Archive
August 2022
Vulnerabilities first published in this month (UTC), newest first.
2,333 results · Feed
-
Medium 6.1
Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Self Cross-Site Scripting (XSS).
Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Information Disclosure, or Self Cross-Site Scripting (XSS). This issue affects: Micro Focus ArcSight Logger versions pr…
-
Medium 6.5
Potential vulnerability has been identified in Micro Focus ArcSight Logger. The vulnerability could be remotely exploited resulting in Information Disclosure.
Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Information Disclosure, or Self Cross-Site Scripting (XSS). This issue affects: Micro Focus ArcSight Logger versions pr…
-
Unscored —
Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 …
-
Unscored —
Honeywell ControlEdge through R151.1 uses Hard-coded Credentials. According to FSCT-2022-0056, there is a Honeywell Con…
-
Unscored —
A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.
-
Medium 5.5
Delta Electronics Delta Robot Automation Studio (DRAS) versions prior to 1.13.20 are affected by improper restrictions …
-
High 7.8
Delta Electronics CNCSoft Stack-based Buffer Overflow
CNCSoft: All versions prior to 1.01.32 does not properly sanitize input while processing a specific project file, allowing a possible stack-based buffer overflow condition.
-
Low 3.3
Delta Electronics CNCSoft Out-of-bounds Read
Delta Electronics CNCSoft (All versions prior to 1.01.32) does not properly sanitize input while processing a specific project file, allowing a possible out-of-bounds read condition.
-
High 7.8
AutomationDirect C-more EA9 HMI Uncontrolled Search Path Element
AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prio…
-
Medium 6.5
Update
Passwords are not adequately encrypted during the communication process between all versions of LS Industrial Systems (LSIS) Co. Ltd LS Electric XG5000 software prior to V4.0 and LS Electric PLCs: all versions of XGK-CPUU/H/A/S/E prior to V3.50, all versions …
-
High 7.5
AutomationDirect C-more EA9 HMI Cleartext Transmission
AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a valid user. This issue affects: AutomationDirect C-more EA9 EA…
-
Unscored —
An out-of-bounds read flaw was found in the Linux kernel’s io_uring module in the way a user triggers the io_read() fun…
-
Critical 9.8CVE-2022-2466 Public exploit
Quarkus does not terminate HTTP requests header context
It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.
-
High 8.8
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's ch…
-
Unscored —
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy head…
-
Unscored —
A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allo…
-
Unscored —
A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a…
-
Unscored —
An issue found in linux-kernel that leads to a race condition in rose_connect(). The rose driver uses rose_neigh->use t…
-
Unscored —
A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition between kobject cr…
-
Unscored —
There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by simulating a …
-
Unscored —
A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of se…
-
High 7.8
Fuji Electric Alpha7 PC Loader Fuji Electric Alpha7 PC Loader
Alpha7 PC Loader (All versions) is vulnerable to a stack-based buffer overflow while processing a specifically crafted project file, which may allow an attacker to execute arbitrary code.
-
Unscored —CVE-2022-2590 Public exploit
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of p…
-
Unscored —
Honeywell Experion LX through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-005…
-
Critical 9.0
Account takeover via cryptographically weak PRNG in NodeBB Forum
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and real-time notifications. `utils.generateUUID`, a helper function available in essentially all versio…
-
High 7.7
Flux CLI Workload Injection
Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration (like Git repositories), and automating updates to configuration when there is new code to deploy. Flux CLI allows users to deploy Flux components into a Kubernetes cluster v…
-
Unscored —
badge is Unmaintained
The maintainer has advised this crate is deprecated and will not receive any maintenance. The crate depends on the deprecated `rusttype` crate and won't receive updates anymore. ## Possible Alternative(s) The below list has not been vetted in any way and may …
-
Unscored —
[20220801] - Core - Multiple Full Path Disclosures because of missing '_JEXEC or die check'
An issue was discovered in Joomla! 4.2.0. Multiple Full Path Disclosures because of missing '_JEXEC or die check' caused by the PSR12 changes.
-
Medium 6.5
Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11
Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and …
-
High 8.8
Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 11
Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15. …
-
Critical 9.8
Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8.
Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgr…
-
Unscored —
Freeciv before 2.6.7 and before 3.0.3 is prone to a buffer overflow vulnerability in the Modpack Installer utility's ha…
-
High 7.5
An issue was discovered in the GNU C Library (glibc) 2.36. When the syslog function is passed a crafted input string la…
-
Unscored —
A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those pack…
-
Unscored —
A flaw was found in the Linux kernel’s implementation of IO-URING. This flaw allows an attacker with local executable p…
-
Unscored —
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause …
-
Unscored —
A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an…
-
Unscored —CVE-2022-1552 EPSS 17%
A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is m…
-
Unscored —
A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an attacker to pass a…
-
Unscored —
An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is …