Archive
20 September 2022
Vulnerabilities first published on this day (UTC), newest first.
51 results · Clear filters · Feed
-
High 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') McWebserver Minecraft Mod
McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads. Path traversal in McWebserver Minecraft Mod for Fabric and Quilt up to and including 0.1.2.1 and McWebserver Minecraft Mod for Forge up to and including 0.1.1 allows…
-
High 7.8
A logic issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, tvOS 15.6, macOS Mon…
-
High 8.8
This issue was addressed with improved environment sanitization. This issue is fixed in macOS Monterey 12.4. A sandboxe…
-
High 8.8
A vulnerability in the ClearPass Policy Manager web-based management interface exists which exposes some endpoints to a…
-
High 8.8
Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote a…
-
High 8.8
Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote a…
-
High 8.8
Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote a…
-
High 8.8
Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote a…
-
High 7.8
A local Denial of Service (DoS) and local arbitrary code execution vulnerability that could potentially lead to a loss …
-
High 8.8
A remote potential adjacent denial of service (DoS) and potential adjacent arbitrary code execution vulnerability that …
-
High 7.8
An isolated local disclosure of information and potential isolated local arbitrary code execution vulnerability that co…
-
High 8.8
Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote a…
-
High 8.8
A potential local adjacent arbitrary code execution vulnerability that could potentially lead to a loss of confidential…
-
High 7.8
A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their u…
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 8.8
A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to…
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 7.5
A vulnerability exists in the ClearPass Policy Manager Guest User Interface that can allow an unauthenticated attacker …
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run …
-
High 7.5
Random number seed fixed during compilation
The JS Compute Runtime for Fastly's Compute@Edge platform provides the environment JavaScript is executed in when using the Compute@Edge JavaScript SDK. In versions prior to 0.5.3, the `Math.random` and `crypto.getRandomValues` methods fail to use sufficientl…
-
High 7.5
A Huawei device has an input verification vulnerability. Successful exploitation of this vulnerability may lead to DoS …
-
High 7.1
TIBCO Spotfire Server Blind SSRF vulnerability
The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server S…
-
High 7.5
An exploitable firmware modification vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender. An atta…
-
High 8.8CVE-2022-37205 Public exploit
JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filter…
-
High 8.2
The arbitrary write vulnerability in S3Resume2Pei leads to arbitrary code execution during PEI phase.
A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs)…
-
High 8.2
SMM memory corruption vulnerability in OverClockSmiHandler SMM driver
An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than operating system (OS) and completely isolated from it. Running arbitrary code in SM…
-
High 8.8
Stack overflow vulnerability in SMI handler on SmmSmbiosElog.
An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than operating system (OS) and completely isolated from it. Running arbitrary code in SM…
-
High 7.2
Arbitrary write vulnerability in SbPei module leads to arbitrary code execution during PEI phase.
A potential attacker can write one byte by arbitrary address at the time of the PEI phase (only during S3 resume boot mode) and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of…
-
High 8.2
The stack buffer overflow vulnerability in PlatformInitAdvancedPreMem leads to arbitrary code execution during PEI phase.
A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs)…
-
High 7.5
steal Inefficient Regular Expression Complexity vulnerability via string variable
A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the string variable in babel.js.
-
High 7.5
WASM3 Improper Input Validation vulnerability
WASM3 v0.5.0 was discovered to contain a segmentation fault via the component op_Select_i32_srs in wasm3/source/m3_exec.h.
-
High 7.5
In the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript allows the smokeping user to g…
-
High 8.8
TestLink v1.9.20 was discovered to contain a Cross-Site Request Forgery (CSRF) via /lib/plan/planView.php.
-
High 7.9
Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially e…
-
High 8.8
Deserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBC
In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leadi…
-
High 7.5
Festo: CPX-CEC-C1 and CMXX, Missing Authentication for Critical Webpage Function
Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service.
-
High 7.5
Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers
A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException…