-2022-37153 Scanner template
An issue was discovered in Artica Proxy 4.30.000000. There is a XSS vulnerability via the password parameter in /fw.log…
-
Unscored —
mapr is Unmaintained
The `mapr` fork has been merged back into upstream fork `memmap2`. The maintainer(s) have advised `mapr` is deprecated and will not receive any maintenance in favor of using `memmap2`. ## Possible Alternative(s) The below list has not been vetted in any way a…
-
Unscored —
de.fac2 1.34 allows bypassing the User Presence protection mechanism when there is malware on the victim's PC.
-
Unscored —
Stored cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-a…
-
Medium 5.4
exceedone/exment and exceedone/laravel-admin Cross-site Scripting vulnerability
Reflected cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows a remote authe…
-
Unscored —
Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially craf…
-
High 8.8
exceedone/exment and exceedone/laravel-admin SQL Injection vulnerability
SQL injection vulnerability in the Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows remote authenticated attack…
-
Unscored —CVE-2022-37418 Public exploit
The Remote Keyless Entry (RKE) receiving unit on certain Nissan, Kia, and Hyundai vehicles through 2017 allows remote a…
-
Unscored —
The Remote Keyless Entry (RKE) receiving unit on certain Honda vehicles through 2018 allows remote attackers to perform…
-
High 7.5
Denial of Service (DoS)
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.
-
Unscored —
The Remote Keyless Entry (RKE) receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform…
-
High 7.5
Denial of Service (DoS)
The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) via the ExtensionObjects and Variants objects, when it allows unlimited nesting levels, which could result in a stack overflow even if the message size is less than the maximum allowed.
-
High 8.8
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS …
KEV Aug 18, 2022 -
High 7.5
Multiple out-of-bounds write issues were addressed with improved bounds checking. This issue is fixed in macOS Monterey…
-
High 7.8CVE-2022-32894 Exploited
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS …
KEV Aug 18, 2022 -
Unscored —
Flooding SNS firewall versions 3.7.0 to 3.7.29, 3.11.0 to 3.11.17, 4.2.0 to 4.2.10, and 4.3.0 to 4.3.6 with specific fo…
-
Unscored —
A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_…
-
Unscored —
A heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access t…