Archive
7 October 2022
Vulnerabilities first published on this day (UTC), newest first.
38 results · Clear filters · Feed
-
Medium 6.3
IBM InfoSphere Information Server 11.7 does not invalidate session after logout which could allow an authenticated user…
-
Medium 4.3
IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that should on…
-
Medium 6.2
IBM CICS TX 11.1 could allow a local user to cause a denial of service due to improper load handling. IBM X-Force ID: 2…
-
Medium 4.4
IBM QRadar SIEM 7.4 and 7.5 could disclose sensitive information via a local service to a privileged user. IBM X-Force …
-
Medium 5.3
IBM QRadar SIEM 7.4 and 7.5 data node rebalancing does not function correctly when using encrypted hosts which could re…
-
Medium —
Twisted vulnerable to HTTP Request Smuggling Attacks
### Impact Twisted Web is vulnerable to request smuggling attacks: 1. "When presented with two content-length headers, Twisted Web ignored the first header. When the second content-length was set to zero this caused Twisted Web to interpret the request body a…
-
Medium —
Blst vulnerable to incorrect results for some inputs in blst_fp_eucl_inverse function
### Impact Blst versions v0.3.0 to v0.3.2 can produce the incorrect outputs for some inputs to the blst_fp_eucl_inverse function. This could theoretically result in the creation of an invalid signature from correct inputs. However, fuzzing of higher level fun…
-
Medium 6.5
DHCP memory leak
In ISC DHCP 1.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels longer than 63 bytes, could eventually cause the server to run out of memory.
-
Medium 6.5
An option refcount overflow exists in dhcpd
In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is not a corresponding call to option_dereference() to decreme…
-
Medium 4.0
Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows att…
-
Medium 6.4
Improper protection in IOMMU prior to SMR Oct-2022 Release 1 allows unauthorized access to secure memory.
-
Medium 4.3
Improper authorization vulnerability in Samsung Internet prior to version 18.0.4.14 allows physical attackers to add bo…
-
Medium 5.9
Insertion of Sensitive Information into Log in PushRegIdUpdateClient of SReminder prior to 8.2.01.13 allows attacker to…
-
Medium 4.0
Improper access control vulnerability in ContentsSharingActivity.java SmartThings prior to version 1.7.89.0 allows atta…
-
Medium 4.0
Sensitive log information leakage vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthor…
-
Medium 4.0
Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows att…
-
Medium 4.0
Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows att…
-
Medium 4.4
Improper access control vulnerability in QuickShare prior to version 13.2.3.5 allows attackers to access sensitive info…
-
Medium 4.9
Use after free vulnerability in set_nft_pid and signal_handler function of NFC driver prior to SMR Oct-2022 Release 1 a…
-
Medium 5.9
Improper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks MAC address of the connected …
-
Medium 5.3
Improper authorization in Dynamic Lockscreen prior to SMR Sep-2022 Release 1 in Android R(11) and 3.3.03.66 in Android …
-
Medium 5.9
Unprotected Receiver in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to record video w…
-
Medium 4.0
Improper access control vulnerability in CocktailBarService prior to SMR Oct-2022 Release 1 allows local attacker to bi…
-
Medium 5.4CVE-2022-39291 Public exploit
Denial of service through logs in zoneminder
ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new data into the logs stored by Zoneminder. This was …
-
Medium 4.0
Improper access control vulnerability in Samsung Checkout prior to version 5.0.55.3 allows attackers to access sensitiv…
-
Medium 5.1
Improper access control vulnerability in FACM application prior to SMR Oct-2022 Release 1 allows a local attacker to co…
-
Medium 4.4
A use after free vulnerability in perf-mgr driver prior to SMR Oct-2022 Release 1 allows attacker to cause memory acces…
-
Medium 4.0
Implicit intent hijacking vulnerability in UPHelper library prior to version 3.0.12 allows attackers to access sensitiv…
-
Medium 4.0
Improper access control vulnerability in imsservice application prior to SMR Oct-2022 Release 1 allows local attackers …
-
Medium 4.0
Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to…
-
Medium 4.0
Improper access control vulnerability in ProfileSharingAccount in Group Sharing prior to versions 13.0.6.15 in Android …
-
Medium 5.1
Improper component protection vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized…
-
Medium 4.0
Exposure of sensitive information in AT_Distributor prior to SMR Oct-2022 Release 1 allows local attacker to access Ser…
-
Medium 4.0
Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attack…
-
Medium 4.0
Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows att…
-
Medium 5.9
Improper restriction of broadcasting Intent in MouseNKeyHidDevice prior to SMR Oct-2022 Release 1 leaks MAC address of …
-
Medium 5.0
SourceCodester Web-Based Student Clearance System POST Parameter login.php sql injection
A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. Affected is an unknown function of the file /Admin/login.php of the component POST Parameter Handler. The manipulation of the argument txtusern…
-
Medium 5.3
Liferay Portal Insecure Default Configuration in auth.login.prompt.enabled
An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and pages.