Archive
September 2022
Vulnerabilities first published in this month (UTC), newest first.
632 results · Clear filters · Feed
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022…
-
High 7.0
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022…
-
High 7.0
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022…
-
High 7.5
Vulnerability in Milesight Video Management Systems (VMS)
This vulnerability exists in Milesight Video Management Systems (VMS), all firmware versions prior to 40.7.0.79-r1, due to improper input handling at camera’s web-based management interface. A remote attacker could exploit this vulnerability by sending a spec…
-
High 7.6
Improper Initialization vulnerability in local server authentication logic
Improper Initialization vulnerability in the local server component of EZVIZ CS-C6N-A0-1C2WFR allows a local attacker to read the contents of the memory space containing the encrypted admin password. This issue affects: EZVIZ CS-C6N-A0-1C2WFR versions prior t…
-
High 8.8
Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb
Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3.
-
High —
Pageflow vulnerable to insecure direct object reference in membership update endpoint
### Impact Pageflow has a membership edit feature which allows users to edit the roles of user memberships associated with an account that they have the `manager` role to (including their own). While the `Entity` dropdown select field is greyed out in the UI,…
-
High —
Pageflow vulnerable to sensitive user data extraction via Ransack query injection
### Impact The attack allows extracting sensitive properties of database objects that are associated with users or entries belonging to an account that the attacker has access to. Pageflow uses the `ActiveAdmin` Ruby library to provide some management feature…
-
High 7.5
Uncontrolled Resource Consumption in cmark-gfm
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent d…
-
High 7.5
A vulnerability exists during the start of the affected SYS600, where an input validation flaw causes a buffer-overflow while reading a specific configuration file. Subsequently SYS600 will fail to start. The configuration file can only be accessed by ...
Improper Input Validation vulnerability in Hitachi Energy MicroSCADA X SYS600 while reading a specific configuration file causes a buffer-overflow that causes a failure to start the SYS600. The configuration file can only be accessed by an administrator acces…
-
High 7.5
A vulnerability exists in the handling of a specially crafted IEC 61850 packet with a valid data item but with incorrect data type in the IEC 61850 OPC Server. The vulnerability may cause a denial-of-service on the IEC 61850 OPC Server part of the SYS ...
Improper Input Validation vulnerability in the handling of a specially crafted IEC 61850 packet with a valid data item but with incorrect data type in the IEC 61850 OPC Server in the Hitachi Energy MicroSCADA X SYS600, MicroSCADA Pro SYS600. The vulnerability…
-
High 7.5
A vulnerability exists in the ICCP stack of the affected SYS600 versions due to validation flaw in the process that establishes the ICCP communication. The validation flaw will cause a denial-of-service when ICCP of SYS600 is request to forward any da ...
Improper Input Validation vulnerability exists in the Hitachi Energy MicroSCADA X SYS600's ICCP stack during the ICCP communication establishment causes a denial-of-service when ICCP of SYS600 is request to forward any data item updates with timestamps too di…
-
High 7.5
DoS in axum-core due to missing request size limit
<bytes::Bytes as axum_core::extract::FromRequest>::from_request would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large (or infinite) body your server might run out of memory and crash. This …
-
High 8.1
libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.
-
High 8.4
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout …
-
High 8.4
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kerne…
-
High 7.8
LIEF vulnerable to heap based buffer overflow via print_binary function
LIEF commit 365a16a was discovered to contain a heap-buffer overflow via the function print_binary at /c/macho_reader.c.
-
High 8.8
Unisys Data Exchange Management Studio before 6.0.IC2 and 7.x before 7.0.IC1 doesn't have an Anti-CSRF token to authent…
-
High 7.8
A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descrip…
-
High 7.8
In declareDuplicatePermission of ParsedPermissionUtils.java, there is a possible way to obtain a dangerous permission w…
-
High 7.5
Git Repository Disclosure in Onedev
Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. All files in the /opt/onedev/sites/ directory are exposed and can be read by unauthenticated users. This directory contains all projects, including their bare git repos and build artifact…
-
High 7.3
Visual Studio Code Elevation of Privilege Vulnerability
Visual Studio Code Elevation of Privilege Vulnerability
-
High 7.8
AV1 Video Extension Remote Code Execution Vulnerability
AV1 Video Extension Remote Code Execution Vulnerability
-
High 7.7
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
-
High 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft Office Visio Remote Code Execution Vulnerability
-
High 7.3
Raw Image Extension Remote Code Execution Vulnerability
Raw Image Extension Remote Code Execution Vulnerability
-
High 8.8
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
-
High 8.8
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
-
High 7.8
Azure Guest Configuration and Azure Arc-enabled servers Elevation of Privilege Vulnerability
Azure Guest Configuration and Azure Arc-enabled servers Elevation of Privilege Vulnerability