Archive
9 November 2022
Vulnerabilities first published on this day (UTC), newest first.
179 results · Feed
-
Medium 5.4
WordPress Simple Video Embedder plugin <= 2.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in James Lao's Simple Video Embedder plugin <= 2.2 on WordPress.
-
Unscored —
IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential i…
-
High 7.5
Insufficient access controls in the AMD Link Android app may potentially result in information disclosure.
-
High 7.5
Insufficient validation of the IOCTL input buffer in AMD μProf may allow an attacker to send an arbitrary buffer leadin…
-
High 7.5
Insufficient validation in the IOCTL input/output buffer in AMD μProf may allow an attacker to bypass bounds checks pot…
-
Unscored —
Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing…
-
High 7.8
An attacker with local access to the system can make unauthorized modifications of the security configuration of the SO…
-
Unscored —
Improper parameters handling in AMD Secure Processor (ASP) drivers may allow a privileged attacker to elevate their pri…
-
Unscored —
Insufficient memory cleanup in the AMD Secure Processor (ASP) Trusted Execution Environment (TEE) may allow an authenti…
-
High 7.8
Insufficient verification of multiple header signatures while loading a Trusted Application (TA) may allow an attacker …
-
Unscored —
Improper parameters handling in the AMD Secure Processor (ASP) kernel may allow a privileged attacker to elevate their …
-
Critical 9.8
An out-of-bounds write vulnerability exists in the PICT parsing pctwread_14841 functionality of Accusoft ImageGear 20.0…
-
Medium 4.3
A leftover debug code vulnerability exists in the console infct functionality of InHand Networks InRouter302 V3.5.45. A…
-
Medium 6.5
A leftover debug code vulnerability exists in the httpd port 4444 upload.cgi functionality of InHand Networks InRouter3…
-
Medium 4.9
A leftover debug code vulnerability exists in the console nvram functionality of InHand Networks InRouter302 V3.5.45. A…
-
Medium 6.5
A leftover debug code vulnerability exists in the console support functionality of InHand Networks InRouter302 V3.5.45.…
-
Medium 6.5
A leftover debug code vulnerability exists in the console verify functionality of InHand Networks InRouter302 V3.5.45. …
-
High 7.4
The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474. The fixes…
-
Medium 6.7
Cortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR Engine
A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system allows a local attacker with shell access to the engine to execute programs with elevated privileges.
-
High 7.5
PHOENIX CONTACT: FL MGUARD DM version 1.12.0 and 1.13.0 Improper Privilege Management
In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on Microsoft Windows does not require login credentials even if configured during installation.Attackers with network access…
-
Medium 6.5
Hardcoded credentials in Kaden PICOFLUX AiR
In the Kaden PICOFLUX AiR water meter an adversary can read the values through wireless M-Bus mode 5 with a hardcoded shared key while being adjacent to the device.
-
High 8.8
WordPress Zoho CRM Lead Magnet plugin <= 1.7.5.8 - Auth. Arbitrary Options Update vulnerability
Auth. (subscriber+) Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin <= 1.7.5.8 on WordPress.
-
Medium 5.4
WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to rule type migration.
-
Critical 9.8
WAGO I/O-Check Service prone to Out-of-bounds Write
In WAGO I/O-Check Service in multiple products an attacker can send a specially crafted packet containing OS commands to crash the diagnostic tool and write memory.
-
High 7.5
WAGO I/O-Check Service prone to Allocation of Resources Without Limits or Throttling
In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denial of service.
-
High 8.2
WAGO I/O-Check Service prone to Out-of-bounds Read
In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denial of service and an limited out-of-bounds read.
-
Critical 9.1
WAGO I/O-Check Service prone to Memory Overflow
In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to crash the iocheck process and write memory resulting in loss of integrity and DoS.
-
High 7.1
openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itself
A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: open…
-
Medium 4.0
Improper authorization vulnerability in StorageManagerService prior to SMR Nov-2022 Release 1 allows local attacker to …
-
Medium 6.2
Improper Authorization in Samsung Billing prior to version 5.0.56.0 allows attacker to get sensitive information.
-
Medium 6.7
Grafana subject to Exposure of Sensitive Information resulting in User enumeration via forget password
Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JSON response contains…
-
Medium 4.3
Improper access control vulnerability in clearAllGlobalProxy in MiscPolicy prior to SMR Nov-2022 Release 1 allows local…
-
Medium 6.4
Grafana contains Improper Input Validation
Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins…
-
Medium 5.3
Improper input validation vulnerability for processing SIB12 PDU in Exynos modems prior to SMR Sep-2022 Release allows …
-
High 7.1
Improper input validation vulnerability in DualOutFocusViewer prior to SMR Nov-2022 Release 1 allows local attacker to …
-
Low 3.6
Improper access control in Samsung Pass prior to version 4.0.05.1 allows attackers to unauthenticated access via keep o…
-
High 8.2
Californium Failing DTLS handshakes causes Data Loss due to throttling blocking processing of records
Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud services. In versions prior to 3.7.0, and 2.7.4, Californium is vulnerable to a Denial of Service. Failing handshakes don't cleanup counters for throttlin…
-
Medium 5.9
Improper access control vulnerability in BootCompletedReceiver_CMCC in DeviceManagement prior to SMR Nov-2022 Release 1…
-
Medium 4.0
Improper access control vulnerability in GalaxyWatch4Plugin prior to versions 2.2.11.22101351 and 2.2.12.22101351 allow…
-
Medium 5.9
Improper access control vulnerability in IpcRxServiceModeBigDataInfo in RIL prior to SMR Nov-2022 Release 1 allows loca…